2025 CVEs (page 225)
Page 225 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8774 | Low | 2.5 | 2025-08-09 | A vulnerability has been found in riscv-boom SonicBOOM up to 2.2.3 and classified as problematic. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-8773 | High | 7.3 | 2025-08-09 | A vulnerability, which was classified as critical, was found in Dinstar Monitoring Platform 甘肃省危险品库监控平台 1.0. Affected is an unknown function of the file /itc/$… |
CVE-2025-8772 | Medium | 4.3 | 2025-08-09 | A vulnerability, which was classified as problematic, has been found in Vinades NukeViet up to 4.5.06. This issue affects some unknown processing of the file /… |
CVE-2025-8765 | Low | 3.5 | 2025-08-09 | A vulnerability classified as problematic was found in Datacom DM955 5GT 1200 825.8010.00. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2025-8764 | Medium | 6.3 | 2025-08-09 | A vulnerability classified as critical has been found in linlinjava litemall up to 1.8.0. Affected is the function Upload of the file /wx/storage/upload. The m… |
CVE-2025-8763 | Low | 3.7 | 2025-08-09 | A vulnerability was found in Ruijie EG306MG 3.0(1)B11P309. It has been rated as problematic. This issue affects some unknown processing of the file /etc/strong… |
CVE-2025-8759 | Low | 3.7 | 2025-08-09 | A vulnerability was found in TRENDnet TN-200 1.02b02. It has been declared as problematic. This vulnerability affects unknown code of the component Lighttpd. T… |
CVE-2025-8758 | High | 7.0 | 2025-08-09 | A vulnerability was found in TRENDnet TEW-822DRE FW103B02. It has been classified as problematic. This affects an unknown part of the component vsftpd. The man… |
CVE-2025-8757 | High | 7.0 | 2025-08-09 | A vulnerability was found in TRENDnet TV-IP110WN 1.2.2 and classified as problematic. Affected by this issue is some unknown functionality of the file /server/… |
CVE-2025-8756 | Medium | 6.3 | 2025-08-09 | A vulnerability has been found in TDuckCloud tduck-platform up to 5.1 and classified as critical. Affected by this vulnerability is the function preHandle of t… |
CVE-2025-8755 | Medium | 5.3 | 2025-08-09 | A vulnerability was found in macrozheng mall up to 1.0.3 and classified as problematic. This issue affects the function detail of the file UmsMemberController… |
CVE-2025-8753 | Medium | 5.4 | 2025-08-09 | A vulnerability, which was classified as critical, has been found in linlinjava litemall up to 1.8.0. Affected by this issue is the function delete of the file… |
CVE-2025-7726 | Medium | 6.4 | 2025-08-09 | The The7 theme for WordPress is vulnerable to Stored Cross-Site Scripting via its lightbox rendering code in all versions up to, and including, 12.6.0 due to i… |
CVE-2025-7020 | | 2025-08-09 | An incorrect encryption implementation vulnerability exists in the system log dump feature of BYD's DiLink 3.0 OS (e.g. in the model ATTO3). An attacker with p… | |
CVE-2025-8752 | High | 7.3 | 2025-08-09 | A vulnerability was found in wangzhixuan spring-shiro-training up to 94812c1fd8f7fe796c931f4984ff1aa0671ab562. It has been declared as critical. This vulnerabi… |
CVE-2025-8751 | Low | 3.1 | 2025-08-09 | A vulnerability was found in Protected Total WebShield Extension up to 3.2.0 on Chrome. It has been classified as problematic. This affects an unknown part of… |
CVE-2025-8750 | Low | 2.4 | 2025-08-09 | A vulnerability has been found in macrozheng mall up to 1.0.3 and classified as problematic. Affected by this vulnerability is the function Upload of the file… |
CVE-2025-8746 | Low | 3.3 | 2025-08-09 | A vulnerability, which was classified as problematic, was found in GNU libopts up to 27.6. Affected is the function __strstr_sse2. The manipulation leads to me… |
CVE-2025-8745 | Medium | 5.3 | 2025-08-09 | A vulnerability, which was classified as problematic, has been found in Weee RICEPO App 6.17.77 on Android. This issue affects some unknown processing of the f… |
CVE-2025-4655 | Medium | 5.0 | 2025-08-09 | SSRF vulnerability in FreeMarker templates in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.5, 2024.Q4.0 through 2024.Q4.7… |
CVE-2025-4581 | High | 8.6 | 2025-08-09 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 throu… |
CVE-2025-55149 | | 2025-08-09 | Tiny-Scientist is a lightweight framework for automating the entire lifecycle of scientific research—from ideation to implementation, writing, and review. In v… | |
