2025 CVEs (page 224)
Page 224 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-24523 | Low | 3.5 | 2025-08-12 | Protection mechanism failure for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an authenticated user to… |
CVE-2025-24520 | Low | 3.3 | 2025-08-12 | Insertion of sensitive information into log file for some Intel(R) Local Manageability Service software before version 2514.7.16.0 may allow an authenticated u… |
CVE-2025-24515 | Medium | 6.5 | 2025-08-12 | NULL pointer dereference for some Intel(R) Graphics Drivers may allow an authenticated user to potentially enable denial of service via local access. |
CVE-2025-24511 | Low | 3.3 | 2025-08-12 | Improper initialization in the Linux kernel-mode driver for some Intel(R) I350 Series Ethernet before version 5.19.2 may allow an authenticated user to potenti… |
CVE-2025-24486 | High | 7.8 | 2025-08-12 | Improper input validation in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user to potent… |
CVE-2025-24484 | High | 7.8 | 2025-08-12 | Improper input validation in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.17.2 may allow an authenticated user to potent… |
CVE-2025-24325 | High | 8.8 | 2025-08-12 | Improper input validation in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.17.2 may allow an authenticated user to potent… |
CVE-2025-24324 | Low | 2.8 | 2025-08-12 | Integer overflow or wraparound in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.17.2 may allow an authenticated user to p… |
CVE-2025-24323 | Medium | 6.5 | 2025-08-12 | Improper access control in some firmware package and LED mode toggle tool for some Intel(R) PCIe Switch software before version MR4_1.0b1 may allow a privilege… |
CVE-2025-24313 | Medium | 4.4 | 2025-08-12 | Improper access control for some Device Plugins for Kubernetes software maintained by Intel before version 0.32.0 may allow a privileged user to potentially en… |
CVE-2025-24305 | High | 7.2 | 2025-08-12 | Insufficient control flow management in the Alias Checking Trusted Module (ACTM) firmware for some Intel(R) Xeon(R) processors may allow a privileged user to p… |
CVE-2025-24303 | High | 7.8 | 2025-08-12 | Improper check for unusual or exceptional conditions in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.17.2 may allow an a… |
CVE-2025-24302 | Medium | 6.7 | 2025-08-12 | Uncontrolled recursion for some TinyCBOR libraries maintained by Intel(R) before version 0.6.1 may allow an authenticated user to potentially enable escalation… |
CVE-2025-24296 | Medium | 6.0 | 2025-08-12 | Improper input validation in some firmware for the Intel(R) E810 Ethernet before version 4.6 may allow a privileged user to enable denial of service via local… |
CVE-2025-23241 | High | 7.3 | 2025-08-12 | Integer overflow or wraparound in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.17.2 may allow an authenticated user to p… |
CVE-2025-22893 | High | 7.8 | 2025-08-12 | Insufficient control flow management in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.17.2 may allow an authenticated use… |
CVE-2025-22889 | High | 7.9 | 2025-08-12 | Improper handling of overlap between protected memory ranges for some Intel(R) Xeon(R) 6 processor with Intel(R) TDX may allow a privileged user to potentially… |
CVE-2025-22853 | Low | 2.3 | 2025-08-12 | Improper synchronization in the firmware for some Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2025-22840 | High | 7.4 | 2025-08-12 | Sequence of processor instructions leads to unexpected behavior for some Intel(R) Xeon(R) 6 Scalable processors may allow an authenticated user to potentially… |
CVE-2025-22839 | High | 7.5 | 2025-08-12 | Insufficient granularity of access control in the OOB-MSM for some Intel(R) Xeon(R) 6 Scalable processors may allow a privileged user to potentially enable esc… |
CVE-2025-22838 | Medium | 6.7 | 2025-08-12 | Uncontrolled search path for some Intel(R) RealSense(TM) Dynamic Calibrator software before version 2.14.2.0 may allow an authenticated user to potentially ena… |
CVE-2025-22836 | High | 7.8 | 2025-08-12 | Integer overflow or wraparound in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.17.2 may allow an authenticated user to p… |
CVE-2025-22392 | Medium | 4.4 | 2025-08-12 | Out-of-bounds read in firmware for some Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentially enable information disclosu… |
CVE-2025-21096 | Low | 1.9 | 2025-08-12 | Improper buffer restrictions in the firmware for some Intel(R) TDX may allow a privileged user to potentially enable escalation of privilege via local access. |
