2025 CVEs (page 219)
Page 219 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-3414 | Medium | 5.4 | 2025-08-14 | The Structured Content (JSON-LD) #wpsc WordPress plugin before 1.7.0 does not validate and escape some of its block options before outputting them back in a pa… |
CVE-2025-8938 | Medium | 6.3 | 2025-08-14 | A vulnerability was found in TOTOLINK N350R 1.2.3-B20130826. This issue affects the function formSysTel of the file /boafrm/formSysTel of the component Telnet… |
CVE-2025-8937 | Medium | 6.3 | 2025-08-14 | A vulnerability has been found in TOTOLINK N350R 1.2.3-B20130826. This vulnerability affects unknown code of the file /boafrm/formSysCmd. The manipulation lead… |
CVE-2025-8936 | High | 7.3 | 2025-08-14 | A vulnerability was determined in 1000 Projects Sales Management System 1.0. Affected by this issue is some unknown functionality of the file /superstore/dist/… |
CVE-2025-5942 | | 2025-08-14 | Netskope was notified about a potential gap in its agent (NS Client) on Windows systems. If this gap is successfully exploited, an unprivileged user can trigg… | |
CVE-2025-5941 | | 2025-08-14 | Netskope is notified about a potential gap in its agent (NS Client) in which a malicious actor could trigger a memory leak by sending a crafted DNS packet to a… | |
CVE-2025-0309 | | 2025-08-14 | An insufficient validation on the server connection endpoint in Netskope Client allows local users to elevate privileges on the system. The insufficient valida… | |
CVE-2025-8935 | High | 7.3 | 2025-08-14 | A vulnerability was found in 1000 Projects Sales Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /superstore/cust… |
CVE-2025-8934 | Medium | 4.3 | 2025-08-14 | A vulnerability has been found in 1000 Projects Sales Management System 1.0. Affected is an unknown function of the file /sales.php. The manipulation of the ar… |
CVE-2025-8933 | Medium | 4.3 | 2025-08-14 | A vulnerability was identified in 1000 Projects Sales Management System 1.0. This issue affects some unknown processing of the file /superstore/admin/sales.php… |
CVE-2025-8932 | High | 7.3 | 2025-08-14 | A vulnerability was determined in 1000 Projects Sales Management System 1.0. This vulnerability affects unknown code of the file /superstore/admin/sales.php. T… |
CVE-2025-8931 | Medium | 6.3 | 2025-08-14 | A vulnerability was determined in code-projects Medical Store Management System 1.0. Affected is an unknown function of the file ChangePassword.java. The manip… |
CVE-2025-8930 | Medium | 6.3 | 2025-08-14 | A vulnerability was found in code-projects Medical Store Management System 1.0. This issue affects some unknown processing of the file UpdateCompany.java of th… |
CVE-2025-55199 | Medium | 6.5 | 2025-08-14 | Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON Schema file in a manner which could cause Helm to… |
CVE-2025-55198 | Medium | 6.5 | 2025-08-14 | Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, when parsing Chart.yaml and index.yaml files, an improper validation of type erro… |
CVE-2025-55197 | High | 7.5 | 2025-08-13 | pypdf is a free and open-source pure-python PDF library. Prior to version 6.0.0, an attacker can craft a PDF which leads to the RAM being exhausted. This requi… |
CVE-2025-55196 | | 2025-08-13 | External Secrets Operator is a Kubernetes operator that integrates external secret management systems. From version 0.15.0 to before 0.19.2, a vulnerability wa… | |
CVE-2025-55194 | Medium | 5.7 | 2025-08-13 | Part-DB is an open source inventory management system for electronic components. Prior to version 1.17.3, any authenticated user can upload a profile picture w… |
CVE-2025-55193 | | 2025-08-13 | Active Record connects classes to relational database tables. Prior to versions 7.1.5.2, 7.2.2.2, and 8.0.2.1, the ID passed to find or similar methods may be… | |