CVE-2025-55013 | Medium | 4.2 | 2025-08-09 | The Assemblyline 4 Service Client interfaces with the API to fetch tasks and publish the result for a service in Assemblyline 4. In versions below 4.6.1.dev138… |
CVE-2025-55009 | High | 7.1 | 2025-08-09 | The AuthKit library for Remix provides convenient helpers for authentication and session management using WorkOS & AuthKit with Remix. In versions 0.14.1 and b… |
CVE-2025-55008 | High | 7.1 | 2025-08-09 | The AuthKit library for React Router 7+ provides helpers for authentication and session management using WorkOS & AuthKit with React Router. In versions 0.6.1… |
CVE-2025-55006 | Medium | 4.3 | 2025-08-09 | Frappe Learning is a learning system that helps users structure their content. In versions 2.33.0 and below, the image upload functionality did not adequately… |
CVE-2025-55003 | Medium | 5.7 | 2025-08-09 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and… |
CVE-2025-55001 | Medium | 6.5 | 2025-08-09 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and… |
CVE-2025-55000 | Medium | 6.5 | 2025-08-09 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 thro… |
CVE-2025-54999 | Low | 3.7 | 2025-08-09 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 thro… |
CVE-2025-54998 | Medium | 5.3 | 2025-08-09 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 0.1.0 thro… |
CVE-2025-54997 | Critical | 9.1 | 2025-08-09 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and… |
CVE-2025-55152 | Medium | 5.3 | 2025-08-09 | oak is a middleware framework for Deno's native HTTP server, Deno Deploy, Node.js 16.5 and later, Cloudflare Workers and Bun. In versions 17.1.5 and below, it'… |
CVE-2025-54996 | High | 7.2 | 2025-08-09 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. In versions 2.3.1 and… |
CVE-2025-54888 | | 2025-08-09 | Fedify is a TypeScript library for building federated server apps powered by ActivityPub. In versions below 1.3.20, 1.4.0-dev.585 through 1.4.12, 1.5.0-dev.636… | |
CVE-2025-54417 | High | 8.8 | 2025-08-09 | Craft is a platform for creating digital experiences. Versions 4.13.8 through 4.16.2 and 5.5.8 through 5.8.3 contain a vulnerability that can bypass CVE-2025-2… |
CVE-2025-8744 | High | 7.3 | 2025-08-09 | A vulnerability classified as critical was found in CesiumLab Web up to 4.0. This vulnerability affects unknown code of the file /lodmodels/. The manipulation… |
CVE-2025-6573 | Critical | 9.8 | 2025-08-09 | Kernel software installed and running inside an untrusted/rich execution environment (REE) could leak information from the trusted execution environment (TEE). |
CVE-2025-46709 | High | 7.5 | 2025-08-09 | Possible memory leak or kernel exceptions caused by reading kernel heap data after free or NULL pointer dereference kernel exception. |
CVE-2025-8743 | Low | 3.5 | 2025-08-08 | A vulnerability classified as problematic has been found in Scada-LTS up to 2.7.8.1. This affects an unknown part of the file /data_source_edit.shtm of the com… |
CVE-2025-8742 | Low | 3.7 | 2025-08-08 | A vulnerability was found in macrozheng mall 1.0.3. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Adm… |
CVE-2025-8741 | Low | 3.7 | 2025-08-08 | A vulnerability was found in macrozheng mall up to 1.0.3. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of th… |
CVE-2025-8740 | Low | 2.4 | 2025-08-08 | A vulnerability was found in zhenfeng13 My-Blog up to 1.0.0. It has been classified as problematic. Affected is an unknown function of the file /admin/categori… |
CVE-2025-8739 | Medium | 4.3 | 2025-08-08 | A vulnerability was found in zhenfeng13 My-Blog up to 1.0.0 and classified as problematic. This issue affects some unknown processing of the file /admin/tags/s… |
CVE-2025-55188 | Low | 3.6 | 2025-08-08 | 7-Zip before 25.01 does not always properly handle symbolic links during extraction. |
CVE-2025-8738 | Medium | 5.3 | 2025-08-08 | A vulnerability has been found in zlt2000 microservices-platform up to 6.0.0 and classified as problematic. This vulnerability affects unknown code of the file… |
CVE-2025-8737 | Low | 3.5 | 2025-08-08 | A vulnerability, which was classified as problematic, was found in zlt2000 microservices-platform up to 6.0.0. This affects the function onLogoutSuccess of the… |
CVE-2025-8736 | Medium | 5.3 | 2025-08-08 | A vulnerability, which was classified as critical, has been found in GNU cflow up to 1.8. Affected by this issue is the function yylex of the file c.c of the c… |
