2025 CVEs (page 215)
Page 215 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-6758 | Critical | 9.8 | 2025-08-19 | The Real Spaces - WordPress Properties Directory Theme theme for WordPress is vulnerable to privilege escalation via the 'imic_agent_register' function in all… |
CVE-2025-8357 | Medium | 4.3 | 2025-08-19 | The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file deletion in the /wp-content/uploads directory due to insufficient file path va… |
CVE-2025-5417 | Medium | 6.1 | 2025-08-19 | An insufficient access control vulnerability was found in the Red Hat Developer Hub rhdh/rhdh-hub-rhel9 container image. The Red Hat Developer Hub cluster admi… |
CVE-2025-7496 | Medium | 6.4 | 2025-08-19 | The WPC Smart Compare for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via DOM elements in all versions up to, and including… |
CVE-2025-54862 | Medium | 5.4 | 2025-08-18 | Sante PACS Server web portal is vulnerable to stored cross-site scripting. An attacker could inject malicious HTML codes redirecting a user to a malicious webp… |
CVE-2025-54759 | Medium | 6.1 | 2025-08-18 | Sante PACS Server is vulnerable to stored cross-site scripting. An attacker could inject malicious HTML codes redirecting a user to a malicious webpage and ste… |
CVE-2025-54156 | High | 7.4 | 2025-08-18 | The Sante PACS Server Web Portal sends credential information without encryption. |
CVE-2025-53948 | High | 7.5 | 2025-08-18 | The Sante PACS Server allows a remote attacker to crash the main thread by sending a crafted HL7 message, causing a denial-of-service condition. The applicatio… |
CVE-2025-52584 | High | 7.8 | 2025-08-18 | In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supp… |
CVE-2025-46269 | High | 7.8 | 2025-08-18 | In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supp… |
CVE-2025-9119 | Low | 2.4 | 2025-08-18 | A vulnerability was determined in Netis WF2419 1.2.29433. This vulnerability affects unknown code of the file /index.htm of the component Wireless Settings Pag… |
CVE-2025-53705 | High | 7.8 | 2025-08-18 | In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supp… |
CVE-2025-41392 | High | 7.8 | 2025-08-18 | In Ashlar-Vellum Cobalt, Xenon, Argon, Lithium, and Cobalt Share versions prior to 12.6.1204.204, the affected applications lack proper validation of user-supp… |
CVE-2025-8098 | High | 7.8 | 2025-08-18 | An improper permission vulnerability was reported in Lenovo PC Manager that could allow a local attacker to escalate privileges. |
CVE-2025-55591 | Critical | 9.8 | 2025-08-18 | TOTOLINK-A3002R v4.0.0-B20230531.1404 was discovered to contain a command injection vulnerability in the devicemac parameter in the formMapDel endpoint. |
CVE-2025-55590 | Medium | 6.5 | 2025-08-18 | TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an command injection vulnerability via the component bupload.html. |
CVE-2025-55589 | Medium | 6.5 | 2025-08-18 | TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain multiple OS command injection vulnerabilities via the macstr, bandstr, and clientoff parameters… |
CVE-2025-55588 | High | 7.5 | 2025-08-18 | TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the fw_ip parameter at /boafrm/formPortFw. This vulnerability allows attac… |
CVE-2025-55587 | High | 7.5 | 2025-08-18 | TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the hostname parameter at /boafrm/formMapDelDevice. This vulnerability all… |
CVE-2025-55586 | High | 7.5 | 2025-08-18 | TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain a buffer overflow in the url parameter at /boafrm/formFilter. This vulnerability allows attacke… |
CVE-2025-55585 | Medium | 6.5 | 2025-08-18 | TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain an eval injection vulnerability via the eval() function. |
CVE-2025-55584 | Medium | 5.3 | 2025-08-18 | TOTOLINK A3002R v4.0.0-B20230531.1404 was discovered to contain insecure credentials for the telnet service and root account. |
CVE-2025-55213 | Critical | 9.8 | 2025-08-18 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.9.3 to v1.9.4 ( ope… |
CVE-2025-53192 | High | 8.8 | 2025-08-18 | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Expression/Command Delimiters vulnerability in Apache Commons OGNL. This issue affects Apache Commo… |
CVE-2025-4371 | Medium | 6.8 | 2025-08-18 | A potential vulnerability was reported in the Lenovo 510 FHD and Performance FHD web cameras that could allow an attacker with physical access to write arbitra… |
