2025 CVEs (page 221)
Page 221 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-55169 | Medium | 6.5 | 2025-08-12 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability… |
CVE-2025-55168 | Critical | 9.8 | 2025-08-12 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a SQL Injection vulnerability… |
CVE-2025-53744 | High | 7.2 | 2025-08-12 | An incorrect privilege assignment vulnerability [CWE-266] in FortiOS Security Fabric version 7.6.0 through 7.6.2, 7.4.0 through 7.4.7, 7.2 all versions, 7.0 al… |
CVE-2025-52970 | High | 8.1 | 2025-08-12 | A improper handling of parameters in Fortinet FortiWeb versions 7.6.3 and below, versions 7.4.7 and below, versions 7.2.10 and below, and 7.0.10 and below may… |
CVE-2025-49813 | High | 7.2 | 2025-08-12 | An improper neutralization of special elements used in an OS Command ("OS Command Injection") vulnerability [CWE-78] in Fortinet FortiADC version 7.2.0 and bef… |
CVE-2025-47857 | Medium | 6.7 | 2025-08-12 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability [CWE-78] in Fortinet FortiWeb CLI version 7.6.0 thro… |
CVE-2025-43734 | Medium | 5.4 | 2025-08-12 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 thr… |
CVE-2025-36124 | Medium | 5.9 | 2025-08-12 | IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 could allow a remote attacker to bypass security restrictions caused by a failure to honor J… |
CVE-2025-32932 | Medium | 6.5 | 2025-08-12 | An Improper neutralization of input during web page generation ('cross-site scripting') vulnerability [CWE-79] in FortiSOAR version 7.6.1 and below, version 7… |
CVE-2025-32766 | Medium | 6.4 | 2025-08-12 | A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiWeb CLI version 7.6.0 through 7.6.3 and before 7.4.8 allows a privileged attacker to exe… |
CVE-2025-27759 | Medium | 6.7 | 2025-08-12 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiWeb version 7.6.0 through… |
CVE-2025-25256 | Critical | 9.8 | 2025-08-12 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSIEM 7.3.0… |
CVE-2025-25248 | Medium | 5.3 | 2025-08-12 | An Integer Overflow or Wraparound vulnerability [CWE-190] in FortiOS version 7.6.2 and below, version 7.4.7 and below, version 7.2.10 and below, 7.2 all versio… |
CVE-2025-53793 | High | 7.5 | 2025-08-12 | Improper authentication in Azure Stack allows an unauthorized attacker to disclose information over a network. |
CVE-2025-53789 | High | 7.8 | 2025-08-12 | Missing authentication for critical function in Windows StateRepository API allows an authorized attacker to elevate privileges locally. |
CVE-2025-53788 | High | 7.0 | 2025-08-12 | Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. |
CVE-2025-53784 | High | 8.4 | 2025-08-12 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-53783 | High | 7.5 | 2025-08-12 | Heap-based buffer overflow in Microsoft Teams allows an unauthorized attacker to execute code over a network. |
CVE-2025-53781 | High | 7.7 | 2025-08-12 | Exposure of sensitive information to an unauthorized actor in Azure Virtual Machines allows an authorized attacker to disclose information over a network. |
CVE-2025-53779 | High | 7.2 | 2025-08-12 | Relative path traversal in Windows Kerberos allows an authorized attacker to elevate privileges over a network. |
CVE-2025-53778 | High | 8.8 | 2025-08-12 | Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network. |
CVE-2025-53773 | High | 7.8 | 2025-08-12 | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to exec… |
CVE-2025-53772 | High | 8.8 | 2025-08-12 | Deserialization of untrusted data in Web Deploy allows an authorized attacker to execute code over a network. |
CVE-2025-53769 | Medium | 5.5 | 2025-08-12 | External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally. |
CVE-2025-53766 | Critical | 9.8 | 2025-08-12 | Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code over a network. |
CVE-2025-53765 | Medium | 4.4 | 2025-08-12 | Exposure of private personal information to an unauthorized actor in Azure Stack allows an authorized attacker to disclose information locally. |
CVE-2025-53761 | High | 7.8 | 2025-08-12 | Use after free in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. |
CVE-2025-53760 | High | 7.1 | 2025-08-12 | Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2025-53759 | High | 7.8 | 2025-08-12 | Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-53741 | High | 7.8 | 2025-08-12 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-53740 | High | 8.4 | 2025-08-12 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-53739 | High | 7.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-53738 | High | 7.8 | 2025-08-12 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-53737 | High | 7.8 | 2025-08-12 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-53736 | Medium | 6.8 | 2025-08-12 | Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. |
CVE-2025-53735 | High | 7.8 | 2025-08-12 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-53734 | High | 7.8 | 2025-08-12 | Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally. |
CVE-2025-53733 | High | 8.4 | 2025-08-12 | Incorrect conversion between numeric types in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-53732 | High | 7.8 | 2025-08-12 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-53731 | High | 8.4 | 2025-08-12 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-53730 | High | 7.8 | 2025-08-12 | Use after free in Microsoft Office Visio allows an unauthorized attacker to execute code locally. |
CVE-2025-53729 | High | 7.8 | 2025-08-12 | Improper access control in Azure File Sync allows an authorized attacker to elevate privileges locally. |
CVE-2025-53728 | Medium | 6.5 | 2025-08-12 | Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to disclose information over… |
CVE-2025-53727 | High | 8.8 | 2025-08-12 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |
CVE-2025-53726 | High | 7.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally. |
CVE-2025-53725 | High | 7.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally. |
