2025 CVEs (page 243)
Page 243 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-51471 | Medium | 6.9 | 2025-07-22 | Cross-Domain Token Exposure in server.auth.getAuthorizationToken in Ollama 0.6.7 allows remote attackers to steal authentication tokens and bypass access contr… |
CVE-2025-51459 | Medium | 6.5 | 2025-07-22 | File Upload vulnerability in agent.hub.controller.refresh_plugins in eosphoros-ai DB-GPT 0.7.0 allows remote attackers to execute arbitrary code via a maliciou… |
CVE-2025-51464 | High | 8.8 | 2025-07-22 | Cross-site Scripting (XSS) in aimhubio Aim 3.28.0 allows remote attackers to execute arbitrary JavaScript in victims browsers via malicious Python code submitt… |
CVE-2025-48964 | Medium | 6.5 | 2025-07-22 | ping in iputils before 20250602 allows a denial of service (application error in adaptive ping mode or incorrect data collection) via a crafted ICMP Echo Reply… |
CVE-2025-6741 | High | 7.7 | 2025-07-22 | Improper access control in secure message component in Devolutions Server allows an authenticated user to steal unauthorized entries via the secure message ent… |
CVE-2025-6523 | High | 7.7 | 2025-07-22 | Use of weak credentials in emergency authentication component in Devolutions Server allows an unauthenticated attacker to bypass authentication via brute forci… |
CVE-2025-51482 | High | 8.8 | 2025-07-22 | Remote Code Execution in letta.server.rest_api.routers.v1.tools.run_tool_from_source in letta-ai Letta 0.7.12 allows remote attackers to execute arbitrary Pyth… |
CVE-2025-51481 | Medium | 6.6 | 2025-07-22 | Local File Inclusion in dagster._grpc.impl.get_notebook_data in Dagster 1.10.14 allows attackers with access to the gRPC server to read arbitrary files by supp… |
CVE-2025-8019 | High | 8.8 | 2025-07-22 | A vulnerability was found in Shenzhen Libituo Technology LBT-T300-T310 2.2.3.6. It has been rated as critical. Affected by this issue is the function sub_40B6F… |
CVE-2025-7371 | Medium | 6.8 | 2025-07-22 | Okta On-Premises Provisioning (OPP) agents log certain user data during administrator-initiated password resets. This vulnerability allows an attacker with acc… |
CVE-2025-5042 | High | 7.8 | 2025-07-22 | A maliciously crafted RFA file, when parsed through Autodesk Revit, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage this vulnerab… |
CVE-2025-51480 | High | 8.8 | 2025-07-22 | Path Traversal vulnerability in onnx.external_data_helper.save_external_data in ONNX 1.17.0 allows attackers to overwrite arbitrary files by supplying crafted… |
CVE-2025-51463 | High | 7.0 | 2025-07-22 | Path Traversal in restore_run_backup() in AIM 3.28.0 allows remote attackers to write arbitrary files to the server's filesystem via a crafted backup tar file… |
CVE-2025-48498 | High | 7.5 | 2025-07-22 | A null pointer dereference vulnerability exists in the Distributed Transaction component of Bloomberg Comdb2 8.1 when processing a number of fields used for co… |
CVE-2025-46354 | High | 7.5 | 2025-07-22 | A denial of service vulnerability exists in the Distributed Transaction Commit/Abort Operation functionality of Bloomberg Comdb2 8.1. A specially crafted netwo… |
CVE-2025-36520 | High | 7.5 | 2025-07-22 | A null pointer dereference vulnerability exists in the net_connectmsg Protocol Buffer Message functionality of Bloomberg Comdb2 8.1. A specially crafted networ… |
CVE-2025-36512 | High | 7.5 | 2025-07-22 | A denial of service vulnerability exists in the Bloomberg Comdb2 8.1 database when handling a distributed transaction heartbeat. A specially crafted protocol b… |
CVE-2025-35966 | High | 7.5 | 2025-07-22 | A null pointer dereference vulnerability exists in the CDB2SQLQUERY protocol buffer message handling of Bloomberg Comdb2 8.1. A specially crafted protocol buff… |
CVE-2025-8018 | Medium | 6.3 | 2025-07-22 | A vulnerability was found in code-projects Food Ordering Review System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown func… |
CVE-2025-8015 | Medium | 6.4 | 2025-07-22 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded image's 'Title' and 'Slide lin… |
CVE-2025-51865 | High | 8.8 | 2025-07-22 | Ai2 playground web service (playground.allenai.org) LLM chat through 2025-06-03 is vulnerable to Insecure Direct Object Reference (IDOR), allowing attackers to… |
CVE-2025-51864 | Medium | 6.5 | 2025-07-22 | A reflected cross-site scripting (XSS) vulnerability exists in AIBOX LLM chat (chat.aibox365.cn) through 2025-05-27, allowing attackers to hijack accounts thro… |
