2025 CVEs (page 237)
Page 237 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-3075 | Medium | 6.4 | 2025-07-29 | The Elementor Website Builder – More Than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'elementor-ele… |
CVE-2025-7811 | Medium | 6.4 | 2025-07-29 | The StreamWeasels YouTube Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions… |
CVE-2025-7810 | Medium | 5.4 | 2025-07-29 | The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions up… |
CVE-2025-7809 | Medium | 6.4 | 2025-07-29 | The StreamWeasels Twitch Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions u… |
CVE-2025-54769 | High | 8.8 | 2025-07-29 | An authenticated, read-only user can upload a file and perform a directory traversal to have the uploaded file placed in a location of their choosing. This ca… |
CVE-2025-54768 | Medium | 5.3 | 2025-07-29 | An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The en… |
CVE-2025-54767 | Medium | 6.5 | 2025-07-29 | An authenticated, read-only user can kill any processes running on the Xormon Original virtual appliance as the lpar2rrd user. |
CVE-2025-54766 | Medium | 5.3 | 2025-07-29 | An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The en… |
CVE-2025-54765 | Medium | 5.3 | 2025-07-29 | An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The en… |
CVE-2025-54429 | | 2025-07-28 | Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. There are various account address types in Frontier, e.g. precompiled… | |
CVE-2025-54428 | Critical | 9.8 | 2025-07-28 | RevelaCode is an AI-powered faith-tech project that decodes biblical verses, prophecies and global events into accessible language. In versions below 1.0.1, a… |
CVE-2025-54427 | | 2025-07-28 | Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. The extrinsic note_min_gas_price_target is an inherent extrinsic, mean… | |
CVE-2025-54426 | | 2025-07-28 | Polkadot Frontier is an Ethereum and EVM compatibility layer for Polkadot and Substrate. In versions prior to commit 36f70d1, the Curve25519Add and Curve25519S… | |
CVE-2025-54423 | Medium | 5.4 | 2025-07-28 | copyparty is a portable file server. In versions up to and including versions 1.18.4, an unauthenticated attacker is able to execute arbitrary JavaScript code… |
CVE-2025-54419 | Critical | 10.0 | 2025-07-28 | A SAML library not dependent on any frameworks that runs in Node. In version 5.0.1, Node-SAML loads the assertion from the (unsigned) original response documen… |
CVE-2025-50486 | High | 7.1 | 2025-07-28 | Improper session invalidation in the component /carrental/update-password.php of PHPGurukul Car Rental Project v3.0 allows attackers to execute a session hijac… |
CVE-2025-50485 | High | 7.1 | 2025-07-28 | Improper session invalidation in the component /crm/change-password.php of PHPGurukul Online Course Registration v3.1 allows attackers to execute a session hij… |
CVE-2025-29534 | High | 8.8 | 2025-07-28 | An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band Wifi Extender V1.0 allows an attacker with valid credentials to execute arbit… |
CVE-2025-8283 | Low | 3.7 | 2025-07-28 | A vulnerability was found in the netavark package, a network stack for containers used with Podman. Due to dns.podman search domain being removed, netavark may… |
CVE-2025-8194 | High | 7.5 | 2025-07-28 | There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and entry enumeration APIs. The tar implementation would process tar archi… |
CVE-2025-50487 | High | 7.1 | 2025-07-28 | Improper session invalidation in the component /bbdms/change-password.php of PHPGurukul Blood Bank & Donor Management System v2.4 allows attackers to execute a… |
CVE-2025-50484 | High | 7.1 | 2025-07-28 | Improper session invalidation in the component /crm/change-password.php of PHPGurukul Small CRM v3.0 allows attackers to execute a session hijacking attack. |
CVE-2025-54299 | | 2025-07-28 | A stored XSS vulnerability in No Boss Testimonials component 1.0.0-3.0.0 and 4.0.0-4.0.2 for Joomla was discovered. | |
CVE-2025-54298 | | 2025-07-28 | A stored XSS vulnerability in CommentBox component 1.0.0-1.1.0 for Joomla was discovered. | |
CVE-2025-50492 | High | 7.5 | 2025-07-28 | Improper session invalidation in the component /edms/change-password.php of PHPGurukul e-Diary Management System v1 allows attackers to execute a session hijac… |
