2025 CVEs (page 239)
Page 239 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8171 | Medium | 6.3 | 2025-07-25 | A vulnerability, which was classified as critical, has been found in code-projects Document Management System 1.0. This issue affects some unknown processing o… |
CVE-2025-8101 | | 2025-07-25 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability in Linkify (linkifyjs) allows XSS Targeting HTML Attrib… | |
CVE-2025-8170 | High | 8.8 | 2025-07-25 | A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748_B20211015. This vulnerability affects the function tcpcheck_net of the file /router… |
CVE-2025-8169 | High | 8.8 | 2025-07-25 | A vulnerability classified as critical has been found in D-Link DIR-513 1.10. This affects the function formSetWanPPTPcallback of the file /goform/formSetWanPP… |
CVE-2025-8168 | High | 8.8 | 2025-07-25 | A vulnerability was found in D-Link DIR-513 1.10. It has been rated as critical. Affected by this issue is the function websAspInit of the file /goform/formSet… |
CVE-2025-8167 | Low | 3.5 | 2025-07-25 | A vulnerability was found in code-projects Church Donation System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functi… |
CVE-2025-46198 | High | 8.8 | 2025-07-25 | Cross Site Scripting vulnerability in grav v.1.7.48, v.1.7.47 and v.1.7.46 allows an attacker to execute arbitrary code via the onerror attribute of the img el… |
CVE-2025-30135 | Critical | 9.4 | 2025-07-25 | An issue was discovered on IROAD Dashcam FX2 devices. Dumping Files Over HTTP and RTSP Without Authentication can occur. It lacks authentication controls on it… |
CVE-2025-8166 | High | 7.3 | 2025-07-25 | A vulnerability was found in code-projects Church Donation System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/i… |
CVE-2025-8165 | Medium | 6.3 | 2025-07-25 | A vulnerability was found in code-projects Food Review System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/app… |
CVE-2025-52455 | Medium | 5.3 | 2025-07-25 | Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (EPS Server modules) allows Resource Location Spoofing. This is… |
CVE-2025-52454 | High | 8.2 | 2025-07-25 | Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Amazon S3 Connector modules) allows Resource Location Spoofing… |
CVE-2025-52453 | High | 8.2 | 2025-07-25 | Server-Side Request Forgery (SSRF) vulnerability in Salesforce Tableau Server on Windows, Linux (Flow Data Source modules) allows Resource Location Spoofing. T… |
CVE-2025-52452 | High | 8.5 | 2025-07-25 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Salesforce Tableau Server on Windows, Linux (tabdoc api - dupli… |
CVE-2025-52449 | High | 8.5 | 2025-07-25 | Unrestricted Upload of File with Dangerous Type vulnerability in Salesforce Tableau Server on Windows, Linux (Extensible Protocol Service modules) allows Alter… |
CVE-2025-52448 | High | 8.1 | 2025-07-25 | Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (validate-initial-sql api modules) allows Interfa… |
CVE-2025-52447 | High | 8.1 | 2025-07-25 | Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (set-initial-sql tabdoc command modules) allows I… |
CVE-2025-52446 | High | 8.0 | 2025-07-25 | Authorization Bypass Through User-Controlled Key vulnerability in Salesforce Tableau Server on Windows, Linux (tab-doc api modules) allows Interface Manipulati… |
CVE-2025-8164 | Medium | 6.3 | 2025-07-25 | A vulnerability has been found in code-projects Public Chat Room 1.0 and classified as critical. This vulnerability affects unknown code of the file send_messa… |
CVE-2025-8163 | Medium | 6.3 | 2025-07-25 | A vulnerability, which was classified as critical, was found in deerwms deer-wms-2 up to 3.3. This affects an unknown part of the file /system/role/list. The m… |
CVE-2025-5449 | Medium | 6.5 | 2025-07-25 | A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow… |
CVE-2025-46199 | Critical | 9.8 | 2025-07-25 | Cross Site Scripting vulnerability in grav v.1.7.48 and before allows an attacker to execute arbitrary code via a crafted script to the form fields |
CVE-2025-8162 | Medium | 6.3 | 2025-07-25 | A vulnerability, which was classified as critical, has been found in deerwms deer-wms-2 up to 3.3. Affected by this issue is some unknown functionality of the… |
