2025 CVEs (page 227)
Page 227 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48394 | Medium | 4.7 | 2025-08-06 | An attacker with authenticated and privileged access could modify the contents of a non-sensitive file by traversing the path in the limited shell of the CLI… |
CVE-2025-48393 | Medium | 5.7 | 2025-08-06 | The server identity check mechanism for firmware upgrade performed via command shell is insecurely implemented potentially allowing an attacker to perform a Ma… |
CVE-2025-51308 | Medium | 5.3 | 2025-08-06 | In Gatling Enterprise versions below 1.25.0, a low-privileged user that does not hold the role "admin" could perform a REST API call on read-only endpoints, al… |
CVE-2025-51306 | Medium | 6.5 | 2025-08-06 | In Gatling Enterprise versions below 1.25.0, a user logging-out can still use his session token to continue using the application without expiration, due to in… |
CVE-2025-51040 | High | 7.5 | 2025-08-06 | Electrolink FM/DAB/TV Transmitter Web Management System Unauthorized access vulnerability via the /FrameSetCore.html endpoint in Electrolink 500W, 1kW, 2kW Med… |
CVE-2025-50286 | High | 8.1 | 2025-08-06 | A Remote Code Execution (RCE) vulnerability in Grav CMS v1.7.48 allows an authenticated admin to upload a malicious plugin via the /admin/tools/direct-install… |
CVE-2025-50234 | Medium | 6.5 | 2025-08-06 | MCCMS v2.7.0 has an SSRF vulnerability located in the index() method of the sys\apps\controllers\api\Gf.php file, where the pic parameter is processed. The pic… |
CVE-2025-50233 | Medium | 6.5 | 2025-08-06 | A vulnerability in QCMS version 6.0.5 allows authenticated users to read arbitrary files from the server due to insufficient validation of the "Name" parameter… |
CVE-2025-36020 | Medium | 5.9 | 2025-08-06 | IBM Guardium Data Protection could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive credential information. |
CVE-2025-2028 | Medium | 6.5 | 2025-08-06 | Lack of TLS validation when downloading a CSV file including mapping from IPs to countries used ONLY for displaying country flags in logs |
CVE-2025-8616 | | 2025-08-06 | A weakness identified in OpenText Advanced Authentication where a Malicious browser plugin can record and replay the user authentication process to bypass Auth… | |
CVE-2025-3354 | High | 8.1 | 2025-08-06 | IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 20 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attac… |
CVE-2025-3320 | High | 8.1 | 2025-08-06 | IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 20 is vulnerable to a heap-based buffer overflow, caused by improper bounds checking. A remote attac… |
CVE-2025-23335 | Medium | 4.4 | 2025-08-06 | NVIDIA Triton Inference Server for Windows and Linux and the Tensor RT backend contain a vulnerability where an attacker could cause an underflow by a specific… |
CVE-2025-23334 | Medium | 5.9 | 2025-08-06 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause an out-of-bounds read by sen… |
CVE-2025-23333 | Medium | 5.9 | 2025-08-06 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause an out-of-bounds read by man… |
CVE-2025-23331 | High | 7.5 | 2025-08-06 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where a user could cause a memory allocation with excessive size value, leading t… |
CVE-2025-23327 | High | 7.5 | 2025-08-06 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause an integer overflow through specially crafted input… |
CVE-2025-23326 | High | 7.5 | 2025-08-06 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause an integer overflow through a specially crafted inp… |
CVE-2025-23325 | High | 7.5 | 2025-08-06 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause uncontrolled recursion through a specially crafted… |
CVE-2025-23324 | High | 7.5 | 2025-08-06 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where a user could cause an integer overflow or wraparound, leading to a segmenta… |
