2025 CVEs (page 232)
Page 232 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-41691 | High | 7.5 | 2025-08-04 | An unauthenticated remote attacker may trigger a NULL pointer dereference in the affected CODESYS Control runtime systems by sending specially crafted communic… |
CVE-2025-41659 | High | 8.3 | 2025-08-04 | A low-privileged attacker can remotely access the PKI folder of the CODESYS Control runtime system and thus read and write certificates and its keys. This allo… |
CVE-2025-41658 | Medium | 5.5 | 2025-08-04 | CODESYS Runtime Toolkit-based products may expose sensitive files to local low-privileged operating system users due to default file permissions. |
CVE-2025-20702 | High | 8.8 | 2025-08-04 | In the Airoha Bluetooth audio SDK, there is a possible unauthorized access to the RACE protocol. This could lead to remote escalation of privilege with no addi… |
CVE-2025-20701 | High | 8.8 | 2025-08-04 | In the Airoha Bluetooth audio SDK, there is a possible way to pair Bluetooth audio device without user consent. This could lead to remote escalation of privile… |
CVE-2025-20700 | High | 8.8 | 2025-08-04 | In the Airoha Bluetooth audio SDK, there is a possible permission bypass that allows access critical data of RACE protocol through Bluetooth LE GATT service. T… |
CVE-2025-48499 | Medium | 5.3 | 2025-08-04 | Out-of-bounds write vulnerability exists in FUJIFILM Business Innovation MFPs. A specially crafted IPP (Internet Printing Protocol) or LPD (Line Printer Daemon… |
CVE-2025-54962 | Medium | 6.4 | 2025-08-04 | /edit-user in webserver in OpenPLC Runtime 3 through 9cd8f1b allows authenticated users to upload arbitrary files (such as .html or .svg), and these are then p… |
CVE-2025-20698 | Medium | 6.7 | 2025-08-04 | In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has… |
CVE-2025-20697 | Medium | 6.7 | 2025-08-04 | In Power HAL, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has… |
CVE-2025-20696 | Medium | 6.8 | 2025-08-04 | In DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical acc… |
CVE-2025-54956 | Low | 3.2 | 2025-08-03 | The gh package before 1.5.0 for R delivers an HTTP response in a data structure that includes the Authorization header from the corresponding HTTP request. |
CVE-2025-8513 | Medium | 5.3 | 2025-08-03 | A vulnerability, which was classified as problematic, was found in Caixin News App 8.0.1 on Android. Affected is an unknown function of the file AndroidManifes… |
CVE-2025-8512 | Medium | 5.3 | 2025-08-03 | A vulnerability, which was classified as problematic, has been found in TVB Big Big Shop App 2.9.0 on Android. This issue affects some unknown processing of th… |
CVE-2025-8511 | Low | 3.5 | 2025-08-03 | A vulnerability classified as problematic was found in Portabilis i-Diario 1.5.0. This vulnerability affects unknown code of the file /diario-de-observacoes/ o… |
CVE-2025-8510 | Low | 3.5 | 2025-08-03 | A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. This affects the function Gerar of the file ieducar/intranet/educar_matri… |
CVE-2025-8509 | Low | 3.5 | 2025-08-03 | A vulnerability was found in Portabilis i-Educar 2.9. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /intra… |
CVE-2025-8508 | Low | 3.5 | 2025-08-03 | A vulnerability was found in Portabilis i-Educar 2.9. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the fi… |
CVE-2025-8507 | Low | 3.5 | 2025-08-03 | A vulnerability was found in Portabilis i-Educar 2.9. It has been classified as problematic. Affected is an unknown function of the file /intranet/educar_funca… |
CVE-2025-8506 | Low | 3.5 | 2025-08-03 | A vulnerability was found in 495300897 wx-shop up to de1b66331368695779cfc6e4d11a64caddf8716e and classified as problematic. This issue affects some unknown pr… |
CVE-2025-8505 | Medium | 4.3 | 2025-08-03 | A vulnerability has been found in 495300897 wx-shop up to de1b66331368695779cfc6e4d11a64caddf8716e and classified as problematic. This vulnerability affects un… |
CVE-2025-8504 | Medium | 6.3 | 2025-08-03 | A vulnerability, which was classified as critical, was found in code-projects Kitchen Treasure 1.0. This affects an unknown part of the file /userregistration… |
CVE-2025-8503 | High | 7.3 | 2025-08-03 | A vulnerability, which was classified as critical, has been found in code-projects Online Medicine Guide 1.0. Affected by this issue is some unknown functional… |
