2025 CVEs (page 231)
Page 231 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-54982 | Critical | 9.6 | 2025-08-05 | An improper verification of cryptographic signature in Zscaler's SAML authentication mechanism on the server-side allowed an authentication abuse. |
CVE-2025-8546 | Medium | 5.3 | 2025-08-05 | A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects the function adminlogin/login of the component Verific… |
CVE-2025-8545 | Low | 2.4 | 2025-08-05 | A vulnerability, which was classified as problematic, has been found in Portabilis i-Educar 2.10. Affected by this issue is some unknown functionality of the f… |
CVE-2025-8544 | Low | 2.4 | 2025-08-05 | A vulnerability classified as problematic was found in Portabilis i-Educar 2.10. Affected by this vulnerability is an unknown functionality of the file /module… |
CVE-2025-54868 | High | 7.5 | 2025-08-05 | LibreChat is a ChatGPT clone with additional features. In versions 0.0.6 through 0.7.7-rc1, an exposed testing endpoint allows reading arbitrary chats directly… |
CVE-2025-8543 | Low | 2.4 | 2025-08-05 | A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. Affected is an unknown function of the file /intranet/educar_raca_cad.php… |
CVE-2025-8542 | Low | 2.4 | 2025-08-05 | A vulnerability was found in Portabilis i-Educar 2.10. It has been rated as problematic. This issue affects some unknown processing of the file /intranet/empre… |
CVE-2025-8541 | Low | 2.4 | 2025-08-05 | A vulnerability was found in Portabilis i-Educar 2.10. It has been declared as problematic. This vulnerability affects unknown code of the file /intranet/publi… |
CVE-2025-8540 | Low | 2.4 | 2025-08-05 | A vulnerability was found in Portabilis i-Educar 2.10. It has been classified as problematic. This affects an unknown part of the file /intranet/public_municip… |
CVE-2025-53417 | | 2025-08-05 | DIAView (v4.2.0 and prior) - Directory Traversal Information Disclosure Vulnerability | |
CVE-2025-8539 | Low | 2.4 | 2025-08-05 | A weakness has been identified in Portabilis i-Educar 2.10. This affects an unknown function of the file /intranet/public_distrito_cad.php. This manipulation o… |
CVE-2025-8538 | Low | 2.4 | 2025-08-05 | A security flaw has been discovered in Portabilis i-Educar 2.10. The impacted element is an unknown function of the file /usuarios/tipos/novo. The manipulation… |
CVE-2025-8537 | Low | 3.7 | 2025-08-05 | A vulnerability, which was classified as problematic, was found in Axiomatic Bento4 up to 1.6.0-641. Affected is the function AP4_DataBuffer::SetDataSize of th… |
CVE-2025-8535 | Low | 3.5 | 2025-08-05 | A vulnerability, which was classified as problematic, has been found in cronoh NanoVault up to 1.2.1. This issue affects the function executeJavaScript of the… |
CVE-2025-54871 | Medium | 5.5 | 2025-08-05 | Electron Capture facilitates video playback for screen-sharing and capture. In versions 2.19.1 and below, the elecap app on macOS allows local unprivileged use… |
CVE-2025-54870 | | 2025-08-05 | VTun-ng is a Virtual Tunnel over TCP/IP network. In versions 3.0.17 and below, failure to initialize encryption modules might cause reversion to plaintext due… | |
CVE-2025-54865 | High | 7.3 | 2025-08-05 | Tilesheets MediaWiki Extension adds a table lookup parser function for an item and returns the requested image. A missing backtick in a query executed by the T… |
CVE-2025-54804 | Medium | 6.5 | 2025-08-05 | Russh is a Rust SSH client & server library. In versions 0.54.0 and below, the channel window adjust message of the SSH protocol is used to track the free spac… |
CVE-2025-54803 | High | 7.5 | 2025-08-05 | js-toml is a TOML parser for JavaScript, fully compliant with the TOML 1.0.0 Spec. In versions below 1.0.2, a prototype pollution vulnerability in js-toml allo… |
