2025 CVEs (page 214)
Page 214 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-33090 | High | 7.5 | 2025-08-18 | IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cau… |
CVE-2025-27909 | Medium | 5.4 | 2025-08-18 | IBM Concert Software 1.0.0 through 1.1.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain… |
CVE-2025-1759 | Medium | 5.9 | 2025-08-18 | IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap m… |
CVE-2025-43733 | Medium | 5.4 | 2025-08-18 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7 allows a remote authenticated… |
CVE-2025-47206 | High | 8.1 | 2025-08-18 | An out-of-bounds write vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerabi… |
CVE-2025-41242 | Medium | 5.9 | 2025-08-18 | Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can… |
CVE-2025-5296 | High | 7.3 | 2025-08-18 | CWE-59: Improper Link Resolution Before File Access ('Link Following') vulnerability exists that could cause arbitrary data to be written to protected locatio… |
CVE-2025-6625 | High | 7.5 | 2025-08-18 | CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when specific crafted FTP command is sent to the device. |
CVE-2025-57703 | Medium | 6.1 | 2025-08-18 | DIAEnergie - Reflected Cross-site Scripting |
CVE-2025-57702 | Medium | 6.1 | 2025-08-18 | DIAEnergie - Reflected Cross-site Scripting |
CVE-2025-57701 | Medium | 6.1 | 2025-08-18 | DIAEnergie - Reflected Cross-site Scripting |
CVE-2025-57700 | Medium | 6.1 | 2025-08-18 | DIAEnergie - Stored Cross-site Scripting |
CVE-2025-9109 | Low | 3.7 | 2025-08-18 | A security flaw has been discovered in Portabilis i-Diario up to 1.5.0. Affected by this vulnerability is an unknown functionality of the file /password/email… |
CVE-2025-9108 | Medium | 4.3 | 2025-08-18 | Affected is an unknown function of the component Login Page. The manipulation leads to improper restriction of rendered ui layers. It is possible to launch the… |
CVE-2025-9107 | Medium | 4.3 | 2025-08-18 | A vulnerability was determined in Portabilis i-Diario up to 1.5.0. This impacts an unknown function of the file /alunos/search_autocomplete. Executing manipula… |
CVE-2025-9106 | Low | 3.5 | 2025-08-18 | A vulnerability was found in Portabilis i-Diario up to 1.5.0. This affects an unknown function of the file /planos-de-ensino-por-disciplina/ of the component I… |
CVE-2025-9105 | Low | 3.5 | 2025-08-18 | A vulnerability has been found in Portabilis i-Diario up to 1.5.0. The impacted element is an unknown function of the file /planos-de-ensino-por-areas-de-conhe… |
CVE-2025-9104 | Low | 3.5 | 2025-08-18 | A flaw has been found in Portabilis i-Diario up to 1.5.0. The affected element is an unknown function of the file /planos-de-aulas-por-disciplina/ of the compo… |
CVE-2025-9103 | Low | 2.4 | 2025-08-18 | A vulnerability was detected in ZenCart 2.1.0. Affected by this vulnerability is an unknown functionality of the component CKEditor. The manipulation leads to… |
CVE-2025-9102 | Medium | 5.3 | 2025-08-18 | A security vulnerability has been detected in 1&1 Mail & Media mail.com App 8.8.0 on Android. Affected is an unknown function of the file AndroidManifest.xml o… |
CVE-2025-9101 | Low | 3.5 | 2025-08-18 | A weakness has been identified in zhenfeng13 My-Blog up to 1.0.0. This issue affects some unknown processing of the file /admin/tags/save of the component Tag… |
CVE-2025-9100 | Medium | 5.3 | 2025-08-18 | A security flaw has been discovered in zhenfeng13 My-Blog 1.0.0. This vulnerability affects unknown code of the file /blog/comment of the component Frontend Bl… |
CVE-2025-9099 | Medium | 6.3 | 2025-08-18 | A vulnerability was identified in Acrel Environmental Monitoring Cloud Platform up to 20250804. This affects an unknown part of the file /NewsManage/UploadNews… |
CVE-2025-9098 | Medium | 5.3 | 2025-08-18 | A vulnerability was determined in Elseplus File Recovery App 4.4.21 on Android. Affected by this issue is some unknown functionality of the file AndroidManifes… |
CVE-2025-31715 | Critical | 9.8 | 2025-08-18 | In vowifi service, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with no additional… |
CVE-2025-31714 | Medium | 6.8 | 2025-08-18 | In Developer Tools, there is a possible missing verification incorrect input. This could lead to local escalation of privilege with no additional execution pri… |
CVE-2025-31713 | High | 8.4 | 2025-08-18 | In engineer mode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no addi… |
CVE-2025-9097 | Medium | 5.3 | 2025-08-18 | A vulnerability was found in Euro Information CIC banque et compte en ligne App 12.56.0 on Android. Affected by this vulnerability is an unknown functionality… |
CVE-2025-9096 | Low | 3.5 | 2025-08-18 | A vulnerability has been found in ExpressGateway express-gateway up to 1.16.10. Affected is an unknown function in the library lib/rest/routes/apps.js of the c… |
CVE-2025-9095 | Low | 3.5 | 2025-08-17 | A flaw has been found in ExpressGateway express-gateway up to 1.16.10. This issue affects some unknown processing in the library lib/rest/routes/users.js of th… |
CVE-2025-9094 | Medium | 4.3 | 2025-08-17 | A vulnerability was detected in ThingsBoard 4.1. This vulnerability affects unknown code of the component Add Gateway Handler. The manipulation leads to improp… |
CVE-2025-7342 | High | 7.5 | 2025-08-17 | A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the Windows image build process when using the Nut… |