CVE-2025-21093 | Medium | 6.7 | 2025-08-12 | Uncontrolled search path element for some Intel(R) Driver & Support Assistant Tool software before version 24.6.49.8 may allow an authenticated user to pot… |
CVE-2025-21090 | Medium | 6.5 | 2025-08-12 | Missing reference to active allocated resource for some Intel(R) Xeon(R) processors may allow an authenticated user to potentially enable denial of service via… |
CVE-2025-21086 | High | 7.5 | 2025-08-12 | Improper input validation in the Linux kernel-mode driver for some Intel(R) 700 Series Ethernet before version 2.28.5 may allow an authenticated user to potent… |
CVE-2025-20627 | Medium | 6.7 | 2025-08-12 | Uncontrolled search path for some Intel(R) oneAPI DPC++/C++ Compiler software before version 2025.0.1 may allow an authenticated user to potentially enable esc… |
CVE-2025-20625 | High | 7.4 | 2025-08-12 | Improper conditions check for some Intel(R) PROSet/Wireless WiFi Software for Windows before version 23.110.0.5 may allow an unauthenticated user to potentiall… |
CVE-2025-20613 | Low | 3.3 | 2025-08-12 | Predictable Seed in Pseudo-Random Number Generator (PRNG) in the firmware for some Intel(R) TDX may allow an authenticated user to potentially enable informati… |
CVE-2025-20109 | High | 7.8 | 2025-08-12 | Improper Isolation or Compartmentalization in the stream cache mechanism for some Intel(R) Processors may allow an authenticated user to potentially enable esc… |
CVE-2025-20099 | Medium | 6.7 | 2025-08-12 | Improper access control for some Intel(R) Rapid Storage Technology installation software may allow an authenticated user to potentially enable escalation of pr… |
CVE-2025-20093 | High | 8.2 | 2025-08-12 | Improper check for unusual or exceptional conditions in the Linux kernel-mode driver for some Intel(R) 800 Series Ethernet before version 1.17.2 may allow an a… |
CVE-2025-20092 | Medium | 6.7 | 2025-08-12 | Uncontrolled search path for some Clock Jitter Tool software before version 6.0.1 may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2025-20090 | Medium | 5.5 | 2025-08-12 | Untrusted Pointer Dereference for some Intel(R) QuickAssist Technology software before version 2.5.0 may allow an authenticated user to potentially enable deni… |
CVE-2025-20087 | Medium | 6.7 | 2025-08-12 | Incorrect default permissions for some Intel(R) oneAPI DPC++/C++ Compiler software installers may allow an authenticated user to potentially enable escalation… |
CVE-2025-20077 | Medium | 5.3 | 2025-08-12 | Missing release of memory after effective lifetime in the UEFI OobRasMmbiHandlerDriver module for some Intel(R) reference server platforms may allow a privileg… |
CVE-2025-20074 | High | 7.8 | 2025-08-12 | Time-of-check Time-of-use race condition for some Intel(R) Connectivity Performance Suite software installers before version 40.24.11210 may allow an authentic… |
CVE-2025-20067 | Medium | 6.0 | 2025-08-12 | Observable timing discrepancy in firmware for some Intel(R) CSME and Intel(R) SPS may allow a privileged user to potentially enable information disclosure via… |
CVE-2025-20053 | High | 7.2 | 2025-08-12 | Improper buffer restrictions for some Intel(R) Xeon(R) Processor firmware with SGX enabled may allow a privileged user to potentially enable escalation of priv… |
CVE-2025-20048 | Medium | 6.7 | 2025-08-12 | Uncontrolled search path for the Intel(R) Trace Analyzer and Collector software all verions may allow an authenticated user to potentially enable escalation of… |
CVE-2025-20037 | High | 7.2 | 2025-08-12 | Time-of-check time-of-use race condition in firmware for some Intel(R) Converged Security and Management Engine may allow a privileged user to potentially enab… |
CVE-2025-20025 | Medium | 4.4 | 2025-08-12 | Uncontrolled recursion for some TinyCBOR libraries maintained by Intel(R) before version 0.6.1 may allow an authenticated user to potentially enable denial of… |
CVE-2025-20023 | Medium | 6.7 | 2025-08-12 | Incorrect default permissions for some Intel(R) Graphics Driver software installers may allow an authenticated user to potentially enable escalation of privile… |
CVE-2025-20017 | Medium | 6.7 | 2025-08-12 | Uncontrolled search path for some Intel(R) oneAPI Toolkit and component software installers may allow an authenticated user to potentially enable escalation of… |
CVE-2025-8452 | Medium | 4.3 | 2025-08-12 | By using the "uscan" protocol provided by the eSCL specification, an attacker can discover the serial number of multi-function printers that implement the Brot… |
CVE-2025-55164 | | 2025-08-12 | content-security-policy-parser parses content security policy directives. A prototype pollution vulnerability exists in versions 0.5.0 and earlier, wherein if… | |