CVE-2025-54802 | Critical | 9.8 | 2025-08-05 | pyLoad is the free and open-source Download Manager written in pure Python. In versions 0.5.0b3.dev89 and below, there is an opportunity for path traversal in… |
CVE-2025-54795 | Critical | 9.8 | 2025-08-05 | Claude Code is an agentic coding tool. In versions below 1.0.20, an error in command parsing makes it possible to bypass the Claude Code confirmation prompt to… |
CVE-2025-54794 | Critical | 9.1 | 2025-08-05 | Claude Code is an agentic coding tool. In versions below 0.2.111, a path validation flaw using prefix matching instead of canonical path comparison, makes it p… |
CVE-2025-54780 | High | 7.7 | 2025-08-05 | The glpi-screenshot-plugin allows users to take screenshots or screens recording directly from GLPI. In versions below 2.0.2, authenticated user can use the /a… |
CVE-2025-54387 | Critical | 9.8 | 2025-08-05 | IPX is an image optimizer powered by sharp and svgo. In versions 1.3.1 and below, 2.0.0-0 through 2.1.0, and 3.0.0 through 3.1.0, the approach used to check wh… |
CVE-2025-54135 | High | 8.5 | 2025-08-05 | Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions below 1.3.9, If the file is a… |
CVE-2025-54130 | High | 7.5 | 2025-08-05 | Cursor is a code editor built for programming with AI. Cursor allows writing in-workspace files with no user approval in versions less than 1.3.9. If the file… |
CVE-2025-54119 | Critical | 10.0 | 2025-08-05 | ADOdb is a PHP database class library that provides abstractions for performing queries and managing databases. In versions 5.22.9 and below, improper escaping… |
CVE-2025-53544 | High | 7.5 | 2025-08-05 | Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. In versions below 0… |
CVE-2025-52892 | Medium | 4.5 | 2025-08-05 | EspoCRM is a web application with a frontend designed as a single-page application and a REST API backend written in PHP. In versions 9.1.6 and below, if a use… |
CVE-2025-8534 | Low | 2.5 | 2025-08-05 | A vulnerability classified as problematic was found in libtiff 4.6.0. This vulnerability affects the function PS_Lvl2page of the file tools/tiff2ps.c of the co… |
CVE-2025-8530 | Medium | 5.3 | 2025-08-04 | A vulnerability, which was classified as problematic, has been found in elunez eladmin up to 2.7. Affected by this issue is some unknown functionality of the f… |
CVE-2025-8529 | Medium | 6.3 | 2025-08-04 | A vulnerability classified as critical was found in cloudfavorites favorites-web up to 1.3.0. Affected by this vulnerability is the function getCollectLogoUrl… |
CVE-2025-46094 | Low | 3.8 | 2025-08-04 | LiquidFiles before 4.1.2 allows directory traversal by configuring the pathname of a local executable file as an Actionscript. |
CVE-2025-46093 | Critical | 9.9 | 2025-08-04 | LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to execute arbitrary code as root by leveraging… |
CVE-2025-27212 | Critical | 9.8 | 2025-08-04 | An Improper Input Validation in certain UniFi Access devices could allow a Command Injection by a malicious actor with access to UniFi Access management networ… |
CVE-2025-27211 | High | 7.5 | 2025-08-04 | An Improper Input Validation in EdgeMAX EdgeSwitch (Version 1.10.4 and earlier) could allow a Command Injection by a malicious actor with access to EdgeSwitch… |
CVE-2025-8528 | Low | 3.7 | 2025-08-04 | A vulnerability classified as problematic has been found in Exrick xboot up to 3.3.4. Affected is an unknown function of the file /xboot/permission/getMenuList… |
CVE-2025-8527 | Medium | 6.3 | 2025-08-04 | A vulnerability was found in Exrick xboot up to 3.3.4. It has been rated as critical. This issue affects some unknown processing of the file xboot-fast/src/mai… |