CVE-2025-23323 | High | 7.5 | 2025-08-06 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where a user could cause an integer overflow or wraparound, leading to a segmenta… |
CVE-2025-23322 | High | 7.5 | 2025-08-06 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where multiple requests could cause a double free when a stream is cancelled befo… |
CVE-2025-23321 | High | 7.5 | 2025-08-06 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where a user could cause a divide by zero issue by issuing an invalid request. A… |
CVE-2025-23320 | High | 7.5 | 2025-08-06 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause the shared memory limit to b… |
CVE-2025-23319 | High | 8.1 | 2025-08-06 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause an out-of-bounds write by se… |
CVE-2025-23318 | High | 8.1 | 2025-08-06 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability in the Python backend, where an attacker could cause an out-of-bounds write. A su… |
CVE-2025-23317 | Critical | 9.1 | 2025-08-06 | NVIDIA Triton Inference Server contains a vulnerability in the HTTP server, where an attacker could start a reverse shell by sending a specially crafted HTTP r… |
CVE-2025-23311 | Critical | 9.8 | 2025-08-06 | NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a stack overflow through specially crafted HTTP requests. A successful ex… |
CVE-2025-23310 | Critical | 9.8 | 2025-08-06 | NVIDIA Triton Inference Server for Windows and Linux contains a vulnerability where an attacker could cause stack buffer overflow by specially crafted inputs… |
CVE-2025-5197 | Medium | 5.3 | 2025-08-06 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in the Hugging Face Transformers library, specifically in the `convert_tf_weight_name_to_pt… |
CVE-2025-46391 | Medium | 6.5 | 2025-08-06 | CWE-284: Improper Access Control |
CVE-2025-46390 | High | 7.5 | 2025-08-06 | CWE-204: Observable Response Discrepancy |
CVE-2025-46389 | Medium | 6.5 | 2025-08-06 | CWE-620: Unverified Password Change |
CVE-2025-46388 | Medium | 4.3 | 2025-08-06 | CWE-200 Exposure of Sensitive Information to an Unauthorized Actor |
CVE-2025-46387 | High | 8.8 | 2025-08-06 | CWE-639 Authorization Bypass Through User-Controlled Key |
CVE-2025-46386 | High | 8.8 | 2025-08-06 | CWE-639 Authorization Bypass Through User-Controlled Key |
CVE-2025-8620 | Medium | 5.3 | 2025-08-06 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. T… |
CVE-2025-7771 | | 2025-08-06 | ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function… | |
CVE-2025-6013 | Medium | 6.5 | 2025-08-06 | Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs th… |
CVE-2025-22470 | Critical | 9.8 | 2025-08-06 | CL4/6NX Plus and CL4/6NX-J Plus (Japan model) with the firmware versions prior to 1.15.5-r1 allow crafted dangerous files to be uploaded. An arbitrary Lua scri… |
CVE-2025-22469 | High | 7.3 | 2025-08-06 | OS command injection vulnerability exists in CL4/6NX Plus and CL4/6NX-J Plus (Japan model) with the firmware versions prior to 1.15.5-r1. An arbitrary OS comma… |
CVE-2025-8556 | Low | 3.7 | 2025-08-06 | A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order poin… |
CVE-2025-7202 | | 2025-08-06 | A Cross-Site Request Forgery (CSRF) in Elgato's Key Lights and related light products allows an attacker to host a malicious webpage that remotely controlles t… | |
CVE-2025-7954 | High | 8.1 | 2025-08-06 | A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrict… |
CVE-2025-47324 | High | 7.5 | 2025-08-06 | Information disclosure while accessing and modifying the PIB file of a remote device via powerline. |
CVE-2025-27076 | High | 7.8 | 2025-08-06 | Memory corruption while processing simultaneous requests via escape path. |
CVE-2025-27075 | High | 7.8 | 2025-08-06 | Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host. |
CVE-2025-27073 | High | 7.5 | 2025-08-06 | Transient DOS while creating NDP instance. |
