2025 CVEs (page 241)
Page 241 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-54379 | Critical | 9.8 | 2025-07-24 | LF Edge eKuiper is a lightweight IoT data analytics and stream processing engine running on resource-constraint edge devices. In versions before 2.2.1, there i… |
CVE-2025-54369 | | 2025-07-24 | Node-SAML is a SAML library not dependent on any frameworks that runs in Node. In versions 5.0.1 and below, Node-SAML loads the assertion from the (unsigned) o… | |
CVE-2025-53940 | | 2025-07-24 | Quiet is an alternative to team chat apps like Slack, Discord, and Element that does not require trusting a central server or running one's own. In versions 6… | |
CVE-2025-3614 | Medium | 6.4 | 2025-07-24 | The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of a custom widget in al… |
CVE-2025-32429 | Critical | 9.8 | 2025-07-24 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0.0-rc-1 t… |
CVE-2025-22165 | High | 7.3 | 2025-07-24 | This Medium severity ACE (Arbitrary Code Execution) vulnerability was introduced in version 4.2.8 of Sourcetree for Mac. This ACE (Arbitrary Code Execution) v… |
CVE-2025-8123 | Medium | 6.3 | 2025-07-24 | A vulnerability was found in deerwms deer-wms-2 up to 3.3. It has been classified as critical. Affected is an unknown function of the file /system/dept/edit. T… |
CVE-2025-7404 | Critical | 9.8 | 2025-07-24 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS Command In… |
CVE-2025-6260 | Critical | 9.8 | 2025-07-24 | The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network… |
CVE-2025-31955 | High | 7.6 | 2025-07-24 | HCL iAutomate is affected by a sensitive data exposure vulnerability. This issue may allow unauthorized access to sensitive information within the system. |
CVE-2025-31953 | High | 7.1 | 2025-07-24 | HCL iAutomate includes hardcoded credentials which may result in potential exposure of confidential data if intercepted or accessed by unauthorized parties. |
CVE-2025-31952 | High | 7.1 | 2025-07-24 | HCL iAutomate is affected by an insufficient session expiration. This allows tokens to remain valid indefinitely unless manually revoked, increasing the risk… |
CVE-2025-6998 | | 2025-07-24 | ReDoS in strip_whitespaces() function in cps/string_helper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to cause denial of service… | |
CVE-2025-8115 | Low | 3.5 | 2025-07-24 | A vulnerability has been found in PHPGurukul Taxi Stand Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown funct… |
CVE-2025-5039 | High | 7.8 | 2025-07-24 | A maliciously crafted binary file, when present while loading files in certain Autodesk applications, could lead to execution of arbitrary code in the context… |
CVE-2025-45702 | Medium | 6.5 | 2025-07-24 | SoftPerfect Pty Ltd Connection Quality Monitor v1.1 was discovered to store all credentials in plaintext. |
CVE-2025-53084 | Critical | 9.0 | 2025-07-24 | A cross-site scripting (xss) vulnerability exists in the videosList page parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A speciall… |
CVE-2025-50128 | Critical | 9.6 | 2025-07-24 | A cross-site scripting (xss) vulnerability exists in the videoNotFound 404ErrorMsg parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff… |
CVE-2025-48732 | High | 7.3 | 2025-07-24 | An incomplete blacklist exists in the .htaccess sample of WWBN AVideo 14.4 and dev master commit 8a8954ff. A specially crafted HTTP request can lead to a arbit… |
CVE-2025-47061 | Medium | 5.4 | 2025-07-24 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-46996 | Medium | 5.4 | 2025-07-24 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-46993 | Medium | 5.4 | 2025-07-24 | Adobe Experience Manager versions 6.5.22 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-46410 | Critical | 9.6 | 2025-07-24 | A cross-site scripting (xss) vulnerability exists in the managerPlaylists PlaylistOwnerUsersId parameter functionality of WWBN AVideo 14.4 and dev master commi… |
CVE-2025-41420 | Critical | 9.6 | 2025-07-24 | A cross-site scripting (xss) vulnerability exists in the userLogin cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A spec… |
CVE-2025-36548 | High | 8.3 | 2025-07-24 | A cross-site scripting (xss) vulnerability exists in the LoginWordPress loginForm cancelUri parameter functionality of WWBN AVideo 14.4 and dev master commit 8… |