CVE-2025-8161 | Medium | 6.3 | 2025-07-25 | A vulnerability classified as critical was found in deerwms deer-wms-2 up to 3.3. Affected by this vulnerability is an unknown functionality of the file /syste… |
CVE-2025-54596 | Medium | 4.3 | 2025-07-25 | Abnormal Security /v1.0/rbac/users_v2/{USER_ID}/ before 2025-02-19 allows downgrading the privileges of other user accounts. |
CVE-2025-45960 | Medium | 6.1 | 2025-07-25 | Cross Site Scripting vulnerability in tawk.to Live Chat v.1.6.1 allows a remote attacker to execute arbitrary code via the web application stores and displays… |
CVE-2025-45893 | Medium | 6.1 | 2025-07-25 | OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts. The vulnerability arises because… |
CVE-2025-45892 | Medium | 6.1 | 2025-07-25 | OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via the blog editor. The vulnerability arises because input in the blog's… |
CVE-2025-45406 | Medium | 6.1 | 2025-07-25 | A stored cross-site scripting (XSS) vulnerability in CodeIgniter4 v4.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload inject… |
CVE-2025-36728 | Medium | 6.3 | 2025-07-25 | Cross-Site Request Forgery (CSRF) vulnerability in Simplehelp.This issue affects Simplehelp: before 5.5.11. |
CVE-2025-36727 | High | 8.3 | 2025-07-25 | Inclusion of Functionality from Untrusted Control Sphere vulnerability in Simplehelp.This issue affects Simplehelp: before 5.5.12. |
CVE-2025-29631 | Critical | 9.8 | 2025-07-25 | Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 allow command injection through… |
CVE-2025-29629 | Critical | 9.1 | 2025-07-25 | Gardyn Home Kit firmware before master.619, Home Kit Mobile Application before 2.11.0, and Home Kit Cloud API before 2.12.2026 use weak default credentials for… |
CVE-2025-29628 | Critical | 9.4 | 2025-07-25 | A Gardyn Azure IoT Hub connection string is downloaded over an insecure HTTP connection in Gardyn Home Kit firmware before master.619, Home Kit Mobile Applicat… |
CVE-2025-45466 | High | 8.8 | 2025-07-25 | Unitree Go1 <= Go1_2022_05_11 is vulnerale to Incorrect Access Control due to authentication credentials being hardcoded in plaintext. |
CVE-2025-3873 | | 2025-07-25 | The following APIs for the Silcon Labs SiWx91x prior to vesion 3.4.0 failed to check the size of the output buffer of the caller which could lead to data corru… | |
CVE-2025-3508 | Medium | 6.5 | 2025-07-25 | Certain HP DesignJet products may be vulnerable to information disclosure though printer's web interface allowing unauthenticated users to view sensitive print… |
CVE-2025-38467 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: drm/exynos: exynos7_drm_decon: add vblank check in IRQ handling If there's support for an… |
CVE-2025-38466 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: perf: Revert to requiring CAP_SYS_ADMIN for uprobes Jann reports that uprobes can be used… |
CVE-2025-38465 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: netlink: Fix wraparounds of sk->sk_rmem_alloc. Netlink has this pattern in some places … |
CVE-2025-38464 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free in tipc_conn_close(). syzbot reported a null-ptr-deref in tipc_c… |
CVE-2025-38463 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: tcp: Correct signedness in skb remaining space calculation Syzkaller reported a bug [1] w… |
CVE-2025-38462 | Medium | 4.7 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transport_{g2h,h2g} TOCTOU vsock_find_cid() and vsock_dev_do_ioctl() may race… |
CVE-2025-38461 | High | 7.0 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: vsock: Fix transport_* TOCTOU Transport assignment may race with module unload. Protect n… |
CVE-2025-38460 | High | 7.0 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix potential null-ptr-deref in to_atmarpd(). atmarpd is protected by RTNL sin… |
CVE-2025-38459 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix infinite recursive call of clip_push(). syzbot reported the splat below. [… |
CVE-2025-38458 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: atm: clip: Fix NULL pointer dereference in vcc_sendmsg() atmarpd_dev_ops does not impleme… |
CVE-2025-38457 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: net/sched: Abort __tc_modify_qdisc if parent class does not exist Lion's patch [1] reveal… |