CVE-2025-27072 | Medium | 5.5 | 2025-08-06 | Information disclosure while processing a packet at EAVB BE side with invalid header length. |
CVE-2025-27071 | High | 7.3 | 2025-08-06 | Memory corruption while processing specific files in Powerline Communication Firmware. |
CVE-2025-27069 | High | 7.8 | 2025-08-06 | Memory corruption while processing DDI command calls. |
CVE-2025-27068 | High | 7.8 | 2025-08-06 | Memory corruption while processing an IOCTL command with an arbitrary address. |
CVE-2025-27067 | High | 7.8 | 2025-08-06 | Memory corruption while processing DDI call with invalid buffer. |
CVE-2025-27066 | High | 7.5 | 2025-08-06 | Transient DOS while processing an ANQP message. |
CVE-2025-27065 | High | 7.5 | 2025-08-06 | Transient DOS while processing a frame with malformed shared-key descriptor. |
CVE-2025-27062 | High | 7.8 | 2025-08-06 | Memory corruption while handling client exceptions, allowing unauthorized channel access. |
CVE-2025-21477 | High | 7.5 | 2025-08-06 | Transient DOS while processing CCCH data when NW sends data with invalid length. |
CVE-2025-21474 | High | 7.8 | 2025-08-06 | Memory corruption while processing commands from A2dp sink command queue. |
CVE-2025-21473 | High | 7.8 | 2025-08-06 | Memory corruption when using Virtual cdm (Camera Data Mover) to write registers. |
CVE-2025-21472 | Medium | 5.5 | 2025-08-06 | Information disclosure while capturing logs as eSE debug messages are logged. |
CVE-2025-21465 | Medium | 6.5 | 2025-08-06 | Information disclosure while processing the hash segment in an MBN file. |
CVE-2025-21464 | Medium | 6.5 | 2025-08-06 | Information disclosure while reading data from an image using specified offset and size parameters. |
CVE-2025-21461 | High | 7.8 | 2025-08-06 | Memory corruption when programming registers through virtual CDM. |
CVE-2025-21458 | High | 7.8 | 2025-08-06 | Memory corruption when IOCTL interface is called to map and unmap buffers simultaneously. |
CVE-2025-21457 | Medium | 6.1 | 2025-08-06 | Information disclosure while opening a fastrpc session when domain is not sanitized. |
CVE-2025-21456 | High | 7.8 | 2025-08-06 | Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently. |
CVE-2025-21455 | High | 7.8 | 2025-08-06 | Memory corruption while submitting blob data to kernel space though IOCTL. |
CVE-2025-21452 | High | 7.5 | 2025-08-06 | Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network. |
CVE-2025-7727 | Medium | 6.4 | 2025-08-06 | The Gutenverse plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Fun Fact blocks in all versions up to, and… |
CVE-2025-7376 | Medium | 5.9 | 2025-08-06 | Windows Shortcut Following (.LNK) vulnerability in multiple processes of Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS… |
CVE-2025-21024 | Low | 3.3 | 2025-08-06 | Use of Implicit Intent for Sensitive Communication in Smart View prior to Android 16 allows local attackers to access sensitive information. |
CVE-2025-21023 | Low | 3.3 | 2025-08-06 | Improper access control in WcsExtension for Galaxy Watch prior to Android Watch 16 allows local attackers to access sensitive information. |
CVE-2025-21022 | Low | 3.3 | 2025-08-06 | Improper access control in Galaxy Wearable prior to version 2.2.63.25042861 allows local attackers to access sensitive information. |
CVE-2025-21021 | Medium | 5.7 | 2025-08-06 | Out-of-bounds write in drawing pinpad in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-21020 | Medium | 5.7 | 2025-08-06 | Out-of-bounds write in creating bitmap images in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-21019 | Medium | 5.5 | 2025-08-06 | Improper authorization in Samsung Health prior to version 6.30.1.003 allows local attackers to access data in Samsung Health. User interaction is required for… |
CVE-2025-21018 | Medium | 4.4 | 2025-08-06 | Out-of-bounds read in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to read out-of-bounds memory. |
