2025 CVEs (page 226)
Page 226 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-54787 | Low | 3.7 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a vulnerability in SuiteCRM version 7.14.6 w… |
CVE-2025-8701 | Medium | 6.3 | 2025-08-07 | A vulnerability was found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. It has been rated as critical. Affected by this issue is some unkn… |
CVE-2025-8698 | Low | 3.3 | 2025-08-07 | A vulnerability was found in Open5GS up to 2.7.5. It has been classified as problematic. Affected is the function amf_nsmf_pdusession_handle_release_sm_context… |
CVE-2025-53792 | Critical | 9.1 | 2025-08-07 | Azure Portal Elevation of Privilege Vulnerability |
CVE-2025-53787 | High | 8.2 | 2025-08-07 | Microsoft 365 Copilot BizChat Information Disclosure Vulnerability |
CVE-2025-53774 | Medium | 6.5 | 2025-08-07 | Microsoft 365 Copilot BizChat Information Disclosure Vulnerability |
CVE-2025-53767 | Critical | 10.0 | 2025-08-07 | Azure OpenAI Elevation of Privilege Vulnerability |
CVE-2025-45765 | Critical | 9.1 | 2025-08-07 | ruby-jwt v3.0.0.beta1 was discovered to contain weak encryption. NOTE: the Supplier's perspective is "keysize is not something that is enforced by this library… |
CVE-2025-26513 | High | 7.0 | 2025-08-07 | The installer for SAN Host Utilities for Windows versions prior to 8.0 is susceptible to a vulnerability which when successfully exploited could allow a local… |
CVE-2025-48709 | Low | 3.8 | 2025-08-07 | BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe th… |
CVE-2025-47808 | Medium | 5.6 | 2025-08-07 | In GStreamer through 1.26.1, the subparse plugin's tmplayer_parse_line function may dereference a NULL pointer while parsing a subtitle file, leading to a cras… |
CVE-2025-47807 | Medium | 5.5 | 2025-08-07 | In GStreamer through 1.26.1, the subparse plugin's subrip_unescape_formatting function may dereference a NULL pointer while parsing a subtitle file, leading to… |
CVE-2025-47806 | Medium | 5.6 | 2025-08-07 | In GStreamer through 1.26.1, the subparse plugin's parse_subrip_time function may write data past the bounds of a stack buffer, leading to a crash. |
CVE-2025-47219 | High | 8.1 | 2025-08-07 | In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading… |
CVE-2025-47183 | Medium | 6.6 | 2025-08-07 | In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4 file, leading to infor… |
CVE-2025-8697 | Medium | 6.3 | 2025-08-07 | A vulnerability was found in agentUniverse up to 0.0.18 and classified as critical. This issue affects the function StdioServerParameters of the component MCPS… |
CVE-2025-7195 | Medium | 6.4 | 2025-08-07 | Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15… |
CVE-2025-55077 | High | 7.4 | 2025-08-07 | Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Micros… |
CVE-2025-51533 | Medium | 5.3 | 2025-08-07 | An Insecure Direct Object Reference (IDOR) in Sage DPW v2024_12_004 and below allows unauthorized attackers to access internal forms via sending a crafted GET… |
CVE-2025-50692 | Critical | 9.8 | 2025-08-07 | FoxCMS <=v1.2.5 is vulnerable to Code Execution in admin/template_file/editFile.html. |
CVE-2025-50675 | High | 7.8 | 2025-08-07 | GPMAW 14, a bioinformatics software, has a critical vulnerability related to insecure file permissions in its installation directory. The directory is accessib… |
CVE-2025-51629 | High | 8.8 | 2025-08-07 | A cross-site scripting (XSS) vulnerability in the PdfViewer component of Agenzia Impresa Eccobook 2.81.1 allows attackers to execute arbitrary web scripts or H… |
CVE-2025-55138 | High | 7.4 | 2025-08-07 | LinkJoin through 882f196 mishandles token ownership in password reset. |
CVE-2025-55137 | High | 7.4 | 2025-08-07 | LinkJoin through 882f196 mishandles lacks type checking in password reset. |
CVE-2025-54397 | Medium | 4.3 | 2025-08-07 | Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 inserts Sensitive Information Into Sent Data to authenticated users. |