CVE-2025-51863 | Medium | 6.1 | 2025-07-22 | Self Cross Site Scripting (XSS) vulnerability in ChatGPT Unli (ChatGPTUnli.com) thru 2025-05-26 allows attackers to execute arbitrary code via a crafted SVG fi… |
CVE-2025-51862 | Medium | 6.1 | 2025-07-22 | Insecure Direct Object Reference (IDOR) vulnerability in TelegAI (telegai.com) thru 2025-05-26 in its chat component. An attacker can exploit this IDOR to tamp… |
CVE-2025-51860 | Medium | 6.1 | 2025-07-22 | Stored Cross-Site Scripting (XSS) in TelegAI (telegai.com) 2025-05-26 in its chat component and character container component. An attacker can achieve arbitrar… |
CVE-2025-51859 | Medium | 6.5 | 2025-07-22 | Stored Cross-Site Scripting (XSS) vulnerability in Chaindesk thru 2025-05-26 in its agent chat component. An attacker can achieve arbitrary client-side script… |
CVE-2025-51858 | Medium | 6.1 | 2025-07-22 | Self Cross-Site Scripting (XSS) vulnerability in ChatPlayground.ai through 2025-05-24, allows attackers to execute arbitrary code and gain sensitive informatio… |
CVE-2025-4878 | Low | 3.6 | 2025-07-22 | A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be t… |
CVE-2025-8017 | High | 8.8 | 2025-07-22 | A vulnerability was found in Tenda AC7 15.03.06.44. It has been classified as critical. Affected is the function formSetMacFilterCfg of the file /goform/setMac… |
CVE-2025-51867 | Medium | 6.5 | 2025-07-22 | Insecure Direct Object Reference (IDOR) vulnerability in Deepfiction AI (deepfiction.ai) thru June 3, 2025, allowing attackers to chat with the LLM using other… |
CVE-2025-4295 | Medium | 4.6 | 2025-07-22 | Improper Validation of Certificate with Host Mismatch vulnerability in HotelRunner B2B allows HTTP Response Splitting. This issue affects B2B: before 04.06.20… |
CVE-2025-4294 | Medium | 4.8 | 2025-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HotelRunner B2B allows Cross-Site Scripting (XSS)… |
CVE-2025-34143 | | 2025-07-22 | An authentication bypass vulnerability exists in ETQ Reliance on the CG (legacy) platform. The application allowed login as the privileged internal SYSTEM user… | |
CVE-2025-34142 | | 2025-07-22 | An XML External Entity (XXE) injection vulnerability exists in ETQ Reliance on the CG (legacy) platform within the `/resources/sessions/sso` endpoint. The SAML… | |
CVE-2025-34141 | | 2025-07-22 | A reflected cross-site scripting (XSS) vulnerability exists in ETQ Reliance CG (legacy) platform within the `SQLConverterServlet` component. This vulnerability… | |
CVE-2025-34140 | | 2025-07-22 | An authorization bypass vulnerability exists in ETQ Reliance (legacy CG and NXG SaaS platforms). By appending a specific URI suffix to certain API endpoints, a… | |
CVE-2025-7705 | Medium | 6.8 | 2025-07-22 | : Active Debug Code vulnerability in ABB Switch Actuator 4 DU-83330, ABB Switch actuator, door/light 4 DU -83330-500.This issue affects Switch Actuator 4 DU-83… |
CVE-2025-4285 | Critical | 10.0 | 2025-07-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rolantis Information Technologies Agentis allows SQL Inje… |
CVE-2025-4284 | Medium | 6.1 | 2025-07-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Rolantis Information Technologies Agentis allows R… |
CVE-2025-7900 | Medium | 6.5 | 2025-07-22 | The femanager extension for TYPO3 allows Insecure Direct Object Reference resulting in unauthorized modification of userdata. This issue affects femanager vers… |
CVE-2025-7899 | | 2025-07-22 | The powermail extension for TYPO3 allows Insecure Direct Object Reference resulting in download of arbitrary files from the webserver. This issue affects power… | |
CVE-2025-7692 | High | 8.1 | 2025-07-22 | The Orion Login with SMS plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.5. This is due to the olws_handl… |
CVE-2025-7687 | Medium | 6.1 | 2025-07-22 | The Latest Post Accordian Slider plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to mis… |
CVE-2025-7685 | Medium | 6.1 | 2025-07-22 | The Like & Share My Site plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2. This is due to missing or… |
CVE-2025-7427 | Medium | 5.9 | 2025-07-22 | Uncontrolled Search Path Element in Arm Development Studio before 2025 may allow an attacker to perform a DLL hijacking attack. Successful exploitation could l… |