CVE-2025-7844 | | 2025-08-04 | Exporting a TPM based RSA key larger than 2048 bits from the TPM could overrun a stack buffer if the default `MAX_RSA_KEY_BITS=2048` is used. If your TPM 2.0 m… | |
CVE-2025-54554 | Medium | 5.3 | 2025-08-04 | tiaudit in Tera Insights tiCrypt before 2025-07-17 allows unauthenticated REST API requests that reveal sensitive information about the underlying SQL queries… |
CVE-2025-4604 | Medium | 6.1 | 2025-08-04 | The vulnerable code can bypass the Captcha check in Liferay Portal 7.4.3.80 through 7.4.3.132, and Liferay DXP 2024.Q1.1 through 2024.Q1.19, 2024.Q2.0 through… |
CVE-2025-4599 | Medium | 6.1 | 2025-08-04 | The fragment preview functionality in Liferay Portal 7.4.3.61 through 7.4.3.132, and Liferay DXP 2024.Q4.1 through 2024.Q4.5, 2024.Q3.1 through 2024.Q3.13, 202… |
CVE-2025-8526 | Medium | 6.3 | 2025-08-04 | A vulnerability was found in Exrick xboot up to 3.3.4. It has been declared as critical. This vulnerability affects the function Upload of the file xboot-fast/… |
CVE-2025-8525 | Medium | 5.3 | 2025-08-04 | A vulnerability was found in Exrick xboot up to 3.3.4. It has been classified as problematic. This affects an unknown part of the component Spring Boot Admin/S… |
CVE-2025-51726 | High | 8.4 | 2025-08-04 | CyberGhostVPNSetup.exe (Windows installer) is signed using the weak cryptographic hash algorithm SHA-1, which is vulnerable to collision attacks. This allows a… |
CVE-2025-51387 | Critical | 9.8 | 2025-08-04 | The GitKraken Desktop 10.8.0 and 11.1.0 is susceptible to code injection due to misconfigured Electron Fuses. Specifically, the following insecure settings wer… |
CVE-2025-50754 | Critical | 9.6 | 2025-08-04 | Unisite CMS version 5.0 contains a stored Cross-Site Scripting (XSS) vulnerability in the "Report" functionality. A malicious script submitted by an attacker i… |
CVE-2025-50341 | Critical | 9.8 | 2025-08-04 | A Boolean-based SQL injection vulnerability was discovered in Axelor 5.2.4 via the _domain parameter. An attacker can manipulate the SQL query logic and determ… |
CVE-2025-8524 | Medium | 5.3 | 2025-08-04 | A vulnerability was found in Boquan DotWallet App 2.15.2 on Android and classified as problematic. Affected by this issue is some unknown functionality of the… |
CVE-2025-8523 | Medium | 5.3 | 2025-08-04 | A vulnerability has been found in RiderLike Fruit Crush-Brain App 1.0 on Android and classified as problematic. Affected by this vulnerability is an unknown fu… |
CVE-2025-55014 | Medium | 4.7 | 2025-08-04 | The YouDao plugin for StarDict, as used in stardict 3.0.7+git20220909+dfsg-6 in Debian trixie and elsewhere, sends an X11 selection to the dict.youdao.com and… |
CVE-2025-50340 | Medium | 4.3 | 2025-08-04 | An Insecure Direct Object Reference (IDOR) vulnerability was discovered in SOGo Webmail thru 5.6.0, allowing an authenticated user to send emails on behalf of… |
CVE-2025-8522 | Medium | 5.0 | 2025-08-04 | A vulnerability, which was classified as critical, was found in givanz Vvvebjs up to 2.0.4. Affected is an unknown function of the file /save.php of the compon… |
CVE-2025-8521 | Low | 2.4 | 2025-08-04 | A vulnerability, which was classified as problematic, has been found in givanz Vvveb up to 1.0.5. This issue affects some unknown processing of the file /vadmi… |
CVE-2025-53395 | High | 7.7 | 2025-08-04 | Paramount Macrium Reflect through 2025-06-26 allows local attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx backup file a… |
CVE-2025-53394 | High | 7.7 | 2025-08-04 | Paramount Macrium Reflect through 2025-06-26 allows attackers to execute arbitrary code with administrator privileges via a crafted .mrimgx or .mrbax backup fi… |