CVE-2025-21017 | Medium | 6.3 | 2025-08-06 | Out-of-bounds write in detaching crypto box in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-21016 | Medium | 4.3 | 2025-08-06 | Improper access control in PkgPredictorService prior to SMR Aug-2025 Release 1 in Chinese Android 13, 14, 15 and 16 allows local attackers to use the privilege… |
CVE-2025-21015 | Medium | 4.0 | 2025-08-06 | Path Traversal in Document scanner prior to SMR Aug-2025 Release 1 allows local attackers to delete file with Document scanner's privilege. |
CVE-2025-21014 | Medium | 4.3 | 2025-08-06 | Improper export of android application component in Emergency SoS prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information. |
CVE-2025-21013 | Medium | 6.2 | 2025-08-06 | Improper access control in SemSensorManager for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information related to… |
CVE-2025-21012 | Medium | 5.5 | 2025-08-06 | Improper access control in fall detection for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to modify fall detection configuration. |
CVE-2025-21011 | Medium | 5.5 | 2025-08-06 | Improper access control in SemSensorService for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information related to… |
CVE-2025-21010 | Medium | 6.0 | 2025-08-06 | Improper privilege management in SamsungAccount prior to SMR Aug-2025 Release 1 allows local privileged attackers to deactivate Samsung account. |
CVE-2025-20990 | Medium | 4.0 | 2025-08-06 | Improper access control in accessing system device node prior to SMR Aug-2025 Release 1 allows local attackers to access device identifier. |
CVE-2025-8100 | Medium | 5.4 | 2025-08-06 | The Element Pack Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_content' parameter in version… |
CVE-2025-7498 | Medium | 6.4 | 2025-08-06 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Widget in all versions up to, and includ… |
CVE-2025-7399 | Medium | 6.4 | 2025-08-06 | The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via an Elementor display setting in all versions up to, and including, 28.1.3 due… |
CVE-2025-6994 | Critical | 9.8 | 2025-08-06 | The Reveal Listing plugin by smartdatasoft for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.3. This is due to the plugin… |
CVE-2025-54651 | Medium | 4.8 | 2025-08-06 | Race condition vulnerability in the kernel hufs module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-54650 | Medium | 4.2 | 2025-08-06 | Improper array index verification vulnerability in the audio codec module. Impact: Successful exploitation of this vulnerability may affect the audio decoding… |
CVE-2025-54649 | Medium | 4.5 | 2025-08-06 | Vulnerability of using incompatible types to access resources in the location service. Impact: Successful exploitation of this vulnerability may cause some loc… |
CVE-2025-54648 | Medium | 5.4 | 2025-08-06 | Out-of-bounds read vulnerability in the SSAP module of the NearLink protocol stack. Impact: Successful exploitation of this vulnerability may affect availabili… |
CVE-2025-54647 | Medium | 5.4 | 2025-08-06 | Out-of-bounds read vulnerability in the SSAP module of the NearLink protocol stack. Impact: Successful exploitation of this vulnerability may affect availabili… |
CVE-2025-54646 | Medium | 5.1 | 2025-08-06 | Vulnerability of inadequate packet length check in the BLE module. Impact: Successful exploitation of this vulnerability may affect performance. |
CVE-2025-54645 | Medium | 5.0 | 2025-08-06 | Out-of-bounds array access issue due to insufficient data verification in the location service module. Impact: Successful exploitation of this vulnerability ma… |
CVE-2025-54644 | Medium | 6.6 | 2025-08-06 | Out-of-bounds array access issue due to insufficient data verification in the kernel ambient light module. Impact: Successful exploitation of this vulnerabilit… |
CVE-2025-54643 | Medium | 6.6 | 2025-08-06 | Out-of-bounds array access issue due to insufficient data verification in the kernel ambient light module. Impact: Successful exploitation of this vulnerabilit… |