CVE-2025-54396 | Medium | 5.4 | 2025-08-07 | Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows SQL Injection. Authenticated users can exploit this. |
CVE-2025-54395 | Medium | 6.1 | 2025-08-07 | Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication configuration data. |
CVE-2025-54394 | Medium | 5.3 | 2025-08-07 | Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 has Insufficiently Protected Credentials for requests to remote Excel resour… |
CVE-2025-54393 | Medium | 5.4 | 2025-08-07 | Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows Static Code Injection. Authenticated users can obtain administrative… |
CVE-2025-54392 | Medium | 6.1 | 2025-08-07 | Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication error data, a different vulnerability than CVE… |
CVE-2025-34152 | | 2025-08-07 | An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '… | |
CVE-2025-34151 | | 2025-08-07 | A command injection vulnerability exists in the 'passwd' parameter of the PPPoE setup process on the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02)… | |
CVE-2025-34150 | | 2025-08-07 | The PPPoE configuration interface of the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) is vulnerable to command injection via the 'user' parameter… | |
CVE-2025-34149 | | 2025-08-07 | A command injection vulnerability affects the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) during WPA2 configuration. The 'key' parameter is inter… | |
CVE-2025-34148 | | 2025-08-07 | An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). When configuring the device in W… | |
CVE-2025-24000 | High | 8.8 | 2025-08-07 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Saad Iqbal Post SMTP post-smtp allows Authentication Bypass.This issue affects Post S… |
CVE-2025-7054 | Medium | 6.5 | 2025-08-07 | Cloudflare quiche was discovered to be vulnerable to an infinite loop when sending packets containing RETIRE_CONNECTION_ID frames. QUIC connections possess a… |
CVE-2025-55136 | Medium | 5.7 | 2025-08-07 | ERC (aka Emotion Recognition in Conversation) through 0.3 has insecure deserialization via a serialized object because jsonpickle is used. |
CVE-2025-55135 | Medium | 6.4 | 2025-08-07 | In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats other than PNG, JPEG… |
CVE-2025-55134 | Medium | 6.4 | 2025-08-07 | In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via tag in client/agora/public/js/editorManager.js. |
CVE-2025-55133 | Medium | 6.4 | 2025-08-07 | In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via topicName in client/agora/public/js/editorManager.js. |
CVE-2025-47907 | High | 7.0 | 2025-08-07 | Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unex… |
CVE-2025-44779 | Medium | 6.6 | 2025-08-07 | An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull. |
CVE-2025-50952 | Medium | 6.5 | 2025-08-07 | openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c. |
CVE-2025-47188 | Medium | 6.5 | 2025-08-07 | A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4… |
CVE-2025-8533 | | 2025-08-07 | A vulnerability was identified in the XPC services of Fantastical. The services failed to implement proper client authorization checks in its listener:shouldAc… | |
CVE-2025-35970 | High | 7.5 | 2025-08-07 | On multiple products of SEIKO EPSON and FUJIFILM Corporation, the initial administrator password is easy to guess from the information available via SNMP. If t… |
CVE-2025-29866 | | 2025-08-07 | : External Control of File Name or Path vulnerability in TAGFREE X-Free Uploader XFU allows : Parameter Injection.This issue affects X-Free Uploader: from 1.0… | |
CVE-2025-32094 | Medium | 4.0 | 2025-08-07 | An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTION… |
CVE-2025-8583 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Permissions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-8582 | Medium | 4.3 | 2025-08-07 | Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents of the Omnibox (URL… |
CVE-2025-8581 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2025-8580 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Filesystems in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-8579 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2025-8578 | High | 8.8 | 2025-08-07 | Use after free in Cast in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
CVE-2025-8577 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Picture In Picture in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2025-8576 | High | 8.8 | 2025-08-07 | Use after free in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Exte… |
CVE-2025-29865 | | 2025-08-07 | : Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TAGFREE X-Free Uploader XFU allows Path Traversal.This issue… | |
CVE-2025-54885 | | 2025-08-07 | Thinbus Javascript Secure Remote Password is a browser SRP6a implementation for zero-knowledge password authentication. In versions 2.0.0 and below, a protocol… | |
CVE-2025-54882 | High | 7.1 | 2025-08-07 | Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stor… |
CVE-2025-54799 | | 2025-08-07 | Let's Encrypt client and ACME library written in Go (Lego). In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package (thus the lego librar… | |
CVE-2025-54798 | Low | 2.5 | 2025-08-07 | tmp is a temporary file and directory creator for node.js. In versions 0.2.3 and below, tmp is vulnerable to an arbitrary temporary file / directory write via… |
CVE-2025-54784 | Medium | 6.1 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a Cross Site Scripting (XSS) vulnerability i… |
CVE-2025-54783 | Medium | 6.1 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. Versions 7.14.6 and below have a Reflected Cross-Site… |
CVE-2025-3770 | High | 7.0 | 2025-08-07 | EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability… |
CVE-2025-54788 | High | 8.8 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions and below, the InboundEmail module allows… |
CVE-2025-54786 | Medium | 5.3 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, the broken authenticati… |
CVE-2025-54785 | High | 8.8 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. In versions 7.14.6 and 8.8.0, user-supplied input is… |
CVE-2025-7770 | | 2025-08-06 | Tigo Energy's CCA device is vulnerable to insecure session ID generation in their remote API. The session IDs are generated using a predictable method based on… | |
CVE-2025-7769 | | 2025-08-06 | Tigo Energy's CCA is vulnerable to a command injection vulnerability in the /cgi-bin/mobile_api endpoint when the DEVICE_PING command is called, allowing remot… | |
CVE-2025-7768 | | 2025-08-06 | Tigo Energy's Cloud Connect Advanced (CCA) device contains hard-coded credentials that allow unauthorized users to gain administrative access. This vulnerabili… | |
CVE-2025-6634 | High | 7.8 | 2025-08-06 | A maliciously crafted TGA file, when linked or imported into Autodesk 3ds Max, can force a Memory Corruption vulnerability. A malicious actor can leverage this… |
CVE-2025-6633 | High | 7.8 | 2025-08-06 | A maliciously crafted RBG file, when parsed through Autodesk 3ds Max, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulne… |
CVE-2025-6632 | Medium | 5.3 | 2025-08-06 | A maliciously crafted PSD file, when linked or imported into Autodesk 3ds Max, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage th… |
CVE-2025-51058 | Medium | 6.5 | 2025-08-06 | Bottinelli Informatical Vedo Suite 2024.17 is vulnerable to Server-side Request Forgery (SSRF) in the /api_vedo/video/preview endpoint, which allows remote aut… |
CVE-2025-51057 | Medium | 6.5 | 2025-08-06 | A local file inclusion (LFI) vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting… |
CVE-2025-51056 | High | 8.2 | 2025-08-06 | An unrestricted file upload vulnerability in Vedo Suite version 2024.17 allows remote authenticated attackers to write to arbitrary filesystem paths by exploit… |
CVE-2025-51055 | High | 8.6 | 2025-08-06 | Insecure Data Storage of credentials has been found in /api_vedo/configuration/config.yml file in Vedo Suite version 2024.17. This file contains clear-text cre… |