CVE-2025-8502 | High | 7.3 | 2025-08-03 | A vulnerability classified as critical was found in code-projects Online Medicine Guide 1.0. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-8501 | Low | 3.5 | 2025-08-03 | A vulnerability classified as problematic has been found in code-projects Human Resource Integrated System 1.0. Affected is an unknown function of the file /in… |
CVE-2025-8500 | Medium | 6.3 | 2025-08-03 | A vulnerability was found in code-projects Human Resource Integrated System 1.0. It has been rated as critical. This issue affects some unknown processing of t… |
CVE-2025-8499 | High | 7.3 | 2025-08-03 | A vulnerability was found in code-projects Online Medicine Guide 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /cu… |
CVE-2025-8498 | High | 7.3 | 2025-08-03 | A security vulnerability has been detected in code-projects Online Medicine Guide 1.0. This vulnerability affects unknown code of the file /cart/index.php. Suc… |
CVE-2025-8497 | High | 7.3 | 2025-08-03 | A weakness has been identified in code-projects Online Medicine Guide 1.0. This affects an unknown part of the file /cusfindphar2.php. This manipulation of the… |
CVE-2025-8496 | High | 7.3 | 2025-08-03 | A vulnerability has been found in projectworlds Online Admission System 1.0 and classified as critical. Affected by this vulnerability is an unknown functional… |
CVE-2025-52133 | Medium | 6.4 | 2025-08-03 | The Mocca Calendar application before 2.15 for XWiki allows XSS via a title upon calendar import. |
CVE-2025-52132 | Medium | 6.4 | 2025-08-03 | The Mocca Calendar application before 2.15 for XWiki allows XSS via a title to the view event page. |
CVE-2025-52131 | Medium | 6.4 | 2025-08-03 | The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field. |
CVE-2025-8495 | High | 7.3 | 2025-08-03 | A vulnerability, which was classified as critical, was found in code-projects Intern Membership Management System 1.0. Affected is an unknown function of the f… |
CVE-2025-54351 | High | 8.9 | 2025-08-03 | In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv). |
CVE-2025-54350 | Low | 3.7 | 2025-08-03 | In iperf before 3.19.1, iperf_auth.c has a Base64Decode assertion failure and application exit upon a malformed authentication attempt. |
CVE-2025-54349 | Medium | 6.5 | 2025-08-03 | In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow. |
CVE-2025-8494 | High | 7.3 | 2025-08-03 | A vulnerability, which was classified as critical, has been found in code-projects Intern Membership Management System 1.0. This issue affects some unknown pro… |
CVE-2025-54955 | High | 8.1 | 2025-08-03 | OpenNebula Community Edition (CE) before 7.0.0 and Enterprise Edition (EE) before 6.10.3 have a critical FireEdge race condition that can lead to full account… |
CVE-2025-8493 | High | 7.3 | 2025-08-02 | A vulnerability classified as critical was found in code-projects Intern Membership Management System 1.0. This vulnerability affects unknown code of the file… |
CVE-2025-23290 | Low | 2.5 | 2025-08-02 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a guest could get global GPU metrics which may be influenced by work in other V… |
CVE-2025-23285 | Medium | 5.5 | 2025-08-02 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where it allows a guest to access global resources. A successful exploit of this vuln… |
CVE-2025-23284 | High | 7.8 | 2025-08-02 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause a stack buffer overflow. A successful exploit of… |
CVE-2025-23288 | Low | 3.3 | 2025-08-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may cause an exposure of sensitive system information with local unprivileged… |
CVE-2025-23287 | Low | 3.3 | 2025-08-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may access sensitive system-level information. A successful exploit of this vu… |
CVE-2025-23286 | Medium | 4.4 | 2025-08-02 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability where an attacker could read invalid memory. A successful exploit of this vulnerabilit… |
CVE-2025-23283 | High | 7.8 | 2025-08-02 | NVIDIA vGPU software for Linux-style hypervisors contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause stack buffer overflow… |
CVE-2025-23281 | High | 7.0 | 2025-08-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker with local unprivileged access that can win a race condition might be able to… |