CVE-2025-8929 | Medium | 6.3 | 2025-08-13 | A vulnerability has been found in code-projects Medical Store Management System 1.0. This vulnerability affects unknown code of the file MainPanel.java. The ma… |
CVE-2025-8928 | Medium | 6.3 | 2025-08-13 | A vulnerability was identified in code-projects Medical Store Management System 1.0. This affects an unknown part of the file UpdateMedicines.java of the compo… |
CVE-2025-34154 | | 2025-08-13 | UnForm Server Manager versions prior to 10.1.12 expose an unauthenticated file read vulnerability via its log file analysis interface. The flaw resides in the… | |
CVE-2025-8927 | Low | 3.7 | 2025-08-13 | A vulnerability was determined in mtons mblog up to 3.5.0. Affected by this issue is some unknown functionality of the file /email/send_code of the component V… |
CVE-2025-8926 | High | 7.3 | 2025-08-13 | A vulnerability was found in SourceCodester COVID 19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /log… |
CVE-2025-43988 | High | 7.5 | 2025-08-13 | KuWFi 5G01-X55 FL2020_V0.0.12 devices expose an unauthenticated API endpoint (ajax_get.cgi), allowing remote attackers to retrieve sensitive configuration data… |
CVE-2025-43986 | Critical | 9.8 | 2025-08-13 | An issue was discovered on KuWFi GC111 GC111-GL-LM321_V3.0_20191211 devices. The TELNET service is enabled by default and exposed over the WAN interface withou… |
CVE-2025-43982 | Critical | 9.8 | 2025-08-13 | Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices enable the SSH service by default. There is a hidden hard-coded root account that cannot be… |
CVE-2025-8925 | High | 7.3 | 2025-08-13 | A vulnerability has been found in itsourcecode Sports Management System 1.0. Affected is an unknown function of the file /Admin/match.php. The manipulation of… |
CVE-2025-8924 | High | 7.3 | 2025-08-13 | A vulnerability was identified in Campcodes Online Water Billing System 1.0. This issue affects some unknown processing of the file /viewbill.php. The manipula… |
CVE-2025-8923 | High | 7.3 | 2025-08-13 | A vulnerability was determined in code-projects Job Diary 1.0. This vulnerability affects unknown code of the file /edit-details.php. The manipulation of the a… |
CVE-2025-8922 | High | 7.3 | 2025-08-13 | A vulnerability was found in code-projects Job Diary 1.0. This affects an unknown part of the file /admin-inbox.php. The manipulation of the argument ID leads… |
CVE-2025-45313 | Medium | 6.1 | 2025-08-13 | A cross-site scripting (XSS) vulnerability in the /tasks endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a us… |
CVE-2025-43989 | Medium | 6.5 | 2025-08-13 | The /goform/formJsonAjaxReq POST endpoint of Shenzhen Tuoshi NR500-EA RG500UEAABxCOMSLICv3.4.2731.16.43 devices mishandles the set_timesetting action with the… |
CVE-2025-8921 | High | 7.3 | 2025-08-13 | A vulnerability has been found in code-projects Job Diary 1.0. Affected by this issue is some unknown functionality of the file /user-apply.php. The manipulati… |
CVE-2025-8920 | Low | 2.4 | 2025-08-13 | A vulnerability was identified in Portabilis i-Diario 1.6. Affected by this vulnerability is an unknown functionality of the file /dicionario-de-termos-bncc of… |
CVE-2025-8919 | Low | 2.4 | 2025-08-13 | A vulnerability was determined in Portabilis i-Diario up to 1.6. Affected is an unknown function of the file /objetivos-de-aprendizagem-e-habilidades of the co… |
CVE-2025-8904 | High | 8.5 | 2025-08-13 | Amazon EMR Secret Agent creates a keytab file containing Kerberos credentials. This file is stored in the /tmp/ directory. A user with access to this directory… |
CVE-2025-8770 | Medium | 6.5 | 2025-08-13 | An issue has been discovered in GitLab EE affecting all versions from 18.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that could have allo… |
