2025 CVEs (page 237)
Page 237 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8211 | Low | 3.5 | 2025-07-26 | A vulnerability was found in Roothub up to 2.6. It has been declared as problematic. Affected by this vulnerability is the function Edit of the file src/main/j… |
CVE-2025-8210 | Medium | 5.3 | 2025-07-26 | A vulnerability was found in Yeelink Yeelight App up to 3.5.4 on Android. It has been classified as problematic. Affected is an unknown function of the file An… |
CVE-2025-8207 | Medium | 5.3 | 2025-07-26 | A vulnerability was found in Canara ai1 Mobile Banking App 3.6.23 on Android and classified as problematic. This issue affects some unknown processing of the f… |
CVE-2025-8206 | Low | 3.1 | 2025-07-26 | A vulnerability, which was classified as problematic, was found in Comodo Dragon up to 134.0.6998.179. This affects an unknown part of the component IP DNS Lea… |
CVE-2025-8205 | Low | 3.7 | 2025-07-26 | A vulnerability, which was classified as problematic, has been found in Comodo Dragon up to 134.0.6998.179. Affected by this issue is some unknown functionalit… |
CVE-2025-8204 | Low | 3.1 | 2025-07-26 | A vulnerability classified as problematic was found in Comodo Dragon up to 134.0.6998.179. Affected by this vulnerability is an unknown functionality of the co… |
CVE-2025-8203 | Medium | 6.3 | 2025-07-26 | A vulnerability classified as critical has been found in Jingmen Zeyou Large File Upload Control up to 6.3. Affected is an unknown function of the file /index… |
CVE-2025-8191 | Low | 3.5 | 2025-07-26 | A vulnerability, which was classified as problematic, was found in macrozheng mall up to 1.0.3. Affected is an unknown function of the file /swagger-ui/index.h… |
CVE-2025-8190 | Medium | 6.3 | 2025-07-26 | A vulnerability, which was classified as critical, has been found in Campcodes Courier Management System 1.0. This issue affects some unknown processing of the… |
CVE-2025-8189 | Medium | 6.3 | 2025-07-26 | A vulnerability classified as critical was found in Campcodes Courier Management System 1.0. This vulnerability affects unknown code of the file /edit_user.php… |
CVE-2025-8188 | Medium | 6.3 | 2025-07-26 | A vulnerability classified as critical has been found in Campcodes Courier Management System 1.0. This affects an unknown part of the file /edit_staff.php. The… |
CVE-2025-8187 | Medium | 6.3 | 2025-07-26 | A vulnerability was found in Campcodes Courier Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of th… |
CVE-2025-8186 | Medium | 6.3 | 2025-07-26 | A vulnerability was found in Campcodes Courier Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functional… |
CVE-2025-8185 | High | 7.3 | 2025-07-26 | A vulnerability was found in 1000 Projects ABC Courier Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /… |
CVE-2025-8184 | High | 8.8 | 2025-07-26 | A vulnerability was found in D-Link DIR-513 up to 1.10 and classified as critical. This issue affects the function formSetWanL2TPcallback of the file /goform/f… |
CVE-2025-8182 | Medium | 5.6 | 2025-07-26 | A vulnerability has been found in Tenda AC18 15.03.05.19 and classified as problematic. This vulnerability affects unknown code of the file /etc_ro/smb.conf of… |
CVE-2025-6991 | High | 7.5 | 2025-07-26 | The kallyas theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.21.0 via the 'TH_LatestPosts4` widget. This makes… |
CVE-2025-6989 | High | 8.1 | 2025-07-26 | The Kallyas theme for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the delete_font() function in all versio… |
CVE-2025-5529 | Medium | 6.4 | 2025-07-26 | The Educenter theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Circle Counter Block in all versions up to, and including, 1.6.2 due to… |
CVE-2025-8181 | High | 7.2 | 2025-07-26 | A vulnerability, which was classified as critical, was found in TOTOLINK N600R and X2000R 1.0.0.1. This affects an unknown part of the file vsftpd.conf of the… |
CVE-2025-8180 | High | 8.8 | 2025-07-26 | A vulnerability, which was classified as critical, has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function formdeleteUserName of the file… |
CVE-2025-8097 | Medium | 5.3 | 2025-07-26 | The WoodMart theme for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 8.2.6. This is due to insufficient validation… |