CVE-2025-8735 | Low | 3.3 | 2025-08-08 | A vulnerability classified as problematic was found in GNU cflow up to 1.8. Affected by this vulnerability is the function yylex of the file c.c of the compone… |
CVE-2025-4796 | High | 8.8 | 2025-08-08 | The Eventin plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.34. This is due to the pl… |
CVE-2025-5095 | Critical | 9.8 | 2025-08-08 | Burk Technology ARC Solo's password change mechanism can be utilized without proper authentication procedures, allowing an attacker to take over the device. … |
CVE-2025-52914 | High | 8.8 | 2025-08-08 | A vulnerability in the Suite Applications Services component of Mitel MiCollab 10.0 through SP1 FP1 (10.0.1.101) could allow an authenticated attacker to condu… |
CVE-2025-52913 | Critical | 9.8 | 2025-08-08 | A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP2 (9.8.2.12) could allow an unauthenticated attacker to conduc… |
CVE-2025-50928 | Medium | 4.8 | 2025-08-08 | Easy Hosting Control Panel EHCP v20.04.1.b was discovered to contain a SQL injection vulnerability via the id parameter in the Change Settings function. |
CVE-2025-50927 | Medium | 6.3 | 2025-08-08 | A reflected cross-site scripting (XSS) vulnerability in the List All FTP User Function in EHCP v20.04.1.b allows authenticated attackers to execute arbitrary J… |
CVE-2025-8732 | Low | 3.3 | 2025-08-08 | A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the comp… |
CVE-2025-8393 | High | 7.3 | 2025-08-08 | A TLS vulnerability exists in the phone application used to manage a connected device. The phone application accepts self-signed certificates when establishi… |
CVE-2025-8284 | Critical | 9.8 | 2025-08-08 | By default, the Packet Power Monitoring and Control Web Interface do not enforce authentication mechanisms. This vulnerability could allow unauthorized users… |
CVE-2025-53520 | High | 8.8 | 2025-08-08 | The affected product allows firmware updates to be downloaded from EG4's website, transferred via USB dongles, or installed through EG4's Monitoring Center (… |
CVE-2025-50468 | Medium | 6.5 | 2025-08-08 | OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the DocStoreDAO interface… |
CVE-2025-50467 | Medium | 6.5 | 2025-08-08 | OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestDefinitionDAO inter… |
CVE-2025-50466 | High | 7.1 | 2025-08-08 | OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestDefinitionDAO inter… |
CVE-2025-50465 | High | 7.1 | 2025-08-08 | OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestDefinitionDAO inter… |
CVE-2025-47872 | Medium | 5.8 | 2025-08-08 | The public-facing product registration endpoint server responds differently depending on whether the S/N is valid and unregistered, valid but already registe… |
CVE-2025-46414 | High | 8.1 | 2025-08-08 | The affected product does not limit the number of attempts for inputting the correct PIN for a registered product, which may allow an attacker to gain unauth… |
CVE-2025-8731 | Critical | 9.8 | 2025-08-08 | A vulnerability was identified in TRENDnet TI-G160i, TI-PG102i and TPL-430AP up to 20250724. This affects an unknown part of the component SSH Service. The man… |
CVE-2025-8356 | Critical | 9.8 | 2025-08-08 | In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remot… |
CVE-2025-8355 | High | 7.5 | 2025-08-08 | In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing refe… |
CVE-2025-52586 | Medium | 6.9 | 2025-08-08 | The MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext without encryption or obfuscation. This vulnerabilit… |
CVE-2025-4576 | Medium | 6.1 | 2025-08-08 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 thro… |
CVE-2025-8730 | Critical | 9.8 | 2025-08-08 | A vulnerability was found in Belkin F9K1009 and F9K1010 2.00.04/2.00.09 and classified as critical. Affected by this issue is some unknown functionality of the… |
CVE-2025-36119 | High | 7.1 | 2025-08-08 | IBM i 7.3, 7.4, 7.5, and 7.6 is affected by an authenticated user obtaining elevated privileges with IBM Digital Certificate Manager for i (DCM) due to a web s… |
CVE-2025-36023 | Medium | 6.5 | 2025-08-08 | IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF005 and 24.0.1 through 24.0.1 IF002 could allow an authenticated user to view sensitive user and… |
CVE-2025-8729 | Medium | 6.3 | 2025-08-08 | A vulnerability has been found in MigoXLab LMeterX 1.2.0 and classified as critical. Affected by this vulnerability is the function process_cert_files of the f… |
