2025 CVEs (page 229)
Page 229 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-46387 | High | 8.8 | 2025-08-06 | CWE-639 Authorization Bypass Through User-Controlled Key |
CVE-2025-46386 | High | 8.8 | 2025-08-06 | CWE-639 Authorization Bypass Through User-Controlled Key |
CVE-2025-8620 | Medium | 5.3 | 2025-08-06 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.6.0. T… |
CVE-2025-7771 | | 2025-08-06 | ThrottleStop.sys, a legitimate driver, exposes two IOCTL interfaces that allow arbitrary read and write access to physical memory via the MmMapIoSpace function… | |
CVE-2025-6013 | Medium | 6.5 | 2025-08-06 | Vault and Vault Enterprise’s (“Vault”) ldap auth method may not have correctly enforced MFA if username_as_alias was set to true and a user had multiple CNs th… |
CVE-2025-22470 | Critical | 9.8 | 2025-08-06 | CL4/6NX Plus and CL4/6NX-J Plus (Japan model) with the firmware versions prior to 1.15.5-r1 allow crafted dangerous files to be uploaded. An arbitrary Lua scri… |
CVE-2025-22469 | High | 7.3 | 2025-08-06 | OS command injection vulnerability exists in CL4/6NX Plus and CL4/6NX-J Plus (Japan model) with the firmware versions prior to 1.15.5-r1. An arbitrary OS comma… |
CVE-2025-8556 | Low | 3.7 | 2025-08-06 | A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via low-order poin… |
CVE-2025-7202 | | 2025-08-06 | A Cross-Site Request Forgery (CSRF) in Elgato's Key Lights and related light products allows an attacker to host a malicious webpage that remotely controlles t… | |
CVE-2025-7954 | High | 8.1 | 2025-08-06 | A race condition vulnerability has been identified in Shopware's voucher system of Shopware v6.6.10.4 that allows attackers to bypass intended voucher restrict… |
CVE-2025-47324 | High | 7.5 | 2025-08-06 | Information disclosure while accessing and modifying the PIB file of a remote device via powerline. |
CVE-2025-27076 | High | 7.8 | 2025-08-06 | Memory corruption while processing simultaneous requests via escape path. |
CVE-2025-27075 | High | 7.8 | 2025-08-06 | Memory corruption while processing IOCTL command with larger buffer in Bluetooth Host. |
CVE-2025-27073 | High | 7.5 | 2025-08-06 | Transient DOS while creating NDP instance. |
CVE-2025-27072 | Medium | 5.5 | 2025-08-06 | Information disclosure while processing a packet at EAVB BE side with invalid header length. |
CVE-2025-27071 | High | 7.3 | 2025-08-06 | Memory corruption while processing specific files in Powerline Communication Firmware. |
CVE-2025-27069 | High | 7.8 | 2025-08-06 | Memory corruption while processing DDI command calls. |
CVE-2025-27068 | High | 7.8 | 2025-08-06 | Memory corruption while processing an IOCTL command with an arbitrary address. |
CVE-2025-27067 | High | 7.8 | 2025-08-06 | Memory corruption while processing DDI call with invalid buffer. |
CVE-2025-27066 | High | 7.5 | 2025-08-06 | Transient DOS while processing an ANQP message. |
CVE-2025-27065 | High | 7.5 | 2025-08-06 | Transient DOS while processing a frame with malformed shared-key descriptor. |
CVE-2025-27062 | High | 7.8 | 2025-08-06 | Memory corruption while handling client exceptions, allowing unauthorized channel access. |
CVE-2025-21477 | High | 7.5 | 2025-08-06 | Transient DOS while processing CCCH data when NW sends data with invalid length. |
CVE-2025-21474 | High | 7.8 | 2025-08-06 | Memory corruption while processing commands from A2dp sink command queue. |
CVE-2025-21473 | High | 7.8 | 2025-08-06 | Memory corruption when using Virtual cdm (Camera Data Mover) to write registers. |
CVE-2025-21472 | Medium | 5.5 | 2025-08-06 | Information disclosure while capturing logs as eSE debug messages are logged. |
CVE-2025-21465 | Medium | 6.5 | 2025-08-06 | Information disclosure while processing the hash segment in an MBN file. |
CVE-2025-21464 | Medium | 6.5 | 2025-08-06 | Information disclosure while reading data from an image using specified offset and size parameters. |
CVE-2025-21461 | High | 7.8 | 2025-08-06 | Memory corruption when programming registers through virtual CDM. |
CVE-2025-21458 | High | 7.8 | 2025-08-06 | Memory corruption when IOCTL interface is called to map and unmap buffers simultaneously. |
CVE-2025-21457 | Medium | 6.1 | 2025-08-06 | Information disclosure while opening a fastrpc session when domain is not sanitized. |
CVE-2025-21456 | High | 7.8 | 2025-08-06 | Memory corruption while processing IOCTL command when multiple threads are called to map/unmap buffer concurrently. |
CVE-2025-21455 | High | 7.8 | 2025-08-06 | Memory corruption while submitting blob data to kernel space though IOCTL. |
CVE-2025-21452 | High | 7.5 | 2025-08-06 | Transient DOS while processing a random-access response (RAR) with an invalid PDU length on LTE network. |
CVE-2025-7727 | Medium | 6.4 | 2025-08-06 | The Gutenverse plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Animated Text and Fun Fact blocks in all versions up to, and… |
CVE-2025-7376 | Medium | 5.9 | 2025-08-06 | Windows Shortcut Following (.LNK) vulnerability in multiple processes of Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS… |
CVE-2025-21024 | Low | 3.3 | 2025-08-06 | Use of Implicit Intent for Sensitive Communication in Smart View prior to Android 16 allows local attackers to access sensitive information. |