CVE-2025-7501 | Medium | 6.4 | 2025-07-26 | The Wonder Slider Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image title and description DOM in all versions up to, and includi… |
CVE-2025-6987 | Medium | 6.4 | 2025-07-26 | The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advanced_iframe' shortcode in all versions up to, and i… |
CVE-2025-8198 | High | 7.5 | 2025-07-26 | The MinimogWP – The High Converting eCommerce WordPress Theme theme for WordPress is vulnerable to price manipulation in all versions up to, and including, 3.9… |
CVE-2025-8179 | High | 7.3 | 2025-07-26 | A vulnerability classified as critical was found in PHPGurukul Local Services Search Engine Management System 2.1. Affected by this vulnerability is an unknown… |
CVE-2025-8178 | High | 8.8 | 2025-07-26 | A vulnerability classified as critical has been found in Tenda AC10 16.03.10.13. Affected is an unknown function of the file /goform/RequestsProcessLaid. The m… |
CVE-2025-6895 | Critical | 9.8 | 2025-07-26 | The Melapress Login Security plugin for WordPress is vulnerable to Authentication Bypass due to missing authorization within the get_valid_user_based_on_token(… |
CVE-2025-8177 | Medium | 5.3 | 2025-07-26 | A vulnerability was found in LibTIFF up to 4.7.0. It has been rated as critical. This issue affects the function setrow of the file tools/thumbnail.c. The mani… |
CVE-2025-8176 | Medium | 5.3 | 2025-07-26 | A vulnerability was found in LibTIFF up to 4.7.0. It has been declared as critical. This vulnerability affects the function get_histogram of the file tools/tif… |
CVE-2025-8103 | Medium | 4.3 | 2025-07-26 | The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.8.7. This is due to mis… |
CVE-2025-54416 | Critical | 9.1 | 2025-07-26 | tj-actions/branch-names is a Github actions repository that contains workflows to retrieve branch or tag names with support for all events. In versions 8.2.1 a… |
CVE-2025-54415 | | 2025-07-26 | dag-factory is a library for Apache Airflow® to construct DAGs declaratively via configuration files. In versions 0.23.0a8 and below, a high-severity vulnerabi… | |
CVE-2025-54414 | | 2025-07-26 | Anubis is a Web AI Firewall Utility that weighs the soul of users' connections using one or more challenges in order to protect upstream resources from scraper… | |
CVE-2025-54413 | | 2025-07-26 | skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below contain an inconsistency in MethodNode, w… | |
CVE-2025-54412 | | 2025-07-26 | skops is a Python library which helps users share and ship their scikit-learn based models. Versions 0.11.0 and below contain a inconsistency in the OperatorFu… | |
CVE-2025-54385 | Critical | 9.8 | 2025-07-26 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions between 17.0.0-rc1 to 17.2.2 and versions… |
CVE-2025-54380 | Medium | 6.5 | 2025-07-26 | Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to version 17.6, Opencast would incorrectly se… |
CVE-2025-54378 | High | 8.3 | 2025-07-26 | HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and below of haxcms-nodejs and versions 11.0.8 and below… |
CVE-2025-54366 | High | 8.8 | 2025-07-26 | FreeScout is a lightweight free open source help desk and shared inbox built with PHP (Laravel framework). In versions 1.8.185 and below, there is a critical d… |
CVE-2025-50185 | | 2025-07-26 | DbGate is cross-platform database manager. In versions 6.6.0 and below, DbGate allows unauthorized file access due to insufficient validation of file paths and… | |
CVE-2025-50184 | | 2025-07-26 | DbGate is cross-platform database manager. In versions 6.4.3-premium-beta.5 and below, DbGate is vulnerable to a directory traversal flaw. The file parameter i… | |
CVE-2025-8175 | Medium | 6.5 | 2025-07-26 | A vulnerability was found in D-Link DI-8400 16.07.26A1. It has been classified as problematic. This affects an unknown part of the file usb_paswd.asp of the co… |
CVE-2025-8174 | Medium | 6.3 | 2025-07-26 | A vulnerability was found in code-projects Voting System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admi… |