CVE-2025-50491 | High | 7.1 | 2025-07-28 | Improper session invalidation in the component /banker/change-password.php of PHPGurukul Bank Locker Management System v1 allows attackers to execute a session… |
CVE-2025-50489 | High | 7.5 | 2025-07-28 | Improper session invalidation in the component /srms/change-password.php of PHPGurukul Student Result Management System v2.0 allows attackers to execute a sess… |
CVE-2025-50488 | High | 7.1 | 2025-07-28 | Improper session invalidation in the component /library/change-password.php of PHPGurukul Online Library Management System v3.0 allows attackers to execute a s… |
CVE-2025-43023 | Critical | 9.1 | 2025-07-28 | A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software documentation. This potential vulnerability is due to the… |
CVE-2025-7676 | | 2025-07-28 | DLL hijacking of all PE32 executables when run on Windows for ARM64 CPU architecture. This allows an attacker to execute code, if the attacker can plant a DLL… | |
CVE-2025-54538 | Medium | 5.5 | 2025-07-28 | In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command |
CVE-2025-54537 | Medium | 5.5 | 2025-07-28 | In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots |
CVE-2025-54536 | Medium | 5.4 | 2025-07-28 | In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint |
CVE-2025-54535 | Medium | 5.8 | 2025-07-28 | In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms |
CVE-2025-54534 | Medium | 4.8 | 2025-07-28 | In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page |
CVE-2025-54533 | Medium | 4.3 | 2025-07-28 | In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration |
CVE-2025-54532 | Medium | 4.3 | 2025-07-28 | In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependencies |
CVE-2025-54531 | High | 7.7 | 2025-07-28 | In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows |
CVE-2025-54530 | High | 7.5 | 2025-07-28 | In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions |
CVE-2025-54529 | Low | 3.7 | 2025-07-28 | In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration |
CVE-2025-54528 | Medium | 5.4 | 2025-07-28 | In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow |
CVE-2025-54527 | Medium | 6.1 | 2025-07-28 | In JetBrains YouTrack before 2025.2.86935, 2025.2.87167, 2025.3.87341, 2025.3.87344 improper iframe configuration in widget sandbox allows popups to bypass… |
CVE-2025-50494 | High | 7.5 | 2025-07-28 | Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Car Washing Management System v1.0 allows attackers to execute a sessi… |
CVE-2025-50493 | High | 7.5 | 2025-07-28 | Improper session invalidation in the component /doctor/change-password.php of PHPGurukul Doctor Appointment Management System v1 allows attackers to execute a… |
CVE-2025-50490 | High | 7.5 | 2025-07-28 | Improper session invalidation in the component /elms/emp-changepassword.php of PHPGurukul Student Result Management System v2.0 allows attackers to execute a s… |
CVE-2025-6250 | Medium | 6.7 | 2025-07-28 | Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the s… |
CVE-2025-2297 | High | 7.8 | 2025-07-28 | Prior to version 25.4.270.0, a local authenticated attacker can manipulate user profile files to add illegitimate challenge response codes into the local user… |
CVE-2025-54418 | Critical | 9.8 | 2025-07-28 | CodeIgniter is a PHP full-stack web framework. A command injection vulnerability present in versions prior to 4.6.2 affects applications that use the ImageMagi… |
CVE-2025-53696 | | 2025-07-28 | iSTAR Ultra performs a firmware verification on boot, however the verification does not inspect certain portions of the firmware. These firmware parts may cont… | |
CVE-2025-30125 | Critical | 9.8 | 2025-07-28 | An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. All dashcams were shipped with the same default credentials of 12345678, which creates an in… |
CVE-2025-8279 | High | 8.7 | 2025-07-28 | Insufficient input validation within GitLab Language Server 7.6.0 and later before 7.30.0 allows arbitrary GraphQL query execution |
CVE-2025-53695 | | 2025-07-28 | OS Command Injection in iSTAR Ultra products web application allows an authenticated attacker to gain even more privileged access ('root' user) to the device f… | |