CVE-2025-6213 | High | 7.2 | 2025-07-22 | The Nginx Cache Purge Preload plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.1.1 via the 'nppp_preload_cac… |
CVE-2025-6187 | Critical | 9.8 | 2025-07-22 | The bSecure plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization within its order_info REST endpoint in versions 1.3.7 throu… |
CVE-2025-6082 | Medium | 5.3 | 2025-07-22 | The Birth Chart Compatibility plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 2.0. This is due to insufficient… |
CVE-2025-53472 | High | 7.2 | 2025-07-22 | WRC-BE36QS-B and WRC-W701-B contain an improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in WebGUI. If e… |
CVE-2025-46267 | Medium | 4.9 | 2025-07-22 | Hidden functionality issue exists in WRC-BE36QS-B and WRC-W701-B. If exploited, the product's hidden debug function may be enabled by a remote attacker who can… |
CVE-2025-38352 | High | 7.8 | 2025-07-22 | In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If… |
CVE-2025-7645 | High | 8.1 | 2025-07-22 | The Extensions For CF7 (Contact form 7 Database, Conditional Fields and Redirection) plugin for WordPress is vulnerable to arbitrary file deletion due to insuf… |
CVE-2025-7644 | Medium | 6.4 | 2025-07-22 | The Pixel Gallery Addons for Elementor – Easy Grid, Creative Gallery, Drag and Drop Grid, Custom Grid Layout, Portfolio Gallery plugin for WordPress is vulnera… |
CVE-2025-7495 | Medium | 6.4 | 2025-07-22 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpmem_login_link' shortcode in all version… |
CVE-2025-6585 | High | 8.1 | 2025-07-22 | The WP JobHunt plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.2 via the cs_remove_profile_callb… |
CVE-2025-52580 | Low | 2.4 | 2025-07-22 | Insertion of sensitive information into log file issue exists in "region PAY" App for Android prior to 1.5.28. If exploited, sensitive user information may be… |
CVE-2025-7953 | Low | 3.5 | 2025-07-22 | A vulnerability, which was classified as problematic, has been found in Sanluan PublicCMS up to 5.202506.a. This issue affects some unknown processing of the f… |
CVE-2025-7952 | Medium | 6.3 | 2025-07-22 | A vulnerability classified as critical was found in TOTOLINK T6 4.1.5cu.748. This vulnerability affects the function ckeckKeepAlive of the file wireless.so of… |
CVE-2025-7951 | Low | 3.5 | 2025-07-22 | A vulnerability classified as problematic has been found in code-projects Public Chat Room 1.0. This affects an unknown part of the file /send_message.php. The… |
CVE-2025-7950 | High | 7.3 | 2025-07-22 | A vulnerability was found in code-projects Public Chat Room 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the fil… |
CVE-2025-7949 | Low | 3.5 | 2025-07-22 | A vulnerability was found in Sanluan PublicCMS up to 5.202506.a. It has been declared as problematic. Affected by this vulnerability is an unknown functionalit… |
CVE-2025-6831 | Medium | 6.4 | 2025-07-22 | The User Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's urcr_restrict shortcode in all versions up to, and inc… |
CVE-2025-5240 | Medium | 6.4 | 2025-07-22 | The CRM and Lead Management by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and incl… |
CVE-2025-7948 | Medium | 4.3 | 2025-07-22 | A vulnerability classified as problematic was found in jshERP up to 3.5. Affected by this vulnerability is an unknown functionality of the file /jshERP-boot/us… |
CVE-2025-7947 | Medium | 5.4 | 2025-07-22 | A vulnerability classified as critical has been found in jshERP up to 3.5. Affected is an unknown function of the file /user/delete of the component Account Ha… |
CVE-2025-7946 | Medium | 4.3 | 2025-07-22 | A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been rated as problematic. This issue affects some unknown processing… |
CVE-2025-7945 | High | 8.8 | 2025-07-22 | A vulnerability was found in D-Link DIR-513 up to 20190831. It has been declared as critical. This vulnerability affects the function formSetWanDhcpplus of the… |
CVE-2025-7944 | Medium | 4.3 | 2025-07-21 | A vulnerability was found in PHPGurukul Taxi Stand Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /sear… |
CVE-2025-7943 | Medium | 4.3 | 2025-07-21 | A vulnerability was found in PHPGurukul Taxi Stand Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of… |
CVE-2025-7486 | Medium | 4.4 | 2025-07-21 | The Ebook Store plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Order Details in all versions up to, and including, 5.8012 due to ins… |