CVE-2025-8173 | High | 7.3 | 2025-07-25 | A vulnerability has been found in 1000 Projects ABC Courier Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown func… |
CVE-2025-8172 | Medium | 6.3 | 2025-07-25 | A vulnerability, which was classified as critical, was found in itsourcecode Employee Management System 1.0. Affected is an unknown function of the file /admin… |
CVE-2025-8171 | Medium | 6.3 | 2025-07-25 | A vulnerability, which was classified as critical, has been found in code-projects Document Management System 1.0. This issue affects some unknown processing o… |
CVE-2025-8101 | | 2025-07-25 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attrib… | |
CVE-2025-8170 | High | 8.8 | 2025-07-25 | A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748_B20211015. This vulnerability affects the function tcpcheck_net of the file /router… |
CVE-2025-8169 | High | 8.8 | 2025-07-25 | A vulnerability classified as critical has been found in D-Link DIR-513 1.10. This affects the function formSetWanPPTPcallback of the file /goform/formSetWanPP… |
CVE-2025-8168 | High | 8.8 | 2025-07-25 | A vulnerability was found in D-Link DIR-513 1.10. It has been rated as critical. Affected by this issue is the function websAspInit of the file /goform/formSet… |
CVE-2025-8167 | Low | 3.5 | 2025-07-25 | A vulnerability was found in code-projects Church Donation System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functi… |
CVE-2025-46198 | High | 8.8 | 2025-07-25 | Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attribute of the img el… |
CVE-2025-30135 | Critical | 9.4 | 2025-07-25 | An issue was discovered on IROAD Dashcam FX2 devices. Dumping Files Over HTTP and RTSP Without Authentication can occur. It lacks authentication controls on it… |
CVE-2025-8166 | High | 7.3 | 2025-07-25 | A vulnerability was found in code-projects Church Donation System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/i… |
CVE-2025-8165 | Medium | 6.3 | 2025-07-25 | A vulnerability was found in code-projects Food Review System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/app… |
CVE-2025-52455 | Medium | 5.3 | 2025-07-25 | Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (EPS Server modules) allows Resource Location Spoofing. This is… |
CVE-2025-52454 | High | 8.2 | 2025-07-25 | Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Amazon S3 Connector modules) allows Resource Location Spoofing… |
CVE-2025-52453 | High | 8.2 | 2025-07-25 | Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Data Source modules) allows Resource Location Spoofing. T… |
CVE-2025-52452 | High | 8.5 | 2025-07-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - dupli… |
CVE-2025-52449 | High | 8.5 | 2025-07-25 | Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service modules) allows Alter… |
CVE-2025-52448 | High | 8.1 | 2025-07-25 | Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initial-sql api modules) allows Interfa… |
CVE-2025-52447 | High | 8.1 | 2025-07-25 | Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc command modules) allows I… |
CVE-2025-52446 | High | 8.0 | 2025-07-25 | Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (tab-doc api modules) allows Interface Manipulati… |
CVE-2025-8164 | Medium | 6.3 | 2025-07-25 | A vulnerability has been found in code-projects Public Chat Room 1.0 and classified as critical. This vulnerability affects unknown code of the file send_messa… |
CVE-2025-8163 | Medium | 6.3 | 2025-07-25 | A vulnerability, which was classified as critical, was found in deerwms deer-wms-2 up to 3.3. This affects an unknown part of the file /system/role/list. The m… |
CVE-2025-5449 | Medium | 6.5 | 2025-07-25 | A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow… |
CVE-2025-46199 | Critical | 9.8 | 2025-07-25 | Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form fields |
CVE-2025-8162 | Medium | 6.3 | 2025-07-25 | A vulnerability, which was classified as critical, has been found in deerwms deer-wms-2 up to 3.3. Affected by this issue is some unknown functionality of the… |
CVE-2025-8161 | Medium | 6.3 | 2025-07-25 | A vulnerability classified as critical was found in deerwms deer-wms-2 up to 3.3. Affected by this vulnerability is an unknown functionality of the file /syste… |