CVE-2025-8754 | High | 7.5 | 2025-08-13 | Missing Authentication for Critical Function vulnerability in ABB ABB AbilityTM zenon.This issue affects ABB AbilityTM zenon: from 7.50 through 14. |
CVE-2025-7739 | High | 8.7 | 2025-08-13 | An issue has been discovered in GitLab CE/EE affecting all versions from 18.2 before 18.2.2 that, under certain conditions, could have allowed authenticated us… |
CVE-2025-7734 | High | 8.7 | 2025-08-13 | An issue has been discovered in GitLab CE/EE affecting all versions from 14.2 before 18.0.6, 18.1 before 18.1.4 and 18.2 before 18.2.2 that, under certain cond… |
CVE-2025-6186 | High | 8.7 | 2025-08-13 | An issue has been discovered in GitLab CE/EE affecting all versions from 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed authenticated users… |
CVE-2025-5819 | Medium | 5.0 | 2025-08-13 | An issue has been discovered in GitLab CE/EE affecting all versions from 15.7 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed… |
CVE-2025-50946 | Medium | 6.5 | 2025-08-13 | OS Command Injection in Olivetin 2025.4.22 Custom Themes via the ParseRequestURI function in service/internal/executor/arguments.go. |
CVE-2025-50617 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_0046ed68 function of the cgitest.cgi file. Attackers can trigger this… |
CVE-2025-50616 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_0046f984 function of the cgitest.cgi file. Attackers can trigger this… |
CVE-2025-50615 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00470c50 function of the cgitest.cgi file. Attackers can trigger this… |
CVE-2025-45317 | Medium | 6.5 | 2025-08-13 | A zip slip vulnerability in the /modules/ImportModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary code via a crafted archive. |
CVE-2025-45316 | Medium | 6.1 | 2025-08-13 | A cross-site scripting (XSS) vulnerability in the TextBlockModule.php component of hortusfox-web v4.4 allows attackers to execute arbitrary web scripts or HTML… |
CVE-2025-45315 | Medium | 5.4 | 2025-08-13 | A cross-site scripting (XSS) vulnerability in the /controller/admin.php endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the… |
CVE-2025-45314 | Medium | 6.1 | 2025-08-13 | A cross-site scripting (XSS) vulnerability in the /Calendar endpoint of hortusfox-web v4.4 allows attackers to execute arbitrary JavaScript in the context of a… |
CVE-2025-2937 | Medium | 6.5 | 2025-08-13 | An issue has been discovered in GitLab CE/EE affecting all versions from 13.2 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed… |
CVE-2025-2614 | Medium | 6.5 | 2025-08-13 | An issue has been discovered in GitLab CE/EE affecting all versions from 11.6 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed… |
CVE-2025-2498 | Low | 3.1 | 2025-08-13 | An improper access control in Gitlab EE affecting all versions from 12.0 prior to 18.0.6, 18.1 prior to 18.1.4, and 18.2 prior to 18.2.2 that under certain con… |
CVE-2025-23306 | High | 7.8 | 2025-08-13 | NVIDIA Megatron-LM for all platforms contains a vulnerability in the megatron/training/ arguments.py component where an attacker could cause a code injection i… |
CVE-2025-23305 | High | 7.8 | 2025-08-13 | NVIDIA Megatron-LM for all platforms contains a vulnerability in the tools component, where an attacker may exploit a code injection issue. A successful exploi… |
CVE-2025-23304 | High | 7.8 | 2025-08-13 | NVIDIA NeMo library for all platforms contains a vulnerability in the model loading component, where an attacker could cause code injection by loading .nemo fi… |
CVE-2025-23303 | High | 7.8 | 2025-08-13 | NVIDIA NeMo Framework for all platforms contains a vulnerability where a user could cause a deserialization of untrusted data by remote code execution. A succe… |