CVE-2025-38456 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() The "intf" list it… |
CVE-2025-38455 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Reject SEV{-ES} intra host migration if vCPU creation is in-flight Reject migra… |
CVE-2025-38454 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: ALSA: ad1816a: Fix potential NULL pointer deref in snd_card_ad1816a_pnp() Use pr_warn() i… |
CVE-2025-38453 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: io_uring/msg_ring: ensure io_kiocb freeing is deferred for RCU syzbot reports that defer/… |
CVE-2025-38452 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: rtsn: Fix a null pointer dereference in rtsn_probe() Add check for the ret… |
CVE-2025-38451 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: md/md-bitmap: fix GPF in bitmap_get_stats() The commit message of commit 6ec1f0239485 ("m… |
CVE-2025-38450 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: prevent NULL pointer dereference in mt7925_sta_set_decap_offload() Ad… |
CVE-2025-38449 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: drm/gem: Acquire references on GEM handles for framebuffers A GEM handle can be released… |
CVE-2025-38448 | Medium | 4.7 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: usb: gadget: u_serial: Fix race condition in TTY wakeup A race condition occurs when gs_s… |
CVE-2025-38447 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: mm/rmap: fix potential out-of-bounds page table access during batched unmap As pointed ou… |
CVE-2025-38446 | High | 7.3 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data When num_parents is 4… |
CVE-2025-38445 | High | 7.1 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: md/raid1: Fix stack memory use after return in raid1_reshape In the raid1_reshape functio… |
CVE-2025-38444 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: raid10: cleanup memleak at raid10_make_request If raid10_read_request or raid10_write_req… |
CVE-2025-38443 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: nbd: fix uaf in nbd_genl_connect() error path There is a use-after-free issue in nbd: bl… |
CVE-2025-38442 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: block: reject bs > ps block devices when THP is disabled If THP is disabled and when a bl… |
CVE-2025-38441 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() syzbot found a… |
CVE-2025-38440 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix race between DIM disable and net_dim() There's a race between disabling DI… |
CVE-2025-38439 | Critical | 9.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT When transmitting an XDP_REDIRECT p… |
CVE-2025-38438 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Use devm_kstrdup() to avoid memleak. sof_pdata->tplg_filename can… |
CVE-2025-38437 | High | 8.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix potential use-after-free in oplock/lease break ack If ksmbd_iov_pin_rsp return… |
CVE-2025-34139 | | 2025-07-25 | A vulnerability exists in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud that could allow an unauthent… | |
CVE-2025-34136 | | 2025-07-25 | An SQL injection vulnerability exists in Commvault 11.32.0 - 11.32.93, 11.36.0 - 11.36.51, and 11.38.0 - 11.38.19 Web Server component that allows a remote, un… | |
CVE-2025-34114 | | 2025-07-25 | A client-side security misconfiguration vulnerability exists in OpenBlow whistleblowing platform across multiple versions and default deployments, due to the a… | |
CVE-2025-2329 | | 2025-07-25 | In high traffic environments, a Silicon Labs OpenThread RCP (see impacted versions) fails to clear the SPI transmit buffer and may send a corrupt packet over S… | |
CVE-2025-8160 | High | 8.8 | 2025-07-25 | A vulnerability classified as critical has been found in Tenda AC20 up to 16.03.08.12. Affected is an unknown function of the file /goform/SetSysTimeCfg of the… |
CVE-2025-8159 | High | 8.8 | 2025-07-25 | A vulnerability was found in D-Link DIR-513 1.0. It has been rated as critical. This issue affects the function formLanguageChange of the file /goform/formLang… |