CVE-2025-55011 | Medium | 6.4 | 2025-08-12 | Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, the createTaskFile method in the API does not validate… |
CVE-2025-55010 | Critical | 9.1 | 2025-08-12 | Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, an unsafe deserialization vulnerability in the Project… |
CVE-2025-54864 | High | 7.5 | 2025-08-12 | Hydra is a continuous integration service for Nix based projects. Prior to commit f7bda02, /api/push-github and /api/push-gitea are called by the corresponding… |
CVE-2025-54800 | Medium | 6.1 | 2025-08-12 | Hydra is a continuous integration service for Nix based projects. Prior to commit dea1e16, a malicious package can introduce arbitrary JavaScript code into the… |
CVE-2025-3089 | | 2025-08-12 | ServiceNow has addressed a Broken Access Control vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could allow a low privileg… | |
CVE-2025-38500 | High | 7.8 | 2025-08-12 | In the Linux kernel, the following vulnerability has been resolved: xfrm: interface: fix use-after-free after changing collect_md xfrm interface collect_md p… |
CVE-2025-8310 | Medium | 6.5 | 2025-08-12 | Missing authorization in the admin console of Ivanti Virtual Application Delivery Controller before version 22.9 allows a remote authenticated attacker to take… |
CVE-2025-8297 | High | 7.2 | 2025-08-12 | Incomplete restriction of configuration in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to achieve r… |
CVE-2025-8296 | High | 7.2 | 2025-08-12 | SQL injection in Ivanti Avalanche before version 6.4.8.8008 allows a remote authenticated attacker with admin privileges to execute arbitrary SQL queries. In c… |
CVE-2025-5468 | Medium | 5.5 | 2025-08-12 | Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before… |
CVE-2025-5466 | Medium | 4.9 | 2025-08-12 | XEE in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Sec… |
CVE-2025-5462 | High | 7.5 | 2025-08-12 | A heap-based buffer overflow in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 a… |
CVE-2025-5456 | High | 7.5 | 2025-08-12 | A buffer over-read vulnerability in Ivanti Connect Secure before 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 2.8R2.3-72… |
CVE-2025-3831 | High | 8.1 | 2025-08-12 | Log files uploaded during troubleshooting by the Harmony SASE agent may have been accessible to unauthorized parties. |
CVE-2025-22834 | Medium | 4.2 | 2025-08-12 | AMI APTIOV contains a vulnerability in BIOS where a user may cause “Improper Initialization” by local accessing. Successful exploitation of this vulnerability… |
CVE-2025-22830 | Medium | 6.7 | 2025-08-12 | APTIOV contains a vulnerability in BIOS where a skilled user may cause “Race Condition” by local access. A successful exploitation of this vulnerability may le… |
CVE-2025-43735 | Medium | 6.1 | 2025-08-12 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 thro… |
CVE-2025-40770 | High | 7.4 | 2025-08-12 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions). The affected application uses a monitoring interface that is… |
CVE-2025-40769 | High | 7.4 | 2025-08-12 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application uses a Content Security Poli… |
CVE-2025-40768 | High | 7.3 | 2025-08-12 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application exposes an internal service… |
CVE-2025-40767 | High | 7.8 | 2025-08-12 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application runs docker containers witho… |
CVE-2025-40766 | Medium | 5.5 | 2025-08-12 | A vulnerability has been identified in SINEC Traffic Analyzer (6GK8822-1BG01-0BA0) (All versions < V3.0). The affected application runs docker containers witho… |
CVE-2025-40764 | High | 7.8 | 2025-08-12 | A vulnerability has been identified in Simcenter Femap V2406 (All versions < V2406.0003), Simcenter Femap V2412 (All versions < V2412.0002). The affected appli… |
CVE-2025-40762 | High | 7.8 | 2025-08-12 | A vulnerability has been identified in Simcenter Femap V2406 (All versions < V2406.0003), Simcenter Femap V2412 (All versions < V2412.0002). The affected appli… |
CVE-2025-40761 | High | 7.6 | 2025-08-12 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions), RUGGEDCOM ROX MX5000RE (All versions), RUGGEDCOM ROX RX1400 (All versions), RUGGEDC… |
CVE-2025-40759 | High | 7.8 | 2025-08-12 | A vulnerability has been identified in SIMATIC S7-PLCSIM V17 (All versions), SIMATIC STEP 7 V17 (All versions < V17 Update 9), SIMATIC STEP 7 V18 (All versions… |
CVE-2025-40753 | Medium | 6.2 | 2025-08-12 | A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA01-2AA1)… |