CVE-2025-53724 | High | 7.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally. |
CVE-2025-53723 | High | 7.8 | 2025-08-12 | Numeric truncation error in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
CVE-2025-53722 | High | 7.5 | 2025-08-12 | Uncontrolled resource consumption in Windows Remote Desktop Services allows an unauthorized attacker to deny service over a network. |
CVE-2025-53721 | High | 7.0 | 2025-08-12 | Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-53720 | High | 8.0 | 2025-08-12 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2025-53719 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-53718 | High | 7.0 | 2025-08-12 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-53716 | Medium | 6.5 | 2025-08-12 | Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network. |
CVE-2025-53156 | Medium | 5.5 | 2025-08-12 | Exposure of sensitive information to an unauthorized actor in Storage Port Driver allows an authorized attacker to disclose information locally. |
CVE-2025-53155 | High | 7.8 | 2025-08-12 | Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
CVE-2025-53154 | High | 7.8 | 2025-08-12 | Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-53153 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-53152 | High | 7.8 | 2025-08-12 | Use after free in Desktop Windows Manager allows an authorized attacker to execute code locally. |
CVE-2025-53151 | High | 7.8 | 2025-08-12 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2025-53149 | High | 7.8 | 2025-08-12 | Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-53148 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-53147 | High | 7.0 | 2025-08-12 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-53145 | High | 8.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Windows Message Queuing allows an authorized attacker to execute code over a network. |
CVE-2025-53144 | High | 8.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Windows Message Queuing allows an authorized attacker to execute code over a network. |
CVE-2025-53143 | High | 8.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Windows Message Queuing allows an authorized attacker to execute code over a network. |
CVE-2025-53142 | High | 7.0 | 2025-08-12 | Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. |
CVE-2025-53141 | High | 7.8 | 2025-08-12 | Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-53140 | High | 7.0 | 2025-08-12 | Use after free in Kernel Transaction Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-53138 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-53137 | High | 7.0 | 2025-08-12 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-53136 | Medium | 5.5 | 2025-08-12 | Exposure of sensitive information to an unauthorized actor in Windows NT OS Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-53135 | High | 7.0 | 2025-08-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to elevate privile… |
CVE-2025-53134 | High | 7.0 | 2025-08-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authoriz… |
CVE-2025-53133 | High | 7.8 | 2025-08-12 | Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. |
CVE-2025-53132 | High | 7.8 | 2025-08-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate p… |
CVE-2025-53131 | High | 8.8 | 2025-08-12 | Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network. |
CVE-2025-50177 | High | 8.1 | 2025-08-12 | Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. |
CVE-2025-50176 | High | 7.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Graphics Kernel allows an authorized attacker to execute code locally. |
CVE-2025-50173 | High | 7.8 | 2025-08-12 | Weak authentication in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2025-50172 | Medium | 6.5 | 2025-08-12 | Allocation of resources without limits or throttling in Windows DirectX allows an authorized attacker to deny service over a network. |
CVE-2025-50171 | Critical | 9.1 | 2025-08-12 | Missing authorization in Remote Desktop Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-50170 | High | 7.8 | 2025-08-12 | Improper handling of insufficient permissions or privileges in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges local… |
CVE-2025-50169 | High | 7.5 | 2025-08-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB allows an unauthorized attacker to execute code over… |
CVE-2025-50168 | High | 7.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally. |
CVE-2025-50167 | High | 7.0 | 2025-08-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privile… |
CVE-2025-50166 | Medium | 6.5 | 2025-08-12 | Integer overflow or wraparound in Windows Distributed Transaction Coordinator allows an authorized attacker to disclose information over a network. |
CVE-2025-50165 | Critical | 9.8 | 2025-08-12 | Untrusted pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. |
CVE-2025-50164 | High | 8.0 | 2025-08-12 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2025-50163 | High | 8.8 | 2025-08-12 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
CVE-2025-50162 | High | 8.0 | 2025-08-12 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2025-50161 | High | 7.3 | 2025-08-12 | Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. |
CVE-2025-50160 | High | 8.0 | 2025-08-12 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2025-50159 | High | 7.3 | 2025-08-12 | Use after free in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an authorized attacker to elevate privileges locally. |
CVE-2025-50158 | High | 7.0 | 2025-08-12 | Time-of-check time-of-use (toctou) race condition in Windows NTFS allows an unauthorized attacker to disclose information locally. |
CVE-2025-50157 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-50156 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-50155 | High | 7.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally. |
CVE-2025-50154 | Medium | 6.5 | 2025-08-12 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-50153 | High | 7.8 | 2025-08-12 | Use after free in Desktop Windows Manager allows an authorized attacker to elevate privileges locally. |