CVE-2025-23279 | High | 7.0 | 2025-08-02 | NVIDIA .run Installer for Linux and Solaris contains a vulnerability where an attacker could use a race condition to escalate privileges. A successful exploit… |
CVE-2025-23278 | High | 7.1 | 2025-08-02 | NVIDIA Display Driver for Windows and Linux contains a vulnerability where an attacker might cause an improper index validation by issuing a call with crafted… |
CVE-2025-23277 | High | 7.3 | 2025-08-02 | NVIDIA Display Driver for Linux and Windows contains a vulnerability in the kernel mode driver, where an attacker could access memory outside bounds permitted… |
CVE-2025-23276 | High | 7.8 | 2025-08-02 | NVIDIA Installer for Windows contains a vulnerability where an attacker may be able to escalate privileges. A successful exploit of this vulnerability may lead… |
CVE-2025-8471 | High | 7.3 | 2025-08-02 | A vulnerability, which was classified as critical, has been found in projectworlds Online Admission System 1.0. This issue affects some unknown processing of t… |
CVE-2025-8470 | High | 7.3 | 2025-08-02 | A vulnerability classified as critical was found in SourceCodester Online Hotel Reservation System 1.0. This vulnerability affects unknown code of the file /ad… |
CVE-2025-8469 | High | 7.3 | 2025-08-02 | A vulnerability classified as critical has been found in SourceCodester Online Hotel Reservation System 1.0. This affects an unknown part of the file /admin/de… |
CVE-2025-8468 | High | 7.3 | 2025-08-02 | A vulnerability was found in code-projects Wazifa System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /… |
CVE-2025-7710 | Critical | 9.8 | 2025-08-02 | The Brave Conversion Engine (PRO) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 0.7.7. This is due to the p… |
CVE-2025-7500 | Medium | 6.4 | 2025-08-02 | The Ocean Social Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via social icon titles in all versions up to, and including, 2.2.1 d… |
CVE-2025-8467 | High | 7.3 | 2025-08-02 | A vulnerability was found in code-projects Wazifa System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of t… |
CVE-2025-8488 | Medium | 4.3 | 2025-08-02 | The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) plugin for WordPress is vulnerable to unauthorized modification of data due to a… |
CVE-2025-6722 | Medium | 5.3 | 2025-08-02 | The BitFire Security – Firewall, WAF, Bot/Spam Blocker, Login Security plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up… |
CVE-2025-8466 | High | 7.3 | 2025-08-02 | A vulnerability was found in code-projects Online Farm System 1.0. It has been classified as critical. Affected is an unknown function of the file /forgot_pass… |
CVE-2025-8400 | Medium | 6.1 | 2025-08-02 | The Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.0.0 due to insufficient input sa… |
CVE-2025-8399 | Medium | 6.4 | 2025-08-02 | The Mmm Unity Loader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘attributes’ parameter in all versions up to, and including, 1.0… |
CVE-2025-8391 | Medium | 6.4 | 2025-08-02 | The Magic Edge – Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, and including, 1.1.6… |
CVE-2025-6832 | Medium | 6.1 | 2025-08-02 | The All in One Time Clock Lite – Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'non… |
CVE-2025-8317 | Medium | 6.4 | 2025-08-02 | The Custom Word Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘angle’ parameter in all versions up to, and including, 0.3 due… |
CVE-2025-8212 | Medium | 6.4 | 2025-08-02 | The Medical Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typewriter widget in all versions up to, and… |
CVE-2025-8152 | Medium | 5.3 | 2025-08-02 | The WP CTA – Call To Action Plugin, Sticky CTA, Sticky Buttons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabil… |
CVE-2025-6754 | High | 8.8 | 2025-08-02 | The SEO Metrics plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks in both the seo_metrics_handle_connect_button_cl… |
CVE-2025-6626 | Medium | 4.4 | 2025-08-02 | The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the API URL Setting… |
CVE-2025-4588 | Medium | 6.4 | 2025-08-02 | The 360 Photo Spheres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sphere' shortcode in all versions up to, and includin… |
CVE-2025-8146 | Medium | 6.4 | 2025-08-02 | The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's TypeOut Text widget in all versions up to, and i… |
CVE-2025-7694 | Medium | 6.8 | 2025-08-02 | The Woffice Core plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the woffice_file_manager_delete() fu… |