CVE-2025-23298 | High | 7.8 | 2025-08-13 | NVIDIA Merlin Transformers4Rec for all platforms contains a vulnerability in a python dependency, where an attacker could cause a code injection issue. A succe… |
CVE-2025-23296 | High | 7.8 | 2025-08-13 | NVIDIA Isaac-GR00T for all platforms contains a vulnerability in a Python component where an attacker could cause a code injection issue. A successful exploit… |
CVE-2025-23295 | High | 7.8 | 2025-08-13 | NVIDIA Apex for all platforms contains a vulnerability in a Python component where an attacker could cause a code injection issue by providing a malicious file… |
CVE-2025-23294 | High | 7.8 | 2025-08-13 | NVIDIA WebDataset for all platforms contains a vulnerability where an attacker could execute arbitrary code with elevated permissions. A successful exploit of… |
CVE-2025-1477 | Medium | 6.5 | 2025-08-13 | An issue has been discovered in GitLab CE/EE affecting all versions from 8.14 before 18.0.6, 18.1 before 18.1.4, and 18.2 before 18.2.2 that could have allowed… |
CVE-2025-52385 | Critical | 9.8 | 2025-08-13 | An issue in Studio 3T v.2025.1.0 and before allows a remote attacker to execute arbitrary code via a crafted payload to the child_process module |
CVE-2025-51451 | Critical | 9.8 | 2025-08-13 | In TOTOLINK EX1200T firmware 4.1.2cu.5215, an attacker can bypass login by sending a specific request through formLoginAuth.htm. |
CVE-2025-50594 | Critical | 9.8 | 2025-08-13 | An issue was discovered in /Code/Websites/DanpheEMR/Controllers/Settings/SecuritySettingsController.cs in Danphe Health Hospital Management System EMR 3.2 allo… |
CVE-2025-34153 | | 2025-08-13 | Hyland OnBase versions prior to 17.0.2.87 (other versions may be affected) are vulnerable to unauthenticated remote code execution via insecure deserialization… | |
CVE-2025-2184 | | 2025-08-13 | A credential management flaw in Palo Alto Networks Cortex XDR® Broker VM causes different Broker VM images to share identical default credentials for internal… | |
CVE-2025-2183 | | 2025-08-13 | An insufficient certificate validation issue in the Palo Alto Networks GlobalProtect™ app enables attackers to connect the GlobalProtect app to arbitrary serve… | |
CVE-2025-2182 | | 2025-08-13 | A problem with the implementation of the MACsec protocol in Palo Alto Networks PAN-OS® results in the cleartext exposure of the connectivity association key (C… | |
CVE-2025-2181 | | 2025-08-13 | A sensitive information disclosure vulnerability in Palo Alto Networks Checkov by Prisma® Cloud can result in the cleartext exposure of Prisma Cloud access key… | |
CVE-2025-2180 | | 2025-08-13 | An unsafe deserialization vulnerability in Palo Alto Networks Checkov by Prisma® Cloud allows an authenticated user to execute arbitrary code as a non administ… | |
CVE-2025-8918 | Low | 2.4 | 2025-08-13 | A vulnerability was found in Portabilis i-Educar up to 2.10. This issue affects some unknown processing of the file /intranet/educar_instituicao_cad.php of the… |
CVE-2025-51452 | Critical | 9.8 | 2025-08-13 | In TOTOLINK A7000R firmware 9.1.0u.6115_B20201022, an attacker can bypass login by sending a specific request through formLoginAuth.htm. |
CVE-2025-50614 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in the Netis WF2880 v2.1.40207 in the FUN_0047151c function of the cgitest.cgi file. Attackers can trigger… |
CVE-2025-50613 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00475e1c function of the cgitest.cgi file. Attackers can trigger this… |
CVE-2025-50612 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in the Netis WF2880 v2.1.40207 in the FUN_004743f8 function of the cgitest.cgi file. Attackers can trigger… |
CVE-2025-50611 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00473154 function of the cgitest.cgi file. Attackers can trigger this… |