CVE-2025-51054 | Medium | 6.5 | 2025-08-06 | Vedo Suite 2024.17 is vulnerable to Incorrect Access Control, which allows remote attackers to obtain a valid high privilege JWT token without prior authentica… |
CVE-2025-51053 | Medium | 6.1 | 2025-08-06 | A Cross-site scripting (XSS) vulnerability in /api_vedo/ in Vedo Suite version 2024.17 allows remote attackers to inject arbitrary Javascript or HTML code and… |
CVE-2025-51052 | Medium | 6.5 | 2025-08-06 | A path traversal vulnerability in Vedo Suite 2024.17 allows remote authenticated attackers to read arbitrary filesystem files by exploiting an unsanitized 'fil… |
CVE-2025-50740 | Medium | 6.1 | 2025-08-06 | AutoConnect 1.4.2, an Arduino library, is vulnerable to a cross site scripting (xss) vulnerability. The AutoConnect web interface /_ac/config allows HTML/JS co… |
CVE-2025-47908 | High | 7.5 | 2025-08-06 | Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) he… |
CVE-2025-46660 | Medium | 5.3 | 2025-08-06 | An issue was discovered in 4C Strategies Exonaut 21.6. Passwords, stored in the database, are hashed without a salt. |
CVE-2025-51624 | High | 7.6 | 2025-08-06 | Cross-site scripting (XSS) vulnerability in Zone Bitaqati thru 3.4.0. |
CVE-2025-46659 | High | 7.5 | 2025-08-06 | An issue was discovered in ExonautWeb in 4C Strategies Exonaut 21.6. Information disclosure can occur via an external HTTPS request. |
CVE-2025-45766 | High | 7.0 | 2025-08-06 | poco v1.14.1-release was discovered to contain weak encryption. NOTE: this issue has been disputed on the basis that key lengths are expected to be set by an a… |
CVE-2025-45764 | Low | 3.2 | 2025-08-06 | jsrsasign v11.1.0 was discovered to contain weak encryption. NOTE: this issue has been disputed by a third party who believes that CVE IDs can be assigned for… |
CVE-2025-38747 | High | 7.8 | 2025-08-06 | Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contain a Creation of Temporary File With Insecure Permissions vulnerability. A local authenticated… |
CVE-2025-38746 | Low | 3.5 | 2025-08-06 | Dell SupportAssist OS Recovery, versions prior to 5.5.14.0, contains an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. An unauthenti… |
CVE-2025-8667 | Medium | 6.3 | 2025-08-06 | A vulnerability, which was classified as critical, was found in SkyworkAI DeepResearchAgent up to 08eb7f8eb9505d0094d75bb97ff7dacc3fa3bbf2. Affected is the fun… |
CVE-2025-8665 | Medium | 6.3 | 2025-08-06 | A vulnerability, which was classified as critical, has been found in agno-agi agno up to 1.7.5. This issue affects the function MCPTools/MultiMCPTools in the l… |
CVE-2025-8419 | Medium | 5.3 | 2025-08-06 | A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwan… |
CVE-2025-30127 | Critical | 9.8 | 2025-08-06 | An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. Once access is gained either by default, common, or cracked passwords, the video recordings… |
CVE-2025-20332 | Medium | 4.3 | 2025-08-06 | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to modify parts of the configuration on an aff… |
CVE-2025-20331 | Medium | 5.4 | 2025-08-06 | A vulnerability in the web-based management interface of Cisco ISE and Cisco ISE-PIC could allow an authenticated, remote attacker to conduct a stored XSS atta… |
CVE-2025-20215 | Medium | 5.4 | 2025-08-06 | A vulnerability in the meeting-join functionality of Cisco Webex Meetings could have allowed an unauthenticated, network-proximate attacker to complete a meeti… |
CVE-2025-53786 | High | 8.0 | 2025-08-06 | On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these cha… |
CVE-2025-51532 | High | 7.5 | 2025-08-06 | Incorrect access control in Sage DPW 2024_12_004 and earlier allows unauthorized attackers to access the built-in Database Monitor via a crafted request. The v… |
CVE-2025-51531 | Medium | 6.1 | 2025-08-06 | A reflected cross-site scripting (XSS) vulnerability in Sage DPW 2024_12_004 and earlier allows attackers to execute arbitrary JavaScript in the context of a v… |