CVE-2025-52239 | Critical | 9.8 | 2025-08-04 | An arbitrary file upload vulnerability in ZKEACMS v4.1 allows attackers to execute arbitrary code via a crafted file. |
CVE-2025-38741 | High | 7.5 | 2025-08-04 | Dell Enterprise SONiC OS, version 4.5.0, contains a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentially exploit this v… |
CVE-2025-26476 | High | 8.4 | 2025-08-04 | Dell ECS versions prior to 3.8.1.5/ ObjectScale version 4.0.0.0, contain a Use of Hard-coded Cryptographic Key vulnerability. An unauthenticated attacker with… |
CVE-2025-21120 | High | 8.3 | 2025-08-04 | Dell Avamar, versions prior to 19.10 SP1 with patch 338904, contains a Trusting HTTP Permission Methods on the Server-Side vulnerability in Security. A low pri… |
CVE-2025-8520 | Medium | 4.7 | 2025-08-04 | A vulnerability classified as critical was found in givanz Vvveb up to 1.0.5. This vulnerability affects unknown code of the file /vadmin123/?module=editor/edi… |
CVE-2025-8519 | Low | 2.7 | 2025-08-04 | A vulnerability classified as problematic has been found in givanz Vvveb up to 1.0.5. This affects an unknown part of the file /vadmin123/index.php?module=edit… |
CVE-2025-51390 | Critical | 9.8 | 2025-08-04 | TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a command injection vulnerability via the pin parameter in the setWiFiWpsConfig function. |
CVE-2025-46206 | Medium | 6.5 | 2025-08-04 | An issue in Artifex mupdf 1.25.6, 1.25.5 allows a remote attacker to cause a denial of service via an infinite recursion in the `mutool clean` utility. When pr… |
CVE-2025-34147 | | 2025-08-04 | An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02). When configuring the device in E… | |
CVE-2025-8518 | Medium | 4.7 | 2025-08-04 | A vulnerability was found in givanz Vvveb 1.0.5. It has been rated as critical. Affected by this issue is the function Save of the file admin/controller/editor… |
CVE-2025-51535 | Critical | 9.1 | 2025-08-04 | Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a SQL injection vulnerability. |
CVE-2025-51534 | High | 8.1 | 2025-08-04 | A cross-site scripting (XSS) vulnerability in Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 allows attackers to execute arbitrary web scripts or HTM… |
CVE-2025-50422 | Low | 2.9 | 2025-08-04 | Cairo through 1.18.4, as used in Poppler through 25.08.0, has an "unscaled->face == NULL" assertion failure for _cairo_ft_unscaled_font_fini in cairo-ft-font.c. |
CVE-2025-50420 | Medium | 6.5 | 2025-08-04 | An issue in the pdfseparate utility of freedesktop poppler v25.04.0 allows attackers to cause an infinite recursion via supplying a crafted PDF file. This can… |
CVE-2025-44963 | Critical | 9.0 | 2025-08-04 | RUCKUS Network Director (RND) before 4.5 allows spoofing of an administrator JWT by an attacker who knows the hardcoded value of a certain secret key. |
CVE-2025-44962 | Medium | 5.0 | 2025-08-04 | RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows ../ directory traversal to read files. |
CVE-2025-44961 | Critical | 9.9 | 2025-08-04 | In RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated user. |
CVE-2025-44960 | High | 8.5 | 2025-08-04 | RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build allows OS command injection via a certain parameter in an API route. |
CVE-2025-44958 | Medium | 5.3 | 2025-08-04 | RUCKUS Network Director (RND) before 4.5 stores passwords in a recoverable format. |
CVE-2025-44957 | High | 8.5 | 2025-08-04 | Ruckus SmartZone (SZ) before 6.1.2p3 Refresh Build allows authentication bypass via a valid API key and crafted HTTP headers. |
CVE-2025-44954 | Critical | 9.0 | 2025-08-04 | RUCKUS SmartZone (SZ) before 6.1.2p3 Refresh Build has a hardcoded SSH private key for a root-equivalent user account. |