CVE-2025-52360 | High | 8.8 | 2025-07-25 | A Cross-Site Scripting (XSS) vulnerability exists in the OPAC search feature of Koha Library Management System v24.05. Unsanitized input entered in the search… |
CVE-2025-45467 | High | 7.1 | 2025-07-25 | Unitree Go1 <= Go1_2022_05_11 is vulnerable to Insecure Permissions as the firmware update functionality (via Wi-Fi/Ethernet) implements an insecure verificati… |
CVE-2025-44608 | Medium | 6.5 | 2025-07-25 | CloudClassroom-PHP Project v1.0 was discovered to contain a SQL injection vulnerability via the viewid parameter. |
CVE-2025-38436 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: drm/scheduler: signal scheduled fence when kill job When an entity from application B is… |
CVE-2025-38435 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: riscv: vector: Fix context save/restore with xtheadvector Previously only v0-v7 were corr… |
CVE-2025-38434 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: Revert "riscv: Define TASK_SIZE_MAX for __access_ok()" This reverts commit ad5643cf2f69 (… |
CVE-2025-38433 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: riscv: fix runtime constant support for nommu kernels the `__runtime_fixup_32` function d… |
CVE-2025-38432 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: net: netpoll: Initialize UDP checksum field before checksumming commit f1fce08e63fe ("net… |
CVE-2025-38431 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix regression with native SMB symlinks Some users and customers reported th… |
CVE-2025-38430 | Critical | 9.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request If the request bein… |
CVE-2025-38429 | Critical | 10.0 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: bus: mhi: ep: Update read pointer only after buffer is written Inside mhi_ep_ring_add_ele… |
CVE-2025-38428 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: Input: ims-pcu - check record size in ims_pcu_flash_firmware() The "len" variable comes f… |
CVE-2025-38427 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: video: screen_info: Relocate framebuffers behind PCI bridges Apply PCI host-bridge window… |
CVE-2025-38426 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Add basic validation for RAS header If RAS header read from EEPROM is corrupt… |
CVE-2025-38425 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: i2c: tegra: check msg length in SMBUS block read For SMBUS block read, do not continue to… |
CVE-2025-38424 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: perf: Fix sample vs do_exit() Baisheng Gao reported an ARM64 crash, which Mark decoded as… |
CVE-2025-38423 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: wcd9375: Fix double free of regulator supplies Driver gets regulator suppli… |
CVE-2025-38422 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: net: lan743x: Modify the EEPROM and OTP size for PCI1xxxx devices Maximum OTP and EEPROM… |
CVE-2025-38421 | High | 7.8 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd: pmf: Use device managed allocations If setting up smart PC fails for an… |
CVE-2025-38420 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: wifi: carl9170: do not ping device which has failed to load firmware Syzkaller reports [1… |
CVE-2025-30086 | Medium | 4.9 | 2025-07-25 | CNCF Harbor 2.13.x before 2.13.1 and 2.12.x before 2.12.4 allows information disclosure by administrators who can exploit an ORM Leak present in the /api/v2.0/… |
CVE-2025-8158 | Medium | 6.3 | 2025-07-25 | A vulnerability was found in PHPGurukul Login and User Management System 3.3. It has been declared as critical. This vulnerability affects unknown code of the… |
CVE-2025-45939 | Medium | 6.5 | 2025-07-25 | Apwide Golive 10.2.0 Jira plugin allows Server-Side Request Forgery (SSRF) via the test webhook function. |
CVE-2025-45777 | Critical | 9.8 | 2025-07-25 | An issue in the OTP mechanism of Chavara Family Welfare Centre Chavara Matrimony Site v2.0 allows attackers to bypass authentication via supplying a crafted re… |
CVE-2025-38419 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Cleanup acquired resources when rproc_handle_resources() fails in rproc_… |
CVE-2025-38418 | Medium | 5.5 | 2025-07-25 | In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Release rproc->clean_table after rproc_attach() fails When rproc->state… |