2025 CVEs (page 223)
Page 223 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-53719 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-53718 | High | 7.0 | 2025-08-12 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-53716 | Medium | 6.5 | 2025-08-12 | Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network. |
CVE-2025-53156 | Medium | 5.5 | 2025-08-12 | Exposure of sensitive information to an unauthorized actor in Storage Port Driver allows an authorized attacker to disclose information locally. |
CVE-2025-53155 | High | 7.8 | 2025-08-12 | Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
CVE-2025-53154 | High | 7.8 | 2025-08-12 | Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-53153 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-53152 | High | 7.8 | 2025-08-12 | Use after free in Desktop Windows Manager allows an authorized attacker to execute code locally. |
CVE-2025-53151 | High | 7.8 | 2025-08-12 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2025-53149 | High | 7.8 | 2025-08-12 | Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-53148 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-53147 | High | 7.0 | 2025-08-12 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-53145 | High | 8.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Windows Message Queuing allows an authorized attacker to execute code over a network. |
CVE-2025-53144 | High | 8.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Windows Message Queuing allows an authorized attacker to execute code over a network. |
CVE-2025-53143 | High | 8.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Windows Message Queuing allows an authorized attacker to execute code over a network. |
CVE-2025-53142 | High | 7.0 | 2025-08-12 | Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. |
CVE-2025-53141 | High | 7.8 | 2025-08-12 | Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-53140 | High | 7.0 | 2025-08-12 | Use after free in Kernel Transaction Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-53138 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-53137 | High | 7.0 | 2025-08-12 | Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
CVE-2025-53136 | Medium | 5.5 | 2025-08-12 | Exposure of sensitive information to an unauthorized actor in Windows NT OS Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-53135 | High | 7.0 | 2025-08-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DirectX allows an authorized attacker to elevate privile… |
CVE-2025-53134 | High | 7.0 | 2025-08-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authoriz… |
CVE-2025-53133 | High | 7.8 | 2025-08-12 | Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally. |
CVE-2025-53132 | High | 7.8 | 2025-08-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate p… |
CVE-2025-53131 | High | 8.8 | 2025-08-12 | Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network. |
CVE-2025-50177 | High | 8.1 | 2025-08-12 | Use after free in Windows Message Queuing allows an unauthorized attacker to execute code over a network. |
CVE-2025-50176 | High | 7.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Graphics Kernel allows an authorized attacker to execute code locally. |
CVE-2025-50173 | High | 7.8 | 2025-08-12 | Weak authentication in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2025-50172 | Medium | 6.5 | 2025-08-12 | Allocation of resources without limits or throttling in Windows DirectX allows an authorized attacker to deny service over a network. |
CVE-2025-50171 | Critical | 9.1 | 2025-08-12 | Missing authorization in Remote Desktop Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-50170 | High | 7.8 | 2025-08-12 | Improper handling of insufficient permissions or privileges in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges local… |
CVE-2025-50169 | High | 7.5 | 2025-08-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB allows an unauthorized attacker to execute code over… |
CVE-2025-50168 | High | 7.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally. |
CVE-2025-50167 | High | 7.0 | 2025-08-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privile… |
CVE-2025-50166 | Medium | 6.5 | 2025-08-12 | Integer overflow or wraparound in Windows Distributed Transaction Coordinator allows an authorized attacker to disclose information over a network. |
CVE-2025-50165 | Critical | 9.8 | 2025-08-12 | Untrusted pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network. |
CVE-2025-50164 | High | 8.0 | 2025-08-12 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2025-50163 | High | 8.8 | 2025-08-12 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
CVE-2025-50162 | High | 8.0 | 2025-08-12 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2025-50161 | High | 7.3 | 2025-08-12 | Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. |
CVE-2025-50160 | High | 8.0 | 2025-08-12 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2025-50159 | High | 7.3 | 2025-08-12 | Use after free in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an authorized attacker to elevate privileges locally. |
CVE-2025-50158 | High | 7.0 | 2025-08-12 | Time-of-check time-of-use (toctou) race condition in Windows NTFS allows an unauthorized attacker to disclose information locally. |
CVE-2025-50157 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-50156 | Medium | 5.7 | 2025-08-12 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network. |
CVE-2025-50155 | High | 7.8 | 2025-08-12 | Access of resource using incompatible type ('type confusion') in Windows Push Notifications allows an authorized attacker to elevate privileges locally. |
CVE-2025-50154 | Medium | 6.5 | 2025-08-12 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-50153 | High | 7.8 | 2025-08-12 | Use after free in Desktop Windows Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-49762 | High | 7.0 | 2025-08-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authoriz… |
CVE-2025-49761 | High | 7.8 | 2025-08-12 | Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2025-49759 | High | 8.8 | 2025-08-12 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |
CVE-2025-49758 | High | 8.8 | 2025-08-12 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |
CVE-2025-49757 | High | 8.8 | 2025-08-12 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
CVE-2025-49755 | Medium | 4.3 | 2025-08-12 | User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-49751 | Medium | 6.8 | 2025-08-12 | Missing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network. |