CVE-2025-6078 | Medium | 5.4 | 2025-08-02 | Partner Software's Partner Software application and Partner Web application allows an authenticated user to add notes on the 'Notes' page when viewing a job bu… |
CVE-2025-6077 | Critical | 9.8 | 2025-08-02 | Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account… |
CVE-2025-6076 | High | 8.8 | 2025-08-02 | Partner Software's Partner Software application and Partner Web application do not sanitize files uploaded on the "reports" tab, allowing an authenticated atta… |
CVE-2025-54796 | High | 7.5 | 2025-08-02 | Copyparty is a portable file server. Versions prior to 1.18.9, the filter parameter for the "Recent Uploads" page allows arbitrary RegExes. If this feature is… |
CVE-2025-54790 | Medium | 6.5 | 2025-08-02 | Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, Files does not have logic to prevent the exploitation of ba… |
CVE-2025-54789 | Medium | 6.1 | 2025-08-02 | Files is a module for managing files inside spaces and user profiles. In versions 0.16.9 and below, the File Move functionality does not contain logic that pre… |
CVE-2025-54782 | High | 8.8 | 2025-08-02 | Nest is a framework for building scalable Node.js server-side applications. In versions 0.2.0 and below, a critical Remote Code Execution (RCE) vulnerability w… |
CVE-2025-54781 | Low | 2.8 | 2025-08-02 | Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. When debugging is enabled for Himmelblau in version 1.0.0, the himmelblaud_tas… |
CVE-2025-54386 | Critical | 9.8 | 2025-08-02 | Traefik is an HTTP reverse proxy and load balancer. In versions 2.11.27 and below, 3.0.0 through 3.4.4 and 3.5.0-rc1, a path traversal vulnerability was discov… |
CVE-2025-54136 | High | 7.2 | 2025-08-02 | Cursor is a code editor built for programming with AI. In versions 1.2.4 and below, attackers can achieve remote and persistent code execution by modifying an… |
CVE-2025-54133 | Critical | 9.6 | 2025-08-02 | Cursor is a code editor built for programming with AI. In versions 1.17 through 1.2, there is a UI information disclosure vulnerability in Cursor's MCP (Model… |
CVE-2025-54792 | Medium | 6.8 | 2025-08-01 | LocalSend is an open-source app to securely share files and messages with nearby devices over local networks without needing an internet connection. In version… |
CVE-2025-54424 | High | 8.1 | 2025-08-01 | 1Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Linux server. In versions 2.0.5 and below, the HTTP… |
CVE-2025-54132 | Medium | 4.4 | 2025-08-01 | Cursor is a code editor built for programming with AI. In versions below 1.3, Mermaid (which is used to render diagrams) allows embedding images which then get… |
CVE-2025-54131 | Medium | 6.4 | 2025-08-01 | Cursor is a code editor built for programming with AI. In versions below 1.3, an attacker can bypass the allow list in auto-run mode with a backtick (`) or $(c… |
CVE-2025-8480 | High | 8.0 | 2025-08-01 | Alpine iLX-507 Command Injection Remote Code Execution. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installation… |
CVE-2025-8477 | High | 7.4 | 2025-08-01 | Alpine iLX-507 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute a… |
CVE-2025-8476 | High | 8.0 | 2025-08-01 | Alpine iLX-507 TIDAL Improper Certificate Validation Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected… |
CVE-2025-8475 | High | 7.4 | 2025-08-01 | Alpine iLX-507 AVRCP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary… |
CVE-2025-8474 | Medium | 6.8 | 2025-08-01 | Alpine iLX-507 CarPlay Stack-based Buffer Overflow Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary co… |
CVE-2025-8473 | Medium | 6.6 | 2025-08-01 | Alpine iLX-507 UPDM_wstpCBCUpdStart Command Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affect… |
CVE-2025-8472 | High | 7.4 | 2025-08-01 | Alpine iLX-507 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute a… |
CVE-2025-6037 | Medium | 6.8 | 2025-08-01 | Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+… |
CVE-2025-6015 | Medium | 5.7 | 2025-08-01 | Vault and Vault Enterprise’s (“Vault”) login MFA rate limits could be bypassed and TOTP tokens could be reused. Fixed in Vault Community Edition 1.20.1 and Vau… |
CVE-2025-6014 | Medium | 6.5 | 2025-08-01 | Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Fixed in Vault Com… |
CVE-2025-6011 | Low | 3.7 | 2025-08-01 | A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users… |