CVE-2025-25214 | High | 8.8 | 2025-07-24 | A race condition vulnerability exists in the aVideoEncoder.json.php unzip functionality of WWBN AVideo 14.4 and dev master commit 8a8954ff. A series of special… |
CVE-2025-8114 | Medium | 4.7 | 2025-07-24 | A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation fa… |
CVE-2025-51089 | Medium | 6.5 | 2025-07-24 | Tenda AC8V4 V16.03.34.06` was discovered to contain heap overflow at /goform/GetParentControlInfo.The manipulation of the argument `mac` leads to heap-based bu… |
CVE-2025-51088 | Medium | 5.3 | 2025-07-24 | Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/WifiGuestSet. The manipulation of the argument `shareSpeed` leads to stack-based… |
CVE-2025-51087 | High | 8.6 | 2025-07-24 | Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/saveParentControlInfo. The manipulation of the argument time leads to stack-based… |
CVE-2025-51085 | Medium | 5.3 | 2025-07-24 | Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/SetSysTimeCfg. The manipulation of the argument `timeZone` and `timeType` leads t… |
CVE-2025-51082 | Medium | 5.3 | 2025-07-24 | Tenda AC8V4 V16.03.34.06` was discovered to contain stack overflow at /goform/fast_setting_wifi_set. The manipulation of the argument `timeZone` leads to stack… |
CVE-2025-36005 | Medium | 5.9 | 2025-07-24 | IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0… |
CVE-2025-33109 | High | 7.5 | 2025-07-24 | IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 is vulnerable to a privilege escalation caused by an invalid database authority check. A bad actor could execute a database… |
CVE-2025-33013 | Medium | 6.2 | 2025-07-24 | IBM MQ Operator LTS 2.0.0 through 2.0.29, MQ Operator CD 3.0.0, 3.0.1, 3.1.0 through 3.1.3, 3.3.0, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, and MQ Operator SC2 3.2.0… |
CVE-2025-4784 | Critical | 9.8 | 2025-07-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Moderec Tourtella allows SQL Injection. This issue affec… |
CVE-2025-45731 | Medium | 6.5 | 2025-07-24 | A group deletion race condition in 2FAuth v5.5.0 causes data inconsistencies and orphaned accounts when a group is deleted while other operations are pending. |
CVE-2025-5243 | Critical | 10.0 | 2025-07-24 | Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SM… |
CVE-2025-4822 | Critical | 9.8 | 2025-07-24 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Bayraktar Solar Energies ScadaWatt Otopilot allows SQL In… |
CVE-2025-40680 | | 2025-07-24 | Lack of sensitive data encryption in CapillaryScope v2.5.0 of Capillary io, which stores both the proxy credentials and the JWT session token in plain text wit… | |
CVE-2025-8071 | Medium | 6.4 | 2025-07-24 | Mine CloudVod plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘audio’ parameter in all versions up to, and including, 2.1.10 due to i… |
CVE-2025-7966 | Medium | 6.4 | 2025-07-24 | The Get Youtube Subs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘channel', 'layout', and 'subs_count’ parameters in all versions… |
CVE-2025-7959 | Medium | 6.4 | 2025-07-24 | The Station Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width' and 'height’ parameter in all versions up to, and including… |
CVE-2025-7835 | Medium | 4.3 | 2025-07-24 | The iThoughts Advanced Code Editor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.2.10. This is due t… |
CVE-2025-7822 | Medium | 4.3 | 2025-07-24 | The WP Wallcreeper plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_notices hook in all v… |
CVE-2025-7780 | Medium | 6.5 | 2025-07-24 | The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.9.4. The simpleTranscribeAudio endpo… |
CVE-2025-7695 | High | 8.8 | 2025-07-24 | The Dataverse Integration plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within its reset_password_link REST en… |
CVE-2025-7690 | Medium | 6.1 | 2025-07-24 | The Affiliate Plus plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.2. This is due to missing or inco… |
CVE-2025-7640 | High | 8.1 | 2025-07-24 | The hiWeb Export Posts plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.9.0.0. This is due to missing o… |
CVE-2025-6588 | Medium | 6.1 | 2025-07-24 | The FunnelCockpit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘error’ parameter in all versions up to, and including, 1.4.3 du… |