CVE-2025-49745 | Medium | 5.4 | 2025-08-12 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to… |
CVE-2025-49743 | Medium | 6.7 | 2025-08-12 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to el… |
CVE-2025-49736 | Medium | 4.3 | 2025-08-12 | The ui performs the wrong action in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-49712 | High | 8.8 | 2025-08-12 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2025-49707 | High | 7.9 | 2025-08-12 | Improper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally. |
CVE-2025-49559 | Medium | 5.3 | 2025-08-12 | Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Limitation of a Pathname to a… |
CVE-2025-49558 | Medium | 5.9 | 2025-08-12 | Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Time-of-check Time-of-use (TOCTOU) Race… |
CVE-2025-49557 | High | 8.7 | 2025-08-12 | Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a stored Cross-Site Scripting (XSS) vulne… |
CVE-2025-49556 | High | 7.5 | 2025-08-12 | Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Incorrect Authorization vulnerability… |
CVE-2025-49555 | High | 8.1 | 2025-08-12 | Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by a Cross-Site Request Forgery (CSRF) vulne… |
CVE-2025-49554 | High | 7.5 | 2025-08-12 | Adobe Commerce versions 2.4.9-alpha1, 2.4.8-p1, 2.4.7-p6, 2.4.6-p11, 2.4.5-p13, 2.4.4-p14 and earlier are affected by an Improper Input Validation vulnerabilit… |
CVE-2025-48807 | Medium | 6.7 | 2025-08-12 | Improper restriction of communication channel to intended endpoints in Windows Hyper-V allows an authorized attacker to execute code locally. |
CVE-2025-47954 | High | 8.8 | 2025-08-12 | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a n… |
CVE-2025-33051 | High | 7.5 | 2025-08-12 | Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network. |
CVE-2025-25007 | Medium | 5.3 | 2025-08-12 | Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-25006 | Medium | 5.3 | 2025-08-12 | Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-25005 | Medium | 6.5 | 2025-08-12 | Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network. |
CVE-2025-24999 | High | 8.8 | 2025-08-12 | Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network. |
CVE-2025-20044 | Medium | 4.1 | 2025-08-12 | Improper locking for some Intel(R) TDX Module firmware before version 1.5.13 may allow a privileged user to potentially enable escalation of privilege via loca… |
CVE-2025-55167 | Critical | 9.8 | 2025-08-12 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a SQL Injection vulnerability… |
CVE-2025-55166 | | 2025-08-12 | savg-sanitizer is a PHP SVG/XML sanitizer. Prior to version 0.22.0, the sanitization logic in the cleanXlinkHrefs method only searches for lower-case attribute… | |
CVE-2025-49568 | Medium | 5.5 | 2025-08-12 | Illustrator versions 28.7.8, 29.6.1 and earlier are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. Exploitation… |
CVE-2025-49567 | Medium | 5.5 | 2025-08-12 | Illustrator versions 28.7.8, 29.6.1 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An a… |
CVE-2025-49564 | High | 7.8 | 2025-08-12 | Illustrator versions 28.7.8, 29.6.1 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in th… |
CVE-2025-49563 | High | 7.8 | 2025-08-12 | Illustrator versions 28.7.8, 29.6.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2025-32086 | High | 7.2 | 2025-08-12 | Improperly implemented security check for standard in the DDRIO configuration for some Intel(R) Xeon(R) 6 Processors when using Intel(R) SGX or Intel(R) TDX ma… |
CVE-2025-32004 | Low | 3.9 | 2025-08-12 | Improper input validation in the Intel Edger8r Tool for some Intel(R) SGX SDK may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2025-27717 | Medium | 6.7 | 2025-08-12 | Uncontrolled search path for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable escalation of privilege via local acc… |
CVE-2025-27707 | Low | 2.6 | 2025-08-12 | Exposure of sensitive information to an unauthorized actor for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may… |
CVE-2025-27576 | Low | 2.9 | 2025-08-12 | Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthenticated… |
CVE-2025-27559 | Medium | 6.7 | 2025-08-12 | Incorrect default permissions for some AI Playground software before version v2.3.0 alpha may allow an authenticated user to potentially enable escalation of p… |
CVE-2025-27537 | Medium | 5.5 | 2025-08-12 | Improper input validation for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to po… |
CVE-2025-27250 | Low | 3.5 | 2025-08-12 | Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated us… |
CVE-2025-26863 | Low | 3.8 | 2025-08-12 | Uncontrolled resource consumption in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user t… |
CVE-2025-26697 | Low | 3.3 | 2025-08-12 | Uncontrolled resource consumption in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user t… |
CVE-2025-26472 | Medium | 5.7 | 2025-08-12 | Uncontrolled resource consumption for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated us… |
CVE-2025-26470 | Medium | 6.7 | 2025-08-12 | Incorrect default permissions for some Intel(R) Distribution for Python software installers before version 2025.1.0 may allow an authenticated user to potentia… |
CVE-2025-26404 | Medium | 6.7 | 2025-08-12 | Uncontrolled search path for some Intel(R) DSA software before version 25.2.15.9 may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2025-26403 | High | 7.2 | 2025-08-12 | Out-of-bounds write in the memory subsystem for some Intel(R) Xeon(R) 6 processors when using Intel(R) SGX or Intel(R) TDX may allow a privileged user to poten… |
CVE-2025-25273 | High | 7.8 | 2025-08-12 | Insufficient control flow management in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated use… |
CVE-2025-24923 | Medium | 6.7 | 2025-08-12 | Uncontrolled search path in some Intel(R) AI for Enterprise Retrieval-augmented Generation software may allow an authenticated user to potentially enable escal… |
CVE-2025-24921 | Medium | 6.6 | 2025-08-12 | Improper neutralization for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthenticated user to po… |
CVE-2025-24840 | Medium | 5.8 | 2025-08-12 | Improper access control for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthenticated user to po… |
CVE-2025-24835 | Medium | 6.5 | 2025-08-12 | Protection mechanism failure in the Intel(R) Graphics Driver for the Intel(R) Arc(TM) B-Series graphics before version 32.0.101.6737 may allow an authenticated… |