CVE-2025-8517 | Medium | 6.3 | 2025-08-04 | A vulnerability was detected in givanz Vvveb 1.0.6.1. Impacted is an unknown function. The manipulation results in session fixiation. The attack can be launche… |
CVE-2025-8516 | Medium | 5.3 | 2025-08-04 | A security vulnerability has been detected in Kingdee Cloud-Starry-Sky Enterprise Edition up to 8.2. This issue affects the function BaseServiceFactory.getFile… |
CVE-2025-5988 | Medium | 5.3 | 2025-08-04 | A flaw was found in the Ansible aap-gateway. Cross-site request forgery (CSRF) origin checking is not done on requests from the gateway to external components… |
CVE-2025-44955 | High | 8.8 | 2025-08-04 | RUCKUS Network Director (RND) before 4.5 allows jailed users to obtain root access vis a weak, hardcoded password. |
CVE-2025-38739 | High | 7.2 | 2025-08-04 | Dell Digital Delivery, versions prior to 5.6.1.0, contains an Insufficiently Protected Credentials vulnerability. A remote unauthenticated attacker could poten… |
CVE-2025-51536 | Critical | 9.8 | 2025-08-04 | Austrian Archaeological Institute (AI) OpenAtlas v8.11.0 as discovered to contain a hardcoded Administrator password. |
CVE-2025-44643 | High | 8.6 | 2025-08-04 | Certain Draytek products are affected by Insecure Configuration. This affects AP903 v1.4.18 and AP912C v1.4.9 and AP918R v1.4.9. The setting of the password pr… |
CVE-2025-36594 | Critical | 9.8 | 2025-08-04 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.3.0.15, LTS2024 release Versions 7.13.1.0… |
CVE-2025-30099 | High | 7.8 | 2025-08-04 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0… |
CVE-2025-30098 | Medium | 6.7 | 2025-08-04 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0… |
CVE-2025-30097 | Medium | 6.7 | 2025-08-04 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0… |
CVE-2025-30096 | Medium | 6.7 | 2025-08-04 | Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.1.0.10, LTS2024 release Versions 7.13.1.0… |
CVE-2025-26065 | High | 7.3 | 2025-08-04 | A cross-site scripting (XSS) vulnerability in Intelbras RX1500 v2.2.9 and RX3000 v1.0.11 allows attackers to execute arbitrary web scripts or HTML via injectin… |
CVE-2025-8109 | High | 8.8 | 2025-08-04 | Software installed and run as a non-privileged user may conduct ptrace system calls to issue writes to GPU origin read only memory. |
CVE-2025-36607 | High | 7.8 | 2025-08-04 | Dell Unity, version(s) 5.5 and prior, contain(s) an OS Command Injection Vulnerability in its svc_nas utility. An authenticated attacker could potentially expl… |
CVE-2025-36606 | High | 7.8 | 2025-08-04 | Dell Unity, version(s) 5.5 and prior, contain(s) an OS Command Injection Vulnerability in its svc_nfssupport utility. An authenticated attacker could potential… |
CVE-2025-36605 | Medium | 6.1 | 2025-08-04 | Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in the C… |
CVE-2025-36604 | High | 7.3 | 2025-08-04 | Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A… |
CVE-2025-8515 | Low | 3.1 | 2025-08-04 | A weakness has been identified in Intelbras InControl 2.21.60.9. This vulnerability affects unknown code of the file /v1/operador/ of the component JSON Endpoi… |
CVE-2025-6205 | Critical | 9.1 | 2025-08-04 | A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the a… |
CVE-2025-6204 | High | 8.0 | 2025-08-04 | An Improper Control of Generation of Code (Code Injection) vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker… |
CVE-2025-0932 | Medium | 4.3 | 2025-08-04 | Use After Free vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Driver, Arm Ltd Arm 5th Gen GPU Architecture Userspace Driv… |
CVE-2025-8341 | Medium | 5.0 | 2025-08-04 | Grafana is an open-source platform for monitoring and observability. The Infinity datasource plugin, maintained by Grafana Labs, allows visualizing data from J… |