CVE-2025-6539 | Medium | 6.4 | 2025-07-24 | The Voltax Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.6.5 du… |
CVE-2025-6441 | Critical | 9.8 | 2025-07-24 | The Webinar Solution: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings | WebinarIgnition plugin for WordPress is vulnerable to unauthen… |
CVE-2025-6387 | Medium | 6.4 | 2025-07-24 | The WP Get The Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.5 due to… |
CVE-2025-6385 | Medium | 6.4 | 2025-07-24 | The WP Applink plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘title’ parameter in all versions up to, and including, 0.4.1 due to i… |
CVE-2025-6382 | Medium | 6.4 | 2025-07-24 | The Taeggie Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's taeggie-feed shortcode in all versions up to, and including… |
CVE-2025-6380 | Critical | 9.8 | 2025-07-24 | The ONLYOFFICE Docs plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its oo.callback REST endpoint in versions 1… |
CVE-2025-6262 | Medium | 6.4 | 2025-07-24 | The muse.ai video embedding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's muse-ai shortcode in all versions up to, and inc… |
CVE-2025-5084 | Medium | 6.1 | 2025-07-24 | The Post Grid Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘argsArray['read_more_text']’ parameter in all versions up to… |
CVE-2025-4608 | Medium | 6.4 | 2025-07-24 | The Structured Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sc_fs_local_business shortcode in all versions up to… |
CVE-2025-3669 | Medium | 6.4 | 2025-07-24 | The Supreme Addons for Beaver Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's auto_qrcodesabb shortcode in all versi… |
CVE-2025-8107 | Medium | 6.3 | 2025-07-24 | In OceanBase's Oracle tenant mode, a malicious user with specific privileges can achieve privilege escalation to SYS-level access by executing carefully crafte… |
CVE-2025-8009 | Medium | 4.9 | 2025-07-24 | The Security Ninja – WordPress Security Plugin & Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 5.242… |
CVE-2025-7745 | Medium | 5.8 | 2025-07-24 | Buffer Over-read vulnerability in ABB AC500 V2.This issue affects AC500 V2: through 2.5.2. |
CVE-2025-26397 | High | 7.8 | 2025-07-24 | SolarWinds Observability Self-Hosted is susceptible to Deserialization of Untrusted Data Local Privilege Escalation vulnerability. An attacker with low privile… |
CVE-2025-7852 | Critical | 9.8 | 2025-07-24 | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via… |
CVE-2025-7437 | Critical | 9.8 | 2025-07-24 | The Ebook Store plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ebook_store_save_form function in all v… |
CVE-2025-7001 | Medium | 4.3 | 2025-07-24 | An issue has been discovered in GitLab CE/EE affecting all versions from 15.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed… |
CVE-2025-4976 | Medium | 4.3 | 2025-07-24 | An issue has been discovered in GitLab EE affecting all versions from 17.0 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under certain circum… |
CVE-2025-4968 | Medium | 6.4 | 2025-07-24 | The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Page Builder elements (Copyright Element… |
CVE-2025-4395 | Medium | 6.8 | 2025-07-24 | Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with physical access to log in with no passwo… |
CVE-2025-4394 | Medium | 6.8 | 2025-07-24 | Medtronic MyCareLink Patient Monitor uses an unencrypted filesystem on internal storage, which allows an attacker with physical access to read and modify files… |
CVE-2025-4393 | Medium | 6.5 | 2025-07-24 | Medtronic MyCareLink Patient Monitor has an internal service that deserializes data, which allows a local attacker to interact with the service by crafting a b… |
CVE-2025-41240 | Critical | 10.0 | 2025-07-24 | Three Bitnami Helm charts mount Kubernetes Secrets under a predictable path (/opt/bitnami/*/secrets) that is located within the web server document root. In af… |
CVE-2025-1299 | Medium | 4.3 | 2025-07-24 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 18.0.5, all versions starting from 18.1 before 18.1.3, all versio… |
CVE-2025-0765 | Medium | 4.3 | 2025-07-24 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowed… |
CVE-2025-54365 | High | 7.5 | 2025-07-23 | fastapi-guard is a security library for FastAPI that provides middleware to control IPs, log requests, detect penetration attempts and more. In version 3.0.1… |