CVE-2025-32731 | Medium | 6.1 | 2025-07-28 | A reflected cross-site scripting (xss) vulnerability exists in the radiationDoseReport.php functionality of meddream MedDream PACS Premium 7.3.5.860. A special… |
CVE-2025-30133 | Critical | 9.8 | 2025-07-28 | An issue was discovered on IROAD Dashcam FX2 devices. Bypass of Device Pairing/Registration can occur. It requires device registration via the "IROAD X View" a… |
CVE-2025-30126 | Medium | 5.3 | 2025-07-28 | An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. Via port 7777 without any need to pair or press a physical button, a remote attacker can dis… |
CVE-2025-30124 | Critical | 9.8 | 2025-07-28 | An issue was discovered on Marbella KR8s Dashcam FF 2.0.8 devices. When a new SD card is inserted into the dashcam, the existing password is written onto the S… |
CVE-2025-27724 | Critical | 9.3 | 2025-07-28 | A privilege escalation vulnerability exists in the login.php functionality of meddream MedDream PACS Premium 7.3.3.840. A specially crafted .php file can lead… |
CVE-2025-26469 | Critical | 9.3 | 2025-07-28 | An incorrect default permissions vulnerability exists in the CServerSettings::SetRegistryValues functionality of MedDream PACS Premium 7.3.3.840. A specially… |
CVE-2025-24485 | Medium | 5.8 | 2025-07-28 | A server-side request forgery vulnerability exists in the cecho.php functionality of MedDream PACS Premium 7.3.5.860. A specially crafted HTTP request can lead… |
CVE-2025-8275 | Medium | 5.3 | 2025-07-28 | A vulnerability, which was classified as problematic, has been found in bsc Peru Cocktails App 1.0.0 on Android. Affected by this issue is some unknown functio… |
CVE-2025-54569 | Medium | 4.5 | 2025-07-28 | In Malwarebytes Binisoft Windows Firewall Control before 6.16.0.0, the installer is vulnerable to local privilege escalation. |
CVE-2025-4056 | High | 7.5 | 2025-07-28 | A flaw was found in GLib. A denial of service on Windows platforms may occur if an application attempts to spawn a program using long command lines. |
CVE-2025-8274 | High | 7.3 | 2025-07-28 | A vulnerability classified as critical was found in Campcodes Online Recruitment Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2025-5997 | High | 8.8 | 2025-07-28 | Incorrect Use of Privileged APIs vulnerability in Beamsec PhishPro allows Privilege Abuse. This issue affects PhishPro: before 7.5.4.2. |
CVE-2025-38497 | High | 7.1 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: configfs: Fix OOB read on empty string write When writing an empty string to… |
CVE-2025-38496 | Medium | 5.5 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: dm-bufio: fix sched in atomic context If "try_verify_in_tasklet" is set for dm-verity, DM… |
CVE-2025-38495 | High | 8.8 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: HID: core: ensure the allocated report buffer can contain the reserved report ID When the… |
CVE-2025-38494 | High | 7.8 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: HID: core: do not bypass hid_hw_raw_request hid_hw_raw_request() is actually useful to en… |
CVE-2025-38493 | Medium | 5.5 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Fix crash in timerlat_dump_stack() We have observed kernel panics when u… |
CVE-2025-38492 | Medium | 4.7 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix race between cache write completion and ALL_QUEUED being set When netfslib is… |
CVE-2025-38491 | High | 8.2 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: mptcp: make fallback action and fallback decision atomic Syzkaller reported the following… |
CVE-2025-38490 | Critical | 9.8 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: net: libwx: remove duplicate page_pool_put_full_page() page_pool_put_full_page() should o… |
CVE-2025-38489 | Medium | 5.5 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: s390/bpf: Fix bpf_arch_text_poke() with new_addr == NULL again Commit 7ded842b356d ("s390… |
CVE-2025-38488 | Critical | 9.8 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free in crypt_message when using async crypto The CVE-2024-500… |
CVE-2025-38487 | Medium | 5.5 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: lpc-snoop: Don't disable channels that aren't enabled Mitigate e.g. the foll… |