CVE-2025-54596 | Medium | 4.3 | 2025-07-25 | Abnormal Security /v1.0/rbac/users_v2/{USER_ID}/ before 2025-02-19 allows downgrading the privileges of other user accounts. |
CVE-2025-45960 | Medium | 6.1 | 2025-07-25 | Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via the web application stores and displays… |
CVE-2025-45893 | Medium | 6.1 | 2025-07-25 | OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts. The vulnerability arises because… |
CVE-2025-45892 | Medium | 6.1 | 2025-07-25 | OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via the blog editor. The vulnerability arises because input in the blog's… |
CVE-2025-45406 | Medium | 6.1 | 2025-07-25 | A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inject… |
CVE-2025-36728 | Medium | 6.3 | 2025-07-25 | Cross-Site Request Forgery (CSRF) vulnerability in Simplehelp.This issue affects Simplehelp: before 5.5.11. |
CVE-2025-36727 | High | 8.3 | 2025-07-25 | Inclusion of Functionality from Untrusted Control Sphere vulnerability in Simplehelp.This issue affects Simplehelp: before 5.5.12. |
CVE-2025-29631 | Critical | 9.8 | 2025-07-25 | Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through… |
CVE-2025-29629 | Critical | 9.1 | 2025-07-25 | Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for… |
CVE-2025-29628 | Critical | 9.4 | 2025-07-25 | A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Kit Mobile Applicat… |
CVE-2025-45466 | High | 8.8 | 2025-07-25 | Unitree Go1 <= Go1_2022_05_11 is vulnerale to Incorrect Access Control due to authentication credentials being hardcoded in plaintext. |
CVE-2025-3873 | | 2025-07-25 | The following APIs for the Silcon Labs SiWx91x prior to vesion 3.4.0 failed to check the size of the output buffer of the caller which could lead to data corru… | |
CVE-2025-3508 | Medium | 6.5 | 2025-07-25 | Certain HP DesignJet products may be vulnerable to information disclosure though printer's web interface allowing unauthenticated users to view sensitive print… |
CVE-2025-38467 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling If there's support for an… |
CVE-2025-38466 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: perf: Revert to requiring CAP_SYS_ADMIN for uprobes Jann reports that uprobes can be used… |
CVE-2025-38465 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: netlink: Fix wraparounds of sk->sk_rmem_alloc. Netlink has this pattern in some places … |
CVE-2025-38464 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free in tipc_conn_close(). syzbot reported a null-ptr-deref in tipc_c… |
CVE-2025-38463 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: tcp: Correct signedness in skb remaining space calculation Syzkaller reported a bug [1] w… |
CVE-2025-38462 | Medium | 4.7 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transport_{g2h,h2g} TOCTOU vsock_find_cid() and vsock_dev_do_ioctl() may race… |
CVE-2025-38461 | High | 7.0 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transport_* TOCTOU Transport assignment may race with module unload. Protect n… |
CVE-2025-38460 | High | 7.0 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix potential null-ptr-deref in to_atmarpd(). atmarpd is protected by RTNL sin… |
CVE-2025-38459 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix infinite recursive call of clip_push(). syzbot reported the splat below. [… |
CVE-2025-38458 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() atmarpd_dev_ops does not impleme… |
CVE-2025-38457 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: Abort __tc_modify_qdisc if parent class does not exist Lion's patch [1] reveal… |
CVE-2025-38456 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() The "intf" list it… |
CVE-2025-38455 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight Reject migra… |
CVE-2025-38454 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() Use pr_warn() i… |
CVE-2025-38453 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU syzbot reports that defer/… |
CVE-2025-38452 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() Add check for the ret… |
CVE-2025-38451 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: md/md-bitmap: fix GPF in bitmap_get_stats() The commit message of commit 6ec1f0239485 ("m… |