CVE-2025-54377 | High | 7.8 | 2025-07-23 | Roo Code is an AI-powered autonomous coding agent that lives in users' editors. In versions 3.23.18 and below, RooCode does not validate line breaks (\n) in it… |
CVE-2025-53942 | High | 7.4 | 2025-07-23 | authentik is an open-source Identity Provider that emphasizes flexibility and versatility, with support for a wide set of protocols. In versions 2025.4.4 and e… |
CVE-2025-53537 | High | 7.5 | 2025-07-23 | LibHTP is a security-aware parser for the HTTP protocol and its related bits and pieces. In versions 0.5.50 and below, there is a traffic-induced memory leak t… |
CVE-2025-47281 | High | 7.7 | 2025-07-23 | Kyverno is a policy engine designed for cloud native platform engineering teams. In versions 1.14.1 and below, a Denial of Service (DoS) vulnerability exists d… |
CVE-2025-32019 | Medium | 4.1 | 2025-07-23 | Harbor is an open source trusted cloud native registry project that stores, signs, and scans content. Versions 2.11.2 and below, as well as versions 2.12.0-rc1… |
CVE-2025-8058 | | 2025-07-23 | The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished eith… | |
CVE-2025-44109 | Medium | 5.4 | 2025-07-23 | A URL redirection in Pinokio v3.6.23 allows attackers to redirect victim users to attacker-controlled pages. |
CVE-2025-50477 | Medium | 5.4 | 2025-07-23 | A URL redirection in lbry-desktop v0.53.9 allows attackers to redirect victim users to attacker-controlled pages. |
CVE-2025-47187 | High | 7.5 | 2025-07-23 | A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4… |
CVE-2025-46686 | Low | 3.5 | 2025-07-23 | Redis through 8.0.3 allows memory consumption via a multi-bulk command composed of many bulks, sent by an authenticated user. This occurs because the server al… |
CVE-2025-4700 | High | 8.7 | 2025-07-23 | An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that, under specific c… |
CVE-2025-4439 | High | 7.7 | 2025-07-23 | An issue has been discovered in GitLab CE/EE affecting all versions from 15.10 before 18.0.5, 18.1 before 18.1.3, and 18.2 before 18.2.1 that could have allowe… |
CVE-2025-8069 | High | 7.8 | 2025-07-23 | During the AWS Client VPN client installation on Windows devices, the install process references the C:\usr\local\windows-x86_64-openssl-localbuild\ssl directo… |
CVE-2025-50481 | Medium | 4.8 | 2025-07-23 | A cross-site scripting (XSS) vulnerability in the component /blog/blogpost/add of Mezzanine CMS v6.1.0 allows attackers to execute arbitrary web scripts or HTM… |
CVE-2025-46171 | Medium | 5.4 | 2025-07-23 | vBulletin 3.8.7 is vulnerable to a denial-of-service condition via the misc.php?do=buddylist endpoint. If an authenticated user has a sufficiently large buddy… |
CVE-2025-2634 | High | 7.8 | 2025-07-23 | Out of bounds read vulnerability due to improper bounds checking in NI LabVIEW in fontmgr may result in information disclosure or arbitrary code execution. Su… |
CVE-2025-2633 | High | 7.8 | 2025-07-23 | Out of bounds read vulnerability due to improper bounds checking in NI LabVIEW in lvre!UDecStrToNum that may result in information disclosure or arbitrary code… |
CVE-2025-6018 | High | 7.8 | 2025-07-23 | A Local Privilege Escalation (LPE) vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules (PAM). This flaw allows an unp… |
CVE-2025-40598 | Medium | 6.1 | 2025-07-23 | A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker to potentially execu… |
CVE-2025-40597 | High | 7.5 | 2025-07-23 | A Heap-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or poten… |
CVE-2025-40596 | High | 7.3 | 2025-07-23 | A Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or pote… |
CVE-2025-36117 | Medium | 6.3 | 2025-07-23 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 does not disallow the session id after use which could allow an authenticated user to impersonate another user on the sy… |
CVE-2025-36116 | Medium | 6.3 | 2025-07-23 | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 GUI is affected by cross-site WebSocket hijacking vulnerability. By sending a specially crafted request, an unauthentic… |
CVE-2025-33077 | High | 8.8 | 2025-07-23 | IBM Engineering Systems Design Rhapsody 9.0.2, 10.0, and 10.0.1 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local use… |