CVE-2025-8749 | Medium | 6.5 | 2025-08-08 | Path Traversal vulnerability in API Endpoint in Mobile Industrial Robots (MiR) Software Versions prior to 3.0.0 on MiR Robots allows authenticated users to ext… |
CVE-2025-8088 | High | 8.8 | 2025-08-08 | A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This… |
CVE-2025-8748 | High | 8.8 | 2025-08-08 | MiR software versions prior to version 3.0.0 are affected by a command injection vulnerability. A malicious HTTP request crafted by an authenticated user coul… |
CVE-2025-53606 | Critical | 9.8 | 2025-08-08 | Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): 2.4.0. Users are recommended to u… |
CVE-2025-48913 | Critical | 9.8 | 2025-08-08 | If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities… |
CVE-2025-6572 | Medium | 5.9 | 2025-08-08 | The OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2.0 does not validate and escape some of its bl… |
CVE-2025-54959 | Medium | 4.3 | 2025-08-08 | Powered BLUE Server versions 0.20130927 and prior contain a path traversal vulnerability. If this vulnerability is exploited, an arbitrary file in the affected… |
CVE-2025-54958 | Medium | 6.3 | 2025-08-08 | Powered BLUE 870 versions 0.20130927 and prior contain an OS command injection vulnerability. If this vulnerability is exploited, arbitrary OS commands may be… |
CVE-2025-54940 | Low | 3.4 | 2025-08-08 | An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. If this vulnerability is exploited, crafted HTML code may b… |
CVE-2025-8708 | Medium | 5.0 | 2025-08-08 | A vulnerability was found in Antabot White-Jotter 0.22. It has been declared as critical. This vulnerability affects the function CookieRememberMeManager of th… |
CVE-2025-8707 | Medium | 5.3 | 2025-08-08 | A vulnerability was found in Huuge Box App 1.0.3 on Android. It has been classified as problematic. This affects an unknown part of the file AndroidManifest.xm… |
CVE-2025-8706 | Medium | 6.3 | 2025-08-08 | A vulnerability has been found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0 and classified as critical. Affected by this vulnerability is… |
CVE-2025-8705 | Medium | 6.3 | 2025-08-08 | A vulnerability, which was classified as critical, was found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. Affected is an unknown function… |
CVE-2025-8704 | Medium | 6.3 | 2025-08-08 | A vulnerability, which was classified as critical, has been found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. This issue affects some un… |
CVE-2025-8703 | Medium | 6.3 | 2025-08-08 | A vulnerability classified as critical was found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. This vulnerability affects unknown code of… |
CVE-2025-54887 | Critical | 9.1 | 2025-08-08 | jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption (JWE) standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brut… |
CVE-2025-54886 | High | 8.4 | 2025-08-08 | skops is a Python library which helps users share and ship their scikit-learn based models. In versions 0.12.0 and below, the Card.get_model does not contain a… |
CVE-2025-54793 | Medium | 6.1 | 2025-08-08 | Astro is a web framework for content-driven websites. In versions 5.2.0 through 5.12.7, there is an Open Redirect vulnerability in the trailing slash redirecti… |
CVE-2025-8702 | Medium | 6.3 | 2025-08-08 | A vulnerability classified as critical has been found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. This affects an unknown part of the fi… |
CVE-2025-54952 | Critical | 9.8 | 2025-08-08 | An integer overflow vulnerability in the loading of ExecuTorch models can cause smaller-than-expected memory regions to be allocated, potentially resulting in… |
CVE-2025-54368 | | 2025-08-08 | uv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP archives were handled in a streamwise fashion, and file e… | |
CVE-2025-54951 | Critical | 9.8 | 2025-08-07 | A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution… |
CVE-2025-54950 | Critical | 9.8 | 2025-08-07 | An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other unde… |
CVE-2025-54949 | Critical | 9.8 | 2025-08-07 | A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effects. This issue affe… |
CVE-2025-30405 | Critical | 9.8 | 2025-08-07 | An integer overflow vulnerability in the loading of ExecuTorch models can cause objects to be placed outside their allocated memory area, potentially resulting… |
CVE-2025-30404 | Critical | 9.8 | 2025-08-07 | An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execution or other undes… |