CVE-2025-32992 | High | 8.5 | 2025-08-18 | Thermo Fisher Scientific ePort through 3.0.0 has Incorrect Access Control. |
CVE-2025-43731 | Medium | 5.4 | 2025-08-18 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0 thro… |
CVE-2025-7693 | | 2025-08-18 | A security issue exists due to improper handling of malformed CIP Forward Close packets during fuzzing. The controller enters a solid red Fault LED state and b… | |
CVE-2025-55300 | | 2025-08-18 | Komari is a lightweight, self-hosted server monitoring tool designed to provide a simple and efficient solution for monitoring server performance. Prior to 1.0… | |
CVE-2025-55299 | Critical | 9.4 | 2025-08-18 | VaulTLS is a modern solution for managing mTLS (mutual TLS) certificates. Prior to 0.9.1, user accounts created through the User web UI have an empty but not N… |
CVE-2025-55296 | Medium | 5.5 | 2025-08-18 | librenms is a community-based GPL-licensed network monitoring system. A stored Cross-Site Scripting (XSS) vulnerability exists in LibreNMS (<= 25.6.0) in the A… |
CVE-2025-55293 | Critical | 9.4 | 2025-08-18 | Meshtastic is an open source mesh networking solution. Prior to v2.6.3, an attacker can send NodeInfo with a empty publicKey first, then overwrite it with a ne… |
CVE-2025-55291 | High | 7.1 | 2025-08-18 | Shaarli is a minimalist bookmark manager and link sharing service. Prior to 0.15.0, the input string in the cloud tag page is not properly sanitized. This allo… |
CVE-2025-55288 | Medium | 5.5 | 2025-08-18 | Genealogy is a family tree PHP application. Prior to 4.4.0, Authenticated Reflected Cross-Site Scripting (XSS) vulnerability was identified in the Genealogy ap… |
CVE-2025-55287 | Medium | 5.4 | 2025-08-18 | Genealogy is a family tree PHP application. Prior to 4.4.0, Authenticated Stored Cross-Site Scripting (XSS) vulnerability was identified in the Genealogy appli… |
CVE-2025-55283 | Critical | 9.1 | 2025-08-18 | aiven-db-migrate is an Aiven database migration tool. Prior to 1.0.7, there is a privilege escalation vulnerability that allows elevation to superuser inside P… |
CVE-2025-55282 | Critical | 9.1 | 2025-08-18 | aiven-db-migrate is an Aiven database migration tool. Prior to 1.0.7, there is a privilege escalation vulnerability that allows a user to elevate to superuser… |
CVE-2025-55214 | | 2025-08-18 | Copier library and CLI app for rendering project templates. From 7.1.0 to before 9.9.1, Copier suggests that it's safe to generate a project from a safe templa… | |
CVE-2025-55205 | Critical | 9.0 | 2025-08-18 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. A namespace label injection vulnerability in Capsule v0.10.3 and earlier allows authentic… |
CVE-2025-55201 | | 2025-08-18 | Copier library and CLI app for rendering project templates. Prior to 9.9.1, a safe template can currently read and write arbitrary files because Copier exposes… | |
CVE-2025-54234 | Low | 2.7 | 2025-08-18 | ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by a Server-Side Request Forgery (SSRF) vulnerability that could lead to limited file sys… |
CVE-2025-3639 | | 2025-08-18 | Liferay Portal 7.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through… | |
CVE-2025-54421 | High | 7.2 | 2025-08-18 | NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Cross-site scripting (XSS) vulnerability in NamelessMC before 2.2.4 allows… |
CVE-2025-54118 | Medium | 5.3 | 2025-08-18 | NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Sensitive information disclosure in NamelessMC before 2.2.4 allows unauthe… |
CVE-2025-54117 | Critical | 9.0 | 2025-08-18 | NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Cross-site scripting (XSS) vulnerability in NamelessMC before 2.2.3 allows… |
CVE-2025-4962 | High | 7.7 | 2025-08-18 | An Insecure Direct Object Reference (IDOR) vulnerability was identified in the `POST /v1/templates` endpoint of the Lunary API, affecting versions up to 0.8.8… |
CVE-2025-43732 | Low | 2.7 | 2025-08-18 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 thro… |
CVE-2025-36120 | High | 8.8 | 2025-08-18 | IBM Storage Virtualize 8.4, 8.5, 8.6, and 8.7 could allow an authenticated user to escalate their privileges in an SSH session due to incorrect authorization c… |
CVE-2025-33100 | Medium | 6.2 | 2025-08-18 | IBM Concert Software 1.0.0 through 1.1.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authenti… |