CVE-2025-40752 | Medium | 6.2 | 2025-08-12 | A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions >= V2.60 < V2.62), POWER METER SICAM Q100 (7KG9501-0AA01-2AA1)… |
CVE-2025-40751 | Medium | 6.3 | 2025-08-12 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected SIMATIC RTLS Locating Manager Report Clients do not proper… |
CVE-2025-40746 | Critical | 9.1 | 2025-08-12 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.2). Affected products do not properly validate input for a backup scrip… |
CVE-2025-40743 | High | 8.3 | 2025-08-12 | A vulnerability has been identified in SINUMERIK 828D PPU.4 (All versions < V4.95 SP5), SINUMERIK 828D PPU.5 (All versions < V5.25 SP1), SINUMERIK 840D sl (All… |
CVE-2025-40584 | Medium | 5.5 | 2025-08-12 | A vulnerability has been identified in SIMOTION SCOUT TIA V5.4 (All versions), SIMOTION SCOUT TIA V5.5 (All versions), SIMOTION SCOUT TIA V5.6 (All versions <… |
CVE-2025-40570 | Low | 2.4 | 2025-08-12 | A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions < V10.0), SIPROTEC 5 6MD85 (CP300) (All versions >= V7.80 < V10.0), SIPROTEC 5 6M… |
CVE-2025-33023 | Medium | 4.1 | 2025-08-12 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions), RUGGEDCOM ROX MX5000RE (All versions), RUGGEDCOM ROX RX1400 (All versions), RUGGEDC… |
CVE-2025-30034 | Medium | 6.2 | 2025-08-12 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V3.3). Affected devices do not properly validate input sent to its listeni… |
CVE-2025-30033 | High | 7.8 | 2025-08-12 | The affected setup component is vulnerable to DLL hijacking. This could allow an attacker to execute arbitrary code when a legitimate user installs an applicat… |
CVE-2025-43736 | Medium | 4.3 | 2025-08-12 | A Denial Of Service via File Upload (DOS) vulnerability in the Liferay Portal 7.4.3.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.8, 2024.Q4.0… |
CVE-2025-8885 | | 2025-08-12 | Allocation of Resources Without Limits or Throttling vulnerability in Legion of the Bouncy Castle Inc. BC Java bcprov on All (API modules), Legion of the Bounc… | |
CVE-2025-41686 | High | 7.8 | 2025-08-12 | A low-privileged local attacker can exploit improper permissions on nssm.exe to escalate their privileges and gain administrative access. |
CVE-2025-26398 | Medium | 5.6 | 2025-08-12 | SolarWinds Database Performance Analyzer was found to contain a hard-coded cryptographic key. If exploited, this vulnerability could lead to a machine-in-the-m… |
CVE-2025-8874 | Medium | 6.4 | 2025-08-12 | The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross… |
CVE-2025-8767 | Medium | 4.8 | 2025-08-12 | The AnWP Football Leagues plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 0.16.17 via the 'download_csv_players' and… |
CVE-2025-8482 | Medium | 4.3 | 2025-08-12 | The Simple Local Avatars plugin for WordPress is vulnerable to unauthorized modification of data in version 2.8.4. This is due to a missing capability check on… |
CVE-2025-8418 | High | 8.8 | 2025-08-12 | The B Slider- Gutenberg Slider Block for WP plugin for WordPress is vulnerable to Arbitrary Plugin Installation in all versions up to, and including, 1.1.30. T… |
CVE-2025-47444 | Medium | 5.3 | 2025-08-12 | Missing Authorization vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-8081 | Medium | 4.9 | 2025-08-12 | The Elementor plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.30.2 via the Import_Images::import() function d… |
CVE-2025-6253 | High | 7.5 | 2025-08-12 | The UiCore Elements – Free Elementor widgets and templates plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.3… |
CVE-2025-3892 | Medium | 6.7 | 2025-08-12 | ACAP applications can be executed with elevated privileges, potentially leading to privilege escalation. This vulnerability can only be exploited if the Axis d… |
CVE-2025-30027 | Medium | 6.7 | 2025-08-12 | An ACAP configuration file lacked sufficient input validation, which could allow for arbitrary code execution. This vulnerability can only be exploited if the… |
CVE-2025-8314 | Medium | 6.4 | 2025-08-12 | The Software Issue Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘noaccess_msg parameter in all versions up to, and includi… |
CVE-2025-8059 | Critical | 9.8 | 2025-08-12 | The B Blocks plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization and improper input validation within the rgfr_registration… |
CVE-2025-7622 | Medium | 5.7 | 2025-08-12 | During an internal security assessment, a Server-Side Request Forgery (SSRF) vulnerability that allowed an authenticated attacker to access internal resources… |
CVE-2025-8690 | Medium | 6.4 | 2025-08-12 | The Simple Responsive Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.0 due to insufficient in… |