CVE-2025-7942 | Low | 3.5 | 2025-07-21 | A vulnerability has been found in PHPGurukul Taxi Stand Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown funct… |
CVE-2025-7941 | Low | 3.5 | 2025-07-21 | A vulnerability, which was classified as problematic, was found in PHPGurukul Time Table Generator System 1.0. Affected is an unknown function of the file /adm… |
CVE-2025-7940 | Medium | 5.3 | 2025-07-21 | A vulnerability was found in Genshin Albedo Cat House App 1.0.2 on Android. It has been declared as problematic. Affected by this vulnerability is an unknown f… |
CVE-2025-7939 | Medium | 6.3 | 2025-07-21 | A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0. It has been classified as critical. Affected is the function addGoods of the file GoodsCo… |
CVE-2025-54134 | Medium | 6.5 | 2025-07-21 | HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.8 and below, the HAX CMS NodeJS application crashes when… |
CVE-2025-54129 | Medium | 4.3 | 2025-07-21 | HAXiam is a packaging wrapper for HAXcms which allows anyone to spawn their own microsite management platform. In versions 11.0.4 and below, the application re… |
CVE-2025-54128 | Medium | 6.1 | 2025-07-21 | HAX CMS NodeJs allows users to manage their microsite universe with a NodeJs backend. In versions 11.0.7 and below, the NodeJS version of HAX CMS has a disable… |
CVE-2025-54127 | Critical | 9.8 | 2025-07-21 | HAXcms with nodejs backend allows users to start the server in any HAXsite or HAXcms instance. In versions 11.0.6 and below, the NodeJS version of HAXcms uses… |
CVE-2025-54122 | Critical | 10.0 | 2025-07-21 | Manager-io/Manager is accounting software. A critical unauthenticated full read Server-Side Request Forgery (SSRF) vulnerability has been identified in the pro… |
CVE-2025-53832 | High | 7.5 | 2025-07-21 | Lara Translate MCP Server is a Model Context Protocol (MCP) Server for Lara Translate API. Versions 0.0.11 and below contain a command injection vulnerability… |
CVE-2025-53528 | High | 7.6 | 2025-07-21 | Cadwyn creates production-ready community-driven modern Stripe-like API versioning in FastAPI. In versions before 5.4.3, the version parameter of the "/docs" e… |
CVE-2025-7938 | Medium | 4.3 | 2025-07-21 | A vulnerability was found in jerryshensjf JPACookieShop 蛋糕商城JPA版 1.0 and classified as critical. This issue affects the function updateGoods of the file GoodsC… |
CVE-2025-7936 | Medium | 6.3 | 2025-07-21 | A vulnerability has been found in fuyang_lipengjun platform up to ca9aceff6902feb7b0b6bf510842aea88430796a and classified as critical. Affected by this vulnera… |
CVE-2025-7325 | High | 7.8 | 2025-07-21 | IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2025-7324 | High | 7.8 | 2025-07-21 | IrfanView CADImage Plugin DXF File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr… |
CVE-2025-7323 | High | 7.8 | 2025-07-21 | IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2025-7322 | High | 7.8 | 2025-07-21 | IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr… |
CVE-2025-7321 | High | 7.8 | 2025-07-21 | IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2025-7320 | High | 7.8 | 2025-07-21 | IrfanView CADImage Plugin DXF File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2025-7319 | High | 7.8 | 2025-07-21 | IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr… |
CVE-2025-7318 | High | 7.8 | 2025-07-21 | IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2025-7317 | High | 7.8 | 2025-07-21 | IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2025-7316 | High | 7.8 | 2025-07-21 | IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2025-7315 | High | 7.8 | 2025-07-21 | IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2025-7314 | High | 7.8 | 2025-07-21 | IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2025-7313 | High | 7.8 | 2025-07-21 | IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2025-7312 | High | 7.8 | 2025-07-21 | IrfanView CADImage Plugin DWG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr… |
CVE-2025-7311 | High | 7.8 | 2025-07-21 | IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2025-7310 | High | 7.8 | 2025-07-21 | IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2025-7309 | High | 7.8 | 2025-07-21 | IrfanView CADImage Plugin DWG File Parsing Memory Corruption Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |