2025 CVEs (page 227)
Page 227 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-52914 | High | 8.8 | 2025-08-08 | A vulnerability in the Suite Applications Services component of Mitel MiCollab 10.0 through SP1 FP1 (10.0.1.101) could allow an authenticated attacker to condu… |
CVE-2025-52913 | Critical | 9.8 | 2025-08-08 | A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP2 (9.8.2.12) could allow an unauthenticated attacker to conduc… |
CVE-2025-50928 | Medium | 4.8 | 2025-08-08 | Easy Hosting Control Panel EHCP v20.04.1.b was discovered to contain a SQL injection vulnerability via the id parameter in the Change Settings function. |
CVE-2025-50927 | Medium | 6.3 | 2025-08-08 | A reflected cross-site scripting (XSS) vulnerability in the List All FTP User Function in EHCP v20.04.1.b allows authenticated attackers to execute arbitrary J… |
CVE-2025-8732 | Low | 3.3 | 2025-08-08 | A vulnerability was found in libxml2 up to 2.14.5. It has been declared as problematic. This vulnerability affects the function xmlParseSGMLCatalog of the comp… |
CVE-2025-8393 | High | 7.3 | 2025-08-08 | A TLS vulnerability exists in the phone application used to manage a connected device. The phone application accepts self-signed certificates when establishi… |
CVE-2025-8284 | Critical | 9.8 | 2025-08-08 | By default, the Packet Power Monitoring and Control Web Interface do not enforce authentication mechanisms. This vulnerability could allow unauthorized users… |
CVE-2025-53520 | High | 8.8 | 2025-08-08 | The affected product allows firmware updates to be downloaded from EG4's website, transferred via USB dongles, or installed through EG4's Monitoring Center (… |
CVE-2025-50468 | Medium | 6.5 | 2025-08-08 | OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the DocStoreDAO interface… |
CVE-2025-50467 | Medium | 6.5 | 2025-08-08 | OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestDefinitionDAO inter… |
CVE-2025-50466 | High | 7.1 | 2025-08-08 | OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestDefinitionDAO inter… |
CVE-2025-50465 | High | 7.1 | 2025-08-08 | OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can extract information from the database in function listCount in the TestDefinitionDAO inter… |
CVE-2025-47872 | Medium | 5.8 | 2025-08-08 | The public-facing product registration endpoint server responds differently depending on whether the S/N is valid and unregistered, valid but already registe… |
CVE-2025-46414 | High | 8.1 | 2025-08-08 | The affected product does not limit the number of attempts for inputting the correct PIN for a registered product, which may allow an attacker to gain unauth… |
CVE-2025-8731 | Critical | 9.8 | 2025-08-08 | A vulnerability was identified in TRENDnet TI-G160i, TI-PG102i and TPL-430AP up to 20250724. This affects an unknown part of the component SSH Service. The man… |
CVE-2025-8356 | Critical | 9.8 | 2025-08-08 | In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead to Remot… |
CVE-2025-8355 | High | 7.5 | 2025-08-08 | In Xerox FreeFlow Core version 8.0.4, improper handling of XML input allows injection of external entities. An attacker can craft malicious XML containing refe… |
CVE-2025-52586 | Medium | 6.9 | 2025-08-08 | The MOD3 command traffic between the monitoring application and the inverter is transmitted in plaintext without encryption or obfuscation. This vulnerabilit… |
CVE-2025-4576 | Medium | 6.1 | 2025-08-08 | A reflected cross-site scripting (XSS) vulnerability in the Liferay Portal 7.4.0 through 7.4.3.133, and Liferay DXP 2025.Q1.0 through 2025.Q1.4 ,2024.Q4.0 thro… |
CVE-2025-8730 | Critical | 9.8 | 2025-08-08 | A vulnerability was found in Belkin F9K1009 and F9K1010 2.00.04/2.00.09 and classified as critical. Affected by this issue is some unknown functionality of the… |
CVE-2025-36119 | High | 7.1 | 2025-08-08 | IBM i 7.3, 7.4, 7.5, and 7.6 is affected by an authenticated user obtaining elevated privileges with IBM Digital Certificate Manager for i (DCM) due to a web s… |
CVE-2025-36023 | Medium | 6.5 | 2025-08-08 | IBM Cloud Pak for Business Automation 24.0.0 through 24.0.0 IF005 and 24.0.1 through 24.0.1 IF002 could allow an authenticated user to view sensitive user and… |
CVE-2025-8729 | Medium | 6.3 | 2025-08-08 | A vulnerability has been found in MigoXLab LMeterX 1.2.0 and classified as critical. Affected by this vulnerability is the function process_cert_files of the f… |
CVE-2025-8749 | Medium | 6.5 | 2025-08-08 | Path Traversal vulnerability in API Endpoint in Mobile Industrial Robots (MiR) Software Versions prior to 3.0.0 on MiR Robots allows authenticated users to ext… |
CVE-2025-8088 | High | 8.8 | 2025-08-08 | A path traversal vulnerability affecting the Windows version of WinRAR allows the attackers to execute arbitrary code by crafting malicious archive files. This… |
CVE-2025-8748 | High | 8.8 | 2025-08-08 | MiR software versions prior to version 3.0.0 are affected by a command injection vulnerability. A malicious HTTP request crafted by an authenticated user coul… |
CVE-2025-53606 | Critical | 9.8 | 2025-08-08 | Deserialization of Untrusted Data vulnerability in Apache Seata (incubating). This issue affects Apache Seata (incubating): 2.4.0. Users are recommended to u… |
CVE-2025-48913 | Critical | 9.8 | 2025-08-08 | If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities… |
CVE-2025-6572 | Medium | 5.9 | 2025-08-08 | The OpenStreetMap for Gutenberg and WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2.0 does not validate and escape some of its bl… |
CVE-2025-54959 | Medium | 4.3 | 2025-08-08 | Powered BLUE Server versions 0.20130927 and prior contain a path traversal vulnerability. If this vulnerability is exploited, an arbitrary file in the affected… |
CVE-2025-54958 | Medium | 6.3 | 2025-08-08 | Powered BLUE 870 versions 0.20130927 and prior contain an OS command injection vulnerability. If this vulnerability is exploited, arbitrary OS commands may be… |
CVE-2025-54940 | Low | 3.4 | 2025-08-08 | An HTML injection vulnerability exists in WordPress plugin "Advanced Custom Fields" prior to 6.4.3. If this vulnerability is exploited, crafted HTML code may b… |
CVE-2025-8708 | Medium | 5.0 | 2025-08-08 | A vulnerability was found in Antabot White-Jotter 0.22. It has been declared as critical. This vulnerability affects the function CookieRememberMeManager of th… |
CVE-2025-8707 | Medium | 5.3 | 2025-08-08 | A vulnerability was found in Huuge Box App 1.0.3 on Android. It has been classified as problematic. This affects an unknown part of the file AndroidManifest.xm… |
CVE-2025-8706 | Medium | 6.3 | 2025-08-08 | A vulnerability has been found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0 and classified as critical. Affected by this vulnerability is… |
CVE-2025-8705 | Medium | 6.3 | 2025-08-08 | A vulnerability, which was classified as critical, was found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. Affected is an unknown function… |
CVE-2025-8704 | Medium | 6.3 | 2025-08-08 | A vulnerability, which was classified as critical, has been found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. This issue affects some un… |
CVE-2025-8703 | Medium | 6.3 | 2025-08-08 | A vulnerability classified as critical was found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. This vulnerability affects unknown code of… |
CVE-2025-54887 | Critical | 9.1 | 2025-08-08 | jwe is a Ruby implementation of the RFC 7516 JSON Web Encryption (JWE) standard. In versions 1.1.0 and below, authentication tags of encrypted JWEs can be brut… |
CVE-2025-54886 | High | 8.4 | 2025-08-08 | skops is a Python library which helps users share and ship their scikit-learn based models. In versions 0.12.0 and below, the Card.get_model does not contain a… |
CVE-2025-54793 | Medium | 6.1 | 2025-08-08 | Astro is a web framework for content-driven websites. In versions 5.2.0 through 5.12.7, there is an Open Redirect vulnerability in the trailing slash redirecti… |
CVE-2025-8702 | Medium | 6.3 | 2025-08-08 | A vulnerability classified as critical has been found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. This affects an unknown part of the fi… |
CVE-2025-54952 | Critical | 9.8 | 2025-08-08 | An integer overflow vulnerability in the loading of ExecuTorch models can cause smaller-than-expected memory regions to be allocated, potentially resulting in… |
CVE-2025-54368 | | 2025-08-08 | uv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP archives were handled in a streamwise fashion, and file e… | |
CVE-2025-54951 | Critical | 9.8 | 2025-08-07 | A group of related buffer overflow vulnerabilities in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution… |
CVE-2025-54950 | Critical | 9.8 | 2025-08-07 | An out-of-bounds access vulnerability in the loading of ExecuTorch models can cause the runtime to crash and potentially result in code execution or other unde… |
CVE-2025-54949 | Critical | 9.8 | 2025-08-07 | A heap buffer overflow vulnerability in the loading of ExecuTorch models can potentially result in code execution or other undesirable effects. This issue affe… |
CVE-2025-30405 | Critical | 9.8 | 2025-08-07 | An integer overflow vulnerability in the loading of ExecuTorch models can cause objects to be placed outside their allocated memory area, potentially resulting… |
CVE-2025-30404 | Critical | 9.8 | 2025-08-07 | An integer overflow vulnerability in the loading of ExecuTorch models can cause overlapping allocations, potentially resulting in code execution or other undes… |
CVE-2025-54787 | Low | 3.7 | 2025-08-07 | SuiteCRM is an open-source, enterprise-ready Customer Relationship Management (CRM) software application. There is a vulnerability in SuiteCRM version 7.14.6 w… |
CVE-2025-8701 | Medium | 6.3 | 2025-08-07 | A vulnerability was found in Wanzhou WOES Intelligent Optimization Energy Saving System 1.0. It has been rated as critical. Affected by this issue is some unkn… |
CVE-2025-8698 | Low | 3.3 | 2025-08-07 | A vulnerability was found in Open5GS up to 2.7.5. It has been classified as problematic. Affected is the function amf_nsmf_pdusession_handle_release_sm_context… |
CVE-2025-53792 | Critical | 9.1 | 2025-08-07 | Azure Portal Elevation of Privilege Vulnerability |
CVE-2025-53787 | High | 8.2 | 2025-08-07 | Microsoft 365 Copilot BizChat Information Disclosure Vulnerability |
CVE-2025-53774 | Medium | 6.5 | 2025-08-07 | Microsoft 365 Copilot BizChat Information Disclosure Vulnerability |
CVE-2025-53767 | Critical | 10.0 | 2025-08-07 | Azure OpenAI Elevation of Privilege Vulnerability |
CVE-2025-45765 | Critical | 9.1 | 2025-08-07 | ruby-jwt v3.0.0.beta1 was discovered to contain weak encryption. NOTE: the Supplier's perspective is "keysize is not something that is enforced by this library… |
CVE-2025-26513 | High | 7.0 | 2025-08-07 | The installer for SAN Host Utilities for Windows versions prior to 8.0 is susceptible to a vulnerability which when successfully exploited could allow a local… |
CVE-2025-48709 | Low | 3.8 | 2025-08-07 | BMC Control-M/Server 9.0.21.300 displays cleartext database credentials in process lists and logs. An authenticated attacker with shell access could observe th… |
CVE-2025-47808 | Medium | 5.6 | 2025-08-07 | In GStreamer through 1.26.1, the subparse plugin's tmplayer_parse_line function may dereference a NULL pointer while parsing a subtitle file, leading to a cras… |
CVE-2025-47807 | Medium | 5.5 | 2025-08-07 | In GStreamer through 1.26.1, the subparse plugin's subrip_unescape_formatting function may dereference a NULL pointer while parsing a subtitle file, leading to… |
CVE-2025-47806 | Medium | 5.6 | 2025-08-07 | In GStreamer through 1.26.1, the subparse plugin's parse_subrip_time function may write data past the bounds of a stack buffer, leading to a crash. |
CVE-2025-47219 | High | 8.1 | 2025-08-07 | In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_trak function may read past the end of a heap buffer while parsing an MP4 file, possibly leading… |
CVE-2025-47183 | Medium | 6.6 | 2025-08-07 | In GStreamer through 1.26.1, the isomp4 plugin's qtdemux_parse_tree function may read past the end of a heap buffer while parsing an MP4 file, leading to infor… |
CVE-2025-8697 | Medium | 6.3 | 2025-08-07 | A vulnerability was found in agentUniverse up to 0.0.18 and classified as critical. This issue affects the function StdioServerParameters of the component MCPS… |
CVE-2025-7195 | Medium | 6.4 | 2025-08-07 | Early versions of Operator-SDK provided an insecure method to allow operator containers to run in environments that used a random UID. Operator-SDK before 0.15… |
CVE-2025-55077 | High | 7.4 | 2025-08-07 | Tyler Technologies ERP Pro 9 SaaS allows an authenticated user to escape the application and execute limited operating system commands within the remote Micros… |
CVE-2025-51533 | Medium | 5.3 | 2025-08-07 | An Insecure Direct Object Reference (IDOR) in Sage DPW v2024_12_004 and below allows unauthorized attackers to access internal forms via sending a crafted GET… |
CVE-2025-50692 | Critical | 9.8 | 2025-08-07 | FoxCMS <=v1.2.5 is vulnerable to Code Execution in admin/template_file/editFile.html. |
CVE-2025-50675 | High | 7.8 | 2025-08-07 | GPMAW 14, a bioinformatics software, has a critical vulnerability related to insecure file permissions in its installation directory. The directory is accessib… |
CVE-2025-51629 | High | 8.8 | 2025-08-07 | A cross-site scripting (XSS) vulnerability in the PdfViewer component of Agenzia Impresa Eccobook 2.81.1 allows attackers to execute arbitrary web scripts or H… |
CVE-2025-55138 | High | 7.4 | 2025-08-07 | LinkJoin through 882f196 mishandles token ownership in password reset. |
CVE-2025-55137 | High | 7.4 | 2025-08-07 | LinkJoin through 882f196 mishandles lacks type checking in password reset. |