CVE-2025-33090 | High | 7.5 | 2025-08-18 | IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to cause a denial of service using a specially crafted regular expression that would cau… |
CVE-2025-27909 | Medium | 5.4 | 2025-08-18 | IBM Concert Software 1.0.0 through 1.1.0 uses cross-origin resource sharing (CORS) which could allow an attacker to carry out privileged actions as the domain… |
CVE-2025-1759 | Medium | 5.9 | 2025-08-18 | IBM Concert Software 1.0.0 through 1.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap m… |
CVE-2025-43733 | Medium | 5.4 | 2025-08-18 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.7 allows a remote authenticated… |
CVE-2025-47206 | High | 8.1 | 2025-08-18 | An out-of-bounds write vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerabi… |
CVE-2025-41242 | Medium | 5.9 | 2025-08-18 | Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can… |
CVE-2025-5296 | High | 7.3 | 2025-08-18 | CWE-59: Improper Link Resolution Before File Access ('Link Following') vulnerability exists that could cause arbitrary data to be written to protected locatio… |
CVE-2025-6625 | High | 7.5 | 2025-08-18 | CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when specific crafted FTP command is sent to the device. |
CVE-2025-57703 | Medium | 6.1 | 2025-08-18 | DIAEnergie - Reflected Cross-site Scripting |
CVE-2025-57702 | Medium | 6.1 | 2025-08-18 | DIAEnergie - Reflected Cross-site Scripting |
CVE-2025-57701 | Medium | 6.1 | 2025-08-18 | DIAEnergie - Reflected Cross-site Scripting |
CVE-2025-57700 | Medium | 6.1 | 2025-08-18 | DIAEnergie - Stored Cross-site Scripting |
CVE-2025-9109 | Low | 3.7 | 2025-08-18 | A security flaw has been discovered in Portabilis i-Diario up to 1.5.0. Affected by this vulnerability is an unknown functionality of the file /password/email… |
CVE-2025-9108 | Medium | 4.3 | 2025-08-18 | Affected is an unknown function of the component Login Page. The manipulation leads to improper restriction of rendered ui layers. It is possible to launch the… |
CVE-2025-9107 | Medium | 4.3 | 2025-08-18 | A vulnerability was determined in Portabilis i-Diario up to 1.5.0. This impacts an unknown function of the file /alunos/search_autocomplete. Executing manipula… |
CVE-2025-9106 | Low | 3.5 | 2025-08-18 | A vulnerability was found in Portabilis i-Diario up to 1.5.0. This affects an unknown function of the file /planos-de-ensino-por-disciplina/ of the component I… |
CVE-2025-9105 | Low | 3.5 | 2025-08-18 | A vulnerability has been found in Portabilis i-Diario up to 1.5.0. The impacted element is an unknown function of the file /planos-de-ensino-por-areas-de-conhe… |
CVE-2025-9104 | Low | 3.5 | 2025-08-18 | A flaw has been found in Portabilis i-Diario up to 1.5.0. The affected element is an unknown function of the file /planos-de-aulas-por-disciplina/ of the compo… |
CVE-2025-9103 | Low | 2.4 | 2025-08-18 | A vulnerability was detected in ZenCart 2.1.0. Affected by this vulnerability is an unknown functionality of the component CKEditor. The manipulation leads to… |
CVE-2025-9102 | Medium | 5.3 | 2025-08-18 | A security vulnerability has been detected in 1&1 Mail & Media mail.com App 8.8.0 on Android. Affected is an unknown function of the file AndroidManifest.xml o… |
CVE-2025-9101 | Low | 3.5 | 2025-08-18 | A weakness has been identified in zhenfeng13 My-Blog up to 1.0.0. This issue affects some unknown processing of the file /admin/tags/save of the component Tag… |
CVE-2025-9100 | Medium | 5.3 | 2025-08-18 | A security flaw has been discovered in zhenfeng13 My-Blog 1.0.0. This vulnerability affects unknown code of the file /blog/comment of the component Frontend Bl… |
CVE-2025-9099 | Medium | 6.3 | 2025-08-18 | A vulnerability was identified in Acrel Environmental Monitoring Cloud Platform up to 20250804. This affects an unknown part of the file /NewsManage/UploadNews… |
CVE-2025-9098 | Medium | 5.3 | 2025-08-18 | A vulnerability was determined in Elseplus File Recovery App 4.4.21 on Android. Affected by this issue is some unknown functionality of the file AndroidManifes… |
CVE-2025-31715 | Critical | 9.8 | 2025-08-18 | In vowifi service, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with no additional… |
CVE-2025-31714 | Medium | 6.8 | 2025-08-18 | In Developer Tools, there is a possible missing verification incorrect input. This could lead to local escalation of privilege with no additional execution pri… |