CVE-2025-38486 | High | 7.8 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: soundwire: Revert "soundwire: qcom: Add set_channel_map api support" This reverts commit… |
CVE-2025-38485 | High | 7.8 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: iio: accel: fxls8962af: Fix use after free in fxls8962af_fifo_flush fxls8962af_fifo_flush… |
CVE-2025-38484 | High | 7.8 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: iio: backend: fix out-of-bound write The buffer is set to 80 character. If a caller write… |
CVE-2025-38483 | High | 7.1 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: comedi: das16m1: Fix bit shift out of bounds When checking for a supported IRQ number, th… |
CVE-2025-38482 | High | 7.1 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: comedi: das6402: Fix bit shift out of bounds When checking for a supported IRQ number, th… |
CVE-2025-38481 | Medium | 5.5 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: comedi: Fail COMEDI_INSNLIST ioctl if n_insns is too large The handling of the `COMEDI_IN… |
CVE-2025-38480 | Medium | 5.5 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: comedi: Fix use of uninitialized data in insn_rw_emulate_bits() For Comedi `INSN_READ` an… |
CVE-2025-38478 | High | 7.8 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: comedi: Fix initialization of data for instructions that write to subdevice Some Comedi s… |
CVE-2025-38477 | High | 7.8 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_qfq: Fix race condition on qfq_aggregate A race condition can occur when '… |
CVE-2025-38476 | Critical | 9.8 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: rpl: Fix use-after-free in rpl_do_srh_inline(). Running lwt_dst_cache_ref_loop.sh in self… |
CVE-2025-38475 | High | 7.8 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: smc: Fix various oops due to inet_sock type confusion. syzbot reported weird splats [0][1… |
CVE-2025-38474 | Medium | 5.5 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: usb: net: sierra: check for no status endpoint The driver checks for having three endpoin… |
CVE-2025-38473 | Medium | 5.5 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix null-ptr-deref in l2cap_sock_resume_cb() syzbot reported null-ptr-deref in… |
CVE-2025-38472 | Critical | 9.8 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: fix crash due to removal of uninitialised entry A crash in connt… |
CVE-2025-38471 | Critical | 9.8 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: tls: always refresh the queue when reading sock After recent changes in net-next TCP comp… |
CVE-2025-38470 | High | 7.8 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime Assuming th… |
CVE-2025-38469 | Medium | 5.5 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86/xen: Fix cleanup logic in emulation of Xen schedop poll hypercalls kvm_xen_sched… |
CVE-2025-38468 | Medium | 5.5 | 2025-07-28 | In the Linux kernel, the following vulnerability has been resolved: net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree htb_lookup_leaf ha… |
CVE-2025-8273 | High | 7.3 | 2025-07-28 | A vulnerability classified as critical has been found in code-projects Exam Form Submission 1.0. Affected is an unknown function of the file /admin/update_s8.p… |
CVE-2025-8272 | High | 7.3 | 2025-07-28 | A vulnerability was found in code-projects Exam Form Submission 1.0. It has been rated as critical. This issue affects some unknown processing of the file /adm… |
CVE-2025-6918 | Critical | 9.8 | 2025-07-28 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ncvav Virtual PBX Software allows SQL Injection. This is… |
CVE-2025-40730 | | 2025-07-28 | HTML injection in Vox Media's Chorus CMS. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious… | |
CVE-2025-8271 | High | 7.3 | 2025-07-28 | A vulnerability was found in code-projects Exam Form Submission 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /adm… |
CVE-2025-8270 | High | 7.3 | 2025-07-28 | A vulnerability was found in code-projects Exam Form Submission 1.0. It has been classified as critical. This affects an unknown part of the file /admin/delete… |
CVE-2025-8269 | High | 7.3 | 2025-07-28 | A vulnerability was found in code-projects Exam Form Submission 1.0 and classified as critical. Affected by this issue is some unknown functionality of the fil… |