CVE-2025-54397 | Medium | 4.3 | 2025-08-07 | Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 inserts Sensitive Information Into Sent Data to authenticated users. |
CVE-2025-54396 | Medium | 5.4 | 2025-08-07 | Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows SQL Injection. Authenticated users can exploit this. |
CVE-2025-54395 | Medium | 6.1 | 2025-08-07 | Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication configuration data. |
CVE-2025-54394 | Medium | 5.3 | 2025-08-07 | Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 has Insufficiently Protected Credentials for requests to remote Excel resour… |
CVE-2025-54393 | Medium | 5.4 | 2025-08-07 | Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows Static Code Injection. Authenticated users can obtain administrative… |
CVE-2025-54392 | Medium | 6.1 | 2025-08-07 | Netwrix Directory Manager (formerly Imanami GroupID) 11.0.0.0 before 11.1.25162.02 allows XSS for authentication error data, a different vulnerability than CVE… |
CVE-2025-34152 | | 2025-08-07 | An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '… | |
CVE-2025-34151 | | 2025-08-07 | A command injection vulnerability exists in the 'passwd' parameter of the PPPoE setup process on the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02)… | |
CVE-2025-34150 | | 2025-08-07 | The PPPoE configuration interface of the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) is vulnerable to command injection via the 'user' parameter… | |
CVE-2025-34149 | | 2025-08-07 | A command injection vulnerability affects the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) during WPA2 configuration. The 'key' parameter is inter… | |
CVE-2025-34148 | | 2025-08-07 | An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). When configuring the device in W… | |
CVE-2025-24000 | High | 8.8 | 2025-08-07 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Saad Iqbal Post SMTP post-smtp allows Authentication Bypass.This issue affects Post S… |
CVE-2025-7054 | Medium | 6.5 | 2025-08-07 | Cloudflare quiche was discovered to be vulnerable to an infinite loop when sending packets containing RETIRE_CONNECTION_ID frames. QUIC connections possess a… |
CVE-2025-55136 | Medium | 5.7 | 2025-08-07 | ERC (aka Emotion Recognition in Conversation) through 0.3 has insecure deserialization via a serialized object because jsonpickle is used. |
CVE-2025-55135 | Medium | 6.4 | 2025-08-07 | In Agora Foundation Agora fall23-Alpha1 before 690ce56, there is XSS via a profile picture to server/controller/userController.js. Formats other than PNG, JPEG… |
CVE-2025-55134 | Medium | 6.4 | 2025-08-07 | In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via tag in client/agora/public/js/editorManager.js. |
CVE-2025-55133 | Medium | 6.4 | 2025-08-07 | In Agora Foundation Agora fall23-Alpha1 before b087490, there is XSS via topicName in client/agora/public/js/editorManager.js. |
CVE-2025-47907 | High | 7.0 | 2025-08-07 | Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unex… |
CVE-2025-44779 | Medium | 6.6 | 2025-08-07 | An issue in Ollama v0.1.33 allows attackers to delete arbitrary files via sending a crafted packet to the endpoint /api/pull. |
CVE-2025-50952 | Medium | 6.5 | 2025-08-07 | openjpeg v 2.5.0 was discovered to contain a NULL pointer dereference via the component /openjp2/dwt.c. |
CVE-2025-47188 | Medium | 6.5 | 2025-08-07 | A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4… |
CVE-2025-8533 | | 2025-08-07 | A vulnerability was identified in the XPC services of Fantastical. The services failed to implement proper client authorization checks in its listener:shouldAc… | |
CVE-2025-35970 | High | 7.5 | 2025-08-07 | On multiple products of SEIKO EPSON and FUJIFILM Corporation, the initial administrator password is easy to guess from the information available via SNMP. If t… |
CVE-2025-29866 | | 2025-08-07 | : External Control of File Name or Path vulnerability in TAGFREE X-Free Uploader XFU allows : Parameter Injection.This issue affects X-Free Uploader: from 1.0… | |
CVE-2025-32094 | Medium | 4.0 | 2025-08-07 | An issue was discovered in Akamai Ghost, as used for the Akamai CDN platform before 2025-03-26. Under certain circumstances, a client making an HTTP/1.x OPTION… |
CVE-2025-8583 | Medium | 4.3 | 2025-08-07 | Inappropriate implementation in Permissions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-8582 | Medium | 4.3 | 2025-08-07 | Insufficient validation of untrusted input in Core in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to spoof the contents of the Omnibox (URL… |