CVE-2025-21023 | Low | 3.3 | 2025-08-06 | Improper access control in WcsExtension for Galaxy Watch prior to Android Watch 16 allows local attackers to access sensitive information. |
CVE-2025-21022 | Low | 3.3 | 2025-08-06 | Improper access control in Galaxy Wearable prior to version 2.2.63.25042861 allows local attackers to access sensitive information. |
CVE-2025-21021 | Medium | 5.7 | 2025-08-06 | Out-of-bounds write in drawing pinpad in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-21020 | Medium | 5.7 | 2025-08-06 | Out-of-bounds write in creating bitmap images in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-21019 | Medium | 5.5 | 2025-08-06 | Improper authorization in Samsung Health prior to version 6.30.1.003 allows local attackers to access data in Samsung Health. User interaction is required for… |
CVE-2025-21018 | Medium | 4.4 | 2025-08-06 | Out-of-bounds read in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to read out-of-bounds memory. |
CVE-2025-21017 | Medium | 6.3 | 2025-08-06 | Out-of-bounds write in detaching crypto box in Blockchain Keystore prior to version 1.3.17.2 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-21016 | Medium | 4.3 | 2025-08-06 | Improper access control in PkgPredictorService prior to SMR Aug-2025 Release 1 in Chinese Android 13, 14, 15 and 16 allows local attackers to use the privilege… |
CVE-2025-21015 | Medium | 4.0 | 2025-08-06 | Path Traversal in Document scanner prior to SMR Aug-2025 Release 1 allows local attackers to delete file with Document scanner's privilege. |
CVE-2025-21014 | Medium | 4.3 | 2025-08-06 | Improper export of android application component in Emergency SoS prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information. |
CVE-2025-21013 | Medium | 6.2 | 2025-08-06 | Improper access control in SemSensorManager for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information related to… |
CVE-2025-21012 | Medium | 5.5 | 2025-08-06 | Improper access control in fall detection for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to modify fall detection configuration. |
CVE-2025-21011 | Medium | 5.5 | 2025-08-06 | Improper access control in SemSensorService for Galaxy Watch prior to SMR Aug-2025 Release 1 allows local attackers to access sensitive information related to… |
CVE-2025-21010 | Medium | 6.0 | 2025-08-06 | Improper privilege management in SamsungAccount prior to SMR Aug-2025 Release 1 allows local privileged attackers to deactivate Samsung account. |
CVE-2025-20990 | Medium | 4.0 | 2025-08-06 | Improper access control in accessing system device node prior to SMR Aug-2025 Release 1 allows local attackers to access device identifier. |
CVE-2025-8100 | Medium | 5.4 | 2025-08-06 | The Element Pack Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'marker_content' parameter in version… |
CVE-2025-7498 | Medium | 6.4 | 2025-08-06 | The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown Widget in all versions up to, and includ… |
CVE-2025-7399 | Medium | 6.4 | 2025-08-06 | The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via an Elementor display setting in all versions up to, and including, 28.1.3 due… |
CVE-2025-6994 | Critical | 9.8 | 2025-08-06 | The Reveal Listing plugin by smartdatasoft for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.3. This is due to the plugin… |
CVE-2025-54651 | Medium | 4.8 | 2025-08-06 | Race condition vulnerability in the kernel hufs module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-54650 | Medium | 4.2 | 2025-08-06 | Improper array index verification vulnerability in the audio codec module. Impact: Successful exploitation of this vulnerability may affect the audio decoding… |
CVE-2025-54649 | Medium | 4.5 | 2025-08-06 | Vulnerability of using incompatible types to access resources in the location service. Impact: Successful exploitation of this vulnerability may cause some loc… |
CVE-2025-54648 | Medium | 5.4 | 2025-08-06 | Out-of-bounds read vulnerability in the SSAP module of the NearLink protocol stack. Impact: Successful exploitation of this vulnerability may affect availabili… |
CVE-2025-54647 | Medium | 5.4 | 2025-08-06 | Out-of-bounds read vulnerability in the SSAP module of the NearLink protocol stack. Impact: Successful exploitation of this vulnerability may affect availabili… |
CVE-2025-54646 | Medium | 5.1 | 2025-08-06 | Vulnerability of inadequate packet length check in the BLE module. Impact: Successful exploitation of this vulnerability may affect performance. |
CVE-2025-54645 | Medium | 5.0 | 2025-08-06 | Out-of-bounds array access issue due to insufficient data verification in the location service module. Impact: Successful exploitation of this vulnerability ma… |
CVE-2025-54644 | Medium | 6.6 | 2025-08-06 | Out-of-bounds array access issue due to insufficient data verification in the kernel ambient light module. Impact: Successful exploitation of this vulnerabilit… |
CVE-2025-54643 | Medium | 6.6 | 2025-08-06 | Out-of-bounds array access issue due to insufficient data verification in the kernel ambient light module. Impact: Successful exploitation of this vulnerabilit… |
CVE-2025-54642 | Medium | 6.7 | 2025-08-06 | Issue of buffer overflow caused by insufficient data verification in the kernel gyroscope module. Impact: Successful exploitation of this vulnerability may aff… |
CVE-2025-54641 | Medium | 6.7 | 2025-08-06 | Issue of buffer overflow caused by insufficient data verification in the kernel acceleration module. Impact: Successful exploitation of this vulnerability may… |
CVE-2025-54640 | Medium | 5.5 | 2025-08-06 | ParcelMismatch vulnerability in attribute deserialization. Impact: Successful exploitation of this vulnerability may cause playback control screen display exce… |
CVE-2025-54639 | Medium | 5.5 | 2025-08-06 | ParcelMismatch vulnerability in attribute deserialization. Impact: Successful exploitation of this vulnerability may cause playback control screen display exce… |
CVE-2025-8595 | Medium | 4.3 | 2025-08-06 | The Zakra theme for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the welcome_notice_import_handler() function… |
CVE-2025-8420 | High | 8.1 | 2025-08-06 | Multiple plugins for WordPress by emarket-design with the 'emd-form-builder-lite' package are vulnerable to Remote Code Execution in various versions via the e… |
CVE-2025-54638 | Medium | 5.5 | 2025-08-06 | Issue of inconsistent read/write serialization in the ad module. Impact: Successful exploitation of this vulnerability may affect the availability of the ad se… |
CVE-2025-54637 | Medium | 4.4 | 2025-08-06 | Out-of-bounds array access issue due to insufficient data verification in the kernel ambient light module. Impact: Successful exploitation of this vulnerabilit… |
CVE-2025-54636 | Medium | 4.4 | 2025-08-06 | Issue of buffer overflow caused by insufficient data verification in the kernel drop detection module. Impact: Successful exploitation of this vulnerability ma… |
CVE-2025-54635 | Medium | 5.9 | 2025-08-06 | Vulnerability of returning released pointers in the distributed notification service. Impact: Successful exploitation of this vulnerability may affect availabi… |
CVE-2025-54634 | High | 8.0 | 2025-08-06 | Vulnerability of improper processing of abnormal conditions in huge page separation. Impact: Successful exploitation of this vulnerability may affect availabil… |
CVE-2025-54633 | Medium | 6.7 | 2025-08-06 | Out-of-bounds read vulnerability in the register configuration of the DMA module. Impact: Successful exploitation of this vulnerability may affect service conf… |
CVE-2025-54632 | Medium | 6.8 | 2025-08-06 | Vulnerability of insufficient data length verification in the HVB module. Impact: Successful exploitation of this vulnerability may affect service integrity. |
CVE-2025-54631 | Medium | 6.7 | 2025-08-06 | Vulnerability of insufficient data length verification in the partition module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-54630 | Medium | 6.8 | 2025-08-06 | :Vulnerability of insufficient data length verification in the DFA module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-54629 | Medium | 6.7 | 2025-08-06 | Race condition issue occurring in the physical page import process of the memory management module. Impact: Successful exploitation of this vulnerability may a… |
CVE-2025-54628 | Medium | 5.3 | 2025-08-06 | Vulnerability of incomplete verification information in the communication module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-54627 | High | 8.8 | 2025-08-06 | Out-of-bounds write vulnerability in the skia module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-54626 | Medium | 4.4 | 2025-08-06 | Pointer dangling vulnerability in the cjwindow module. Impact: Successful exploitation of this vulnerability may affect function stability. |
CVE-2025-54625 | Medium | 6.7 | 2025-08-06 | Race condition vulnerability in the kernel file system module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-54624 | Medium | 5.7 | 2025-08-06 | Unexpected injection event vulnerability in the multimodalinput module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-8656 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Protection Mechanism Failure Software Downgrade Vulnerability. This vulnerability allows physically present attackers to downgrade software on… |
CVE-2025-8655 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR libSystemLib Command injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrar… |
CVE-2025-8654 | High | 8.8 | 2025-08-06 | Kenwood DMX958XR ReadMVGImage Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary… |
CVE-2025-8653 | High | 8.8 | 2025-08-06 | Kenwood DMX958XR JKRadioService Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execut… |
CVE-2025-8652 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR JKWifiService Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitra… |
CVE-2025-8651 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR JKWifiService Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitra… |
CVE-2025-8650 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR libSystemLib Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrar… |
CVE-2025-8649 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR JKWifiService Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitra… |
CVE-2025-8648 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8647 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8646 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8645 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8644 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |
CVE-2025-8643 | Medium | 6.8 | 2025-08-06 | Kenwood DMX958XR Firmware Update Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected… |