CVE-2025-31713 | High | 8.4 | 2025-08-18 | In engineer mode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no addi… |
CVE-2025-9097 | Medium | 5.3 | 2025-08-18 | A vulnerability was found in Euro Information CIC banque et compte en ligne App 12.56.0 on Android. Affected by this vulnerability is an unknown functionality… |
CVE-2025-9096 | Low | 3.5 | 2025-08-18 | A vulnerability has been found in ExpressGateway express-gateway up to 1.16.10. Affected is an unknown function in the library lib/rest/routes/apps.js of the c… |
CVE-2025-9095 | Low | 3.5 | 2025-08-17 | A flaw has been found in ExpressGateway express-gateway up to 1.16.10. This issue affects some unknown processing in the library lib/rest/routes/users.js of th… |
CVE-2025-9094 | Medium | 4.3 | 2025-08-17 | A vulnerability was detected in ThingsBoard 4.1. This vulnerability affects unknown code of the component Add Gateway Handler. The manipulation leads to improp… |
CVE-2025-7342 | High | 7.5 | 2025-08-17 | A security issue was discovered in the Kubernetes Image Builder where default credentials are enabled during the Windows image build process when using the Nut… |
CVE-2025-9093 | Medium | 5.3 | 2025-08-17 | A security vulnerability has been detected in BuzzFeed App 2024.9 on Android. This affects an unknown part of the file AndroidManifest.xml of the component com… |
CVE-2025-9091 | Low | 2.5 | 2025-08-17 | A security flaw has been discovered in Tenda AC20 16.03.08.12. Affected by this vulnerability is an unknown functionality of the file /etc_ro/shadow. The manip… |
CVE-2025-9090 | Medium | 6.3 | 2025-08-17 | A vulnerability was identified in Tenda AC20 16.03.08.12. Affected is the function websFormDefine of the file /goform/telnet of the component Telnet Service. T… |
CVE-2025-9089 | High | 8.8 | 2025-08-17 | A vulnerability was determined in Tenda AC20 16.03.08.12. This issue affects the function sub_48E628 of the file /goform/SetIpMacBind. The manipulation of the… |
CVE-2025-9088 | High | 8.8 | 2025-08-16 | A vulnerability was found in Tenda AC20 16.03.08.12. This vulnerability affects the function save_virtualser_data of the file /goform/formSetVirtualSer. The ma… |
CVE-2025-9087 | High | 8.8 | 2025-08-16 | A vulnerability has been found in Tenda AC20 16.03.08.12. This affects the function set_qosMib_list of the file /goform/SetNetControlList of the component SetN… |
CVE-2025-8878 | Medium | 6.5 | 2025-08-16 | The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerabl… |
CVE-2025-8143 | Medium | 6.4 | 2025-08-16 | The Soledad theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pcsml_smartlists_h’ parameter in all versions up to, and including, 8.6.7… |
CVE-2025-8142 | High | 8.8 | 2025-08-16 | The Soledad theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 8.6.7 via the 'header_layout' parameter. This makes… |
CVE-2025-8105 | High | 7.3 | 2025-08-16 | The The Soledad theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.6.7. This is due to the software all… |
CVE-2025-38552 | Critical | 9.4 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: mptcp: plug races between subflow fail and subflow creation We have races similar to the… |
CVE-2025-38551 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix recursived rtnl_lock() during probe() The deadlock appears in a stack tra… |
CVE-2025-38550 | High | 7.8 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Delay put pmc->idev in mld_del_delrec() pmc->idev is still used in ip6_mc_cl… |
CVE-2025-38549 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: efivarfs: Fix memory leak of efivarfs_fs_info in fs_context error paths When processing m… |
CVE-2025-38548 | High | 7.8 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (corsair-cpro) Validate the size of the received input buffer Add buffer_recv_size… |
CVE-2025-38547 | High | 7.3 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: axp20x_adc: Add missing sentinel to AXP717 ADC channel maps The AXP717 ADC chan… |
CVE-2025-38546 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix memory leak of struct clip_vcc. ioctl(ATMARP_MKIP) allocates struct clip_v… |
CVE-2025-38545 | High | 7.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw-nuss: Fix skb size by accounting for skb_shared_info While t… |
CVE-2025-38544 | Medium | 5.5 | 2025-08-16 | In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix bug due to prealloc collision When userspace is using AF_RXRPC to provide a se… |