CVE-2025-9093 | Medium | 5.3 | 2025-08-17 | A security vulnerability has been detected in BuzzFeed App 2024.9 on Android. This affects an unknown part of the file AndroidManifest.xml of the component com… |
CVE-2025-9091 | Low | 2.5 | 2025-08-17 | A security flaw has been discovered in Tenda AC20 16.03.08.12. Affected by this vulnerability is an unknown functionality of the file /etc_ro/shadow. The manip… |
CVE-2025-9090 | Medium | 6.3 | 2025-08-17 | A vulnerability was identified in Tenda AC20 16.03.08.12. Affected is the function websFormDefine of the file /goform/telnet of the component Telnet Service. T… |
CVE-2025-9089 | High | 8.8 | 2025-08-17 | A vulnerability was determined in Tenda AC20 16.03.08.12. This issue affects the function sub_48E628 of the file /goform/SetIpMacBind. The manipulation of the… |
CVE-2025-9088 | High | 8.8 | 2025-08-16 | A vulnerability was found in Tenda AC20 16.03.08.12. This vulnerability affects the function save_virtualser_data of the file /goform/formSetVirtualSer. The ma… |
CVE-2025-9087 | High | 8.8 | 2025-08-16 | A vulnerability has been found in Tenda AC20 16.03.08.12. This affects the function set_qosMib_list of the file /goform/SetNetControlList of the component SetN… |
CVE-2025-8878 | Medium | 6.5 | 2025-08-16 | The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerabl… |
CVE-2025-8143 | Medium | 6.4 | 2025-08-16 | The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pcsml_smartlists_h’ parameter in all versions up to, and including, 8.6.7… |
CVE-2025-8142 | High | 8.8 | 2025-08-16 | The Soledad theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.6.7 via the 'header_layout' parameter. This makes… |
CVE-2025-8105 | High | 7.3 | 2025-08-16 | The The Soledad theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.6.7. This is due to the software all… |
CVE-2025-38552 | Critical | 9.4 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: mptcp: plug races between subflow fail and subflow creation We have races similar to the… |
CVE-2025-38551 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix recursived rtnl_lock() during probe() The deadlock appears in a stack tra… |
CVE-2025-38550 | High | 7.8 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() pmc->idev is still used in ip6_mc_cl… |
CVE-2025-38549 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths When processing m… |
CVE-2025-38548 | High | 7.8 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Validate the size of the received input buffer Add buffer_recv_size… |
CVE-2025-38547 | High | 7.3 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps The AXP717 ADC chan… |
CVE-2025-38546 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix memory leak of struct clip_vcc. ioctl(ATMARP_MKIP) allocates struct clip_v… |
CVE-2025-38545 | High | 7.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info While t… |
CVE-2025-38544 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix bug due to prealloc collision When userspace is using AF_RXRPC to provide a se… |
CVE-2025-38543 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: drm/tegra: nvdec: Fix dma_alloc_coherent error check Check for NULL return value with dma… |
CVE-2025-38542 | High | 7.8 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: net: appletalk: Fix device refcount leak in atrtr_create() When updating an existing rout… |
CVE-2025-38541 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: Fix null-ptr-deref in mt7925_thermal_init() devm_kasprintf() returns… |
CVE-2025-38540 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras The Chicony Electronics H… |
CVE-2025-38539 | High | 7.8 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: tracing: Add down_write(trace_event_sem) when adding trace event When a module is loaded… |
CVE-2025-38538 | High | 7.8 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: nbpfaxi: Fix memory corruption in probe() The nbpf->chan[] array is allocated… |
CVE-2025-38537 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: net: phy: Don't register LEDs for genphy If a PHY has no driver, the genphy driver is pro… |
CVE-2025-38536 | High | 7.8 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: net: airoha: fix potential use-after-free in airoha_npu_get() np->name was being used aft… |
CVE-2025-38535 | High | 7.8 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode When transitioning fr… |
CVE-2025-38534 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix copy-to-cache so that it performs collection with ceph+fscache The netfs copy-… |
CVE-2025-38533 | Critical | 9.8 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix the using of Rx buffer DMA The wx_rx_buffer structure contained two DMA a… |
CVE-2025-38532 | High | 7.8 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: net: libwx: properly reset Rx ring descriptor When device reset is triggered by feature c… |
CVE-2025-38531 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: iio: common: st_sensors: Fix use of uninitialize device structs Throughout the various pr… |
CVE-2025-38530 | High | 7.1 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: comedi: pcl812: Fix bit shift out of bounds When checking for a supported IRQ number, the… |
CVE-2025-38529 | High | 7.1 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: comedi: aio_iiro_16: Fix bit shift out of bounds When checking for a supported IRQ number… |
CVE-2025-38528 | High | 7.1 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: bpf: Reject %p% format string in bprintf-like helpers static const char fmt[] = "%p%"; … |
CVE-2025-38527 | Critical | 9.8 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in cifs_oplock_break A race condition can occur in cifs_o… |
CVE-2025-38526 | High | 7.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: ice: add NULL check in eswitch lag check The function ice_lag_is_switchdev_running() is b… |
CVE-2025-38525 | High | 7.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix irq-disabled in local_bh_enable() The rxrpc_assess_MTU_size() function calls d… |
CVE-2025-38524 | High | 7.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix recv-recv race of completed call If a call receives an event (such as incoming… |
CVE-2025-38523 | High | 7.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: cifs: Fix the smbd_response slab to allow usercopy The handling of received data in the s… |
CVE-2025-38522 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: sched/ext: Prevent update_locked_rq() calls with NULL rq Avoid invoking update_locked_rq(… |
CVE-2025-9092 | | 2025-08-16 | Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java - BC-FJA 2.1.0 bc-fips (API modules) allows Excessiv… | |
CVE-2025-38521 | High | 7.1 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix kernel crash when hard resetting the GPU The GPU hard reset sequence… |
CVE-2025-38520 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Don't call mmput from MMU notifier callback If the process is exiting, the mm… |
CVE-2025-38519 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: mm/damon: fix divide by zero in damon_get_intervals_score() The current implementation al… |
CVE-2025-38518 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: x86/CPU/AMD: Disable INVLPGB on Zen2 AMD Cyan Skillfish (Family 17h, Model 47h, Stepping… |
CVE-2025-38517 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: lib/alloc_tag: do not acquire non-existent lock in alloc_tag_top_users() alloc_tag_top_us… |
CVE-2025-38516 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: qcom: msm: mark certain pins as invalid for interrupts On some platforms, the UF… |
CVE-2025-38515 | Medium | 4.7 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: drm/sched: Increment job count before swapping tail spsc queue A small race exists betwee… |
CVE-2025-38514 | High | 7.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix oops due to non-existence of prealloc backlog struct If an AF_RXRPC service so… |
CVE-2025-38513 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: wifi: zd1211rw: Fix potential NULL pointer dereference in zd_mac_tx_to_dev() There is a p… |
CVE-2025-38512 | High | 8.8 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: wifi: prevent A-MSDU attacks in mesh networks This patch is a mitigation to prevent the A… |
CVE-2025-38511 | High | 8.8 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/pf: Clear all LMTT pages on alloc Our LMEM buffer objects are not cleared by defau… |
CVE-2025-38510 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: kasan: remove kasan_find_vm_area() to prevent possible deadlock find_vm_area() couldn't b… |
CVE-2025-38509 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject VHT opmode for unsupported channel widths VHT operating mode notif… |
CVE-2025-38508 | High | 7.3 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: x86/sev: Use TSC_FACTOR for Secure TSC frequency calculation When using Secure TSC, the G… |
CVE-2025-38507 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: avoid bluetooth suspend/resume stalls Ensure we don't stall or panic the k… |
CVE-2025-38506 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: KVM: Allow CPU to reschedule while setting per-page memory attributes When running an SEV… |
CVE-2025-38505 | High | 7.1 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: discard erroneous disassoc frames on STA interface When operating in concu… |
CVE-2025-38504 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: io_uring/zcrx: fix pp destruction warnings With multiple page pools and in some other cas… |
CVE-2025-38503 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix assertion when building free space tree When building the free space tree with… |
CVE-2025-38502 | High | 7.8 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix oob access in cgroup local storage Lonial reported that an out-of-bounds access… |
CVE-2025-8719 | Medium | 6.4 | 2025-08-16 | The Translate This gTranslate Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘base_lang’ parameter in all versions up to… |
CVE-2025-8464 | Medium | 5.3 | 2025-08-16 | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.3.9… |
CVE-2025-7499 | Medium | 5.3 | 2025-08-16 | The BetterDocs – Advanced AI-Driven Documentation, FAQ & Knowledge Base Tool for Elementor & Gutenberg with Encyclopedia, AI Support, Instant Answers plugin fo… |
CVE-2025-8898 | Critical | 9.8 | 2025-08-16 | The Taxi Booking Manager for Woocommerce | E-cab plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and inc… |
CVE-2025-8896 | Medium | 6.4 | 2025-08-16 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2025-8089 | Medium | 5.4 | 2025-08-16 | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'additional' parameter in version less than, or equal to, 2025.6… |