CVE-2025-50610 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00476598 function of the cgitest.cgi file. Attackers can trigger this… |
CVE-2025-50609 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the Function_00465620 of the cgitest.cgi file. Attackers can trigger this vul… |
CVE-2025-50608 | High | 7.5 | 2025-08-13 | A buffer overflow vulnerability has been discovered in Netis WF2880 v2.1.40207 in the FUN_00471994 function of the cgitest.cgi file. Attackers can trigger this… |
CVE-2025-8941 | High | 7.8 | 2025-08-13 | A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race c… |
CVE-2025-55163 | High | 7.5 | 2025-08-13 | Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.124.Final and 4.2.4.Final, Netty is vulnerable to MadeYouReset DDoS… |
CVE-2025-54809 | High | 7.4 | 2025-08-13 | F5 Access for Android before version 3.1.2 which uses HTTPS does not verify the remote endpoint identity. Note: Software versions which have reached End o… |
CVE-2025-54500 | Medium | 5.3 | 2025-08-13 | An HTTP/2 implementation flaw allows a denial-of-service (DoS) that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit (HT… |
CVE-2025-53859 | Low | 3.7 | 2025-08-13 | NGINX Open Source and NGINX Plus have a vulnerability in the ngx_mail_smtp_module that might allow an unauthenticated attacker to over-read NGINX SMTP authenti… |
CVE-2025-52585 | High | 7.5 | 2025-08-13 | When a BIG-IP LTM Client SSL profile is configured on a virtual server with SSL Forward Proxy enabled and Anonymous Diffie-Hellman (ADH) ciphers enabled, undis… |
CVE-2025-51691 | Medium | 6.1 | 2025-08-13 | Cross-Site Scripting (XSS) vulnerability found in MarkTwo commit e3a1d3f90cce4ea9c26efcbbf3a1cbfb9dcdb298 (May 2025) allows a remote attacker to execute arbitr… |
CVE-2025-50690 | Medium | 6.1 | 2025-08-13 | A Cross-Site Scripting (XSS) vulnerability exists in SpatialReference.org (OSGeo/spatialreference.org) versions prior to 2025-05-17 (commit 2120adfa17ddd535bd0… |
CVE-2025-50635 | High | 7.5 | 2025-08-13 | A null pointer dereference vulnerability was discovered in Netis WF2780 v2.2.35445. The vulnerability exists in the FUN_0048a728 function of the cgitest.cgi fi… |
CVE-2025-50251 | Critical | 9.1 | 2025-08-13 | Server side request forgery (SSRF) vulnerability in makeplane plane 0.23.1 via the password recovery. |
CVE-2025-48500 | High | 7.3 | 2025-08-13 | A missing file integrity check vulnerability exists on MacOS F5 VPN browser client installer that may allow a local, authenticated attacker with access to the… |
CVE-2025-46405 | High | 7.5 | 2025-08-13 | When Network Access is configured on a BIG-IP APM virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Not… |
CVE-2025-55668 | Medium | 6.5 | 2025-08-13 | Session Fixation vulnerability in Apache Tomcat via rewrite valve. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0-M1 through 10… |
CVE-2025-55160 | Medium | 6.1 | 2025-08-13 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, there is undefined beha… |
CVE-2025-55154 | High | 8.8 | 2025-08-13 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 6.9.13-27 and 7.1.2-1, the magnified size calc… |
CVE-2025-55005 | Medium | 5.5 | 2025-08-13 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, when preparing to transform from Log t… |
CVE-2025-55004 | High | 7.6 | 2025-08-13 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-1, ImageMagick is vulnerable to heap-buff… |
CVE-2025-54791 | Medium | 5.3 | 2025-08-13 | OMERO.web provides a web based client and plugin infrastructure. Prior to version 5.29.2, if an error occurred when resetting a user's password using the Forgo… |
CVE-2025-54382 | Critical | 9.6 | 2025-08-13 | Cherry Studio is a desktop client that supports for multiple LLM providers. In version 1.5.1, a remote code execution (RCE) vulnerability exists in the Cherry… |