2025 CVEs (page 246)
Page 246 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-54059 | Medium | 4.4 | 2025-07-18 | melange allows users to build apk packages using declarative pipelines. Starting in version 0.23.0 and prior to version 0.29.5, SBOM files generated by melange… |
CVE-2025-53945 | High | 7.0 | 2025-07-18 | apko allows users to build and publish OCI container images built from apk packages. Starting in version 0.27.0 and prior to version 0.29.5, critical files wer… |
CVE-2025-53888 | Critical | 9.8 | 2025-07-18 | RIOT-OS, an operating system that supports Internet of Things devices, has an ineffective size check implemented with `assert()` can lead to buffer overflow in… |
CVE-2025-7788 | Medium | 6.3 | 2025-07-18 | A vulnerability has been found in Xuxueli xxl-job up to 3.1.1 and classified as critical. Affected by this vulnerability is the function commandJobHandler of t… |
CVE-2025-7787 | Medium | 6.3 | 2025-07-18 | A vulnerability, which was classified as critical, was found in Xuxueli xxl-job up to 3.1.1. Affected is the function httpJobHandler of the file src\main\java\… |
CVE-2025-46732 | Medium | 5.4 | 2025-07-18 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.6.6, an IDOR vulnerability in the GrapQ… |
CVE-2025-46000 | Medium | 6.5 | 2025-07-18 | An arbitrary file upload vulnerability in the component /rsc/filemanager.rsc.class.php of Filemanager commit c75b914 v.2.5.0 allows attackers to execute arbitr… |
CVE-2025-7786 | Low | 3.5 | 2025-07-18 | A vulnerability, which was classified as problematic, has been found in Gnuboard g6 up to 6.0.10. This issue affects some unknown processing of the file /bbs/s… |
CVE-2025-7784 | Medium | 6.5 | 2025-07-18 | A flaw was found in the Keycloak identity and access management system when Fine-Grained Admin Permissions(FGAPv2) are enabled. An administrative user with the… |
CVE-2025-46002 | Medium | 6.5 | 2025-07-18 | An issue in Filemanager v2.5.0 and below allows attackers to execute a directory traversal via sending a crafted HTTP request to the filemanager.php endpoint. |
CVE-2025-46001 | Critical | 9.8 | 2025-07-18 | An arbitrary file upload vulnerability in the is_allowed_file_type() function of Filemanager v2.3.0 allows attackers to execute arbitrary code via uploading a… |
CVE-2025-7785 | Medium | 4.3 | 2025-07-18 | A vulnerability classified as problematic was found in thinkgem JeeSite up to 5.12.0. This vulnerability affects the function sso of the file src/main/java/com… |
CVE-2025-6227 | Low | 2.2 | 2025-07-18 | Mattermost versions 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite… |
CVE-2025-6233 | Medium | 6.8 | 2025-07-18 | Mattermost versions 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 10.5.x <= 10.5.7, 9.11.x <= 9.11.16 fail to sanitize input paths of file attachments in the bulk import… |
CVE-2025-50126 | | 2025-07-18 | A stored XSS vulnerability in the RSBlog! component 1.11.6-1.14.5 Joomla was discovered. The issue allows remote authenticated users to inject arbitrary web sc… | |
CVE-2025-50058 | | 2025-07-18 | A stored XSS vulnerability in the RSDirectory! component 1.0.0-2.2.8 Joomla was discovered. The issue allows remote authenticated attackers to inject arbitrary… | |
CVE-2025-50057 | | 2025-07-18 | A DOS vulnerability in RSFiles! component 1.16.3-1.17.7 Joomla was discovered. The issue allows unauthenticated remote attackers to deny access to service via… | |
CVE-2025-50056 | | 2025-07-18 | A reflected XSS vulnerability in RSMail! component 1.19.20 - 1.22.26 28 Joomla was discovered. The issue allows remote attackers to inject arbitrary web script… | |
CVE-2025-49486 | | 2025-07-18 | A stored XSS vulnerability in the Balbooa Gallery plugin 1.0.0-2.4.0 for Joomla allows privileged users to store malicious scripts in gallery items. | |
CVE-2025-49485 | | 2025-07-18 | A SQL injection vulnerability in the Balbooa Forms plugin 1.0.0-2.3.1.1 for Joomla allows privileged users to execute arbitrary SQL commands via the 'id' param… | |
CVE-2025-49484 | | 2025-07-18 | A SQL injection vulnerability in the JS Jobs plugin versions 1.0.0-1.4.1 for Joomla allows low-privilege users to execute arbitrary SQL commands via the 'cvid'… | |
CVE-2025-2425 | | 2025-07-18 | Time-of-check to time-of-use race condition vulnerability potentially allowed an attacker to use the installed ESET security software to clear the content of a… | |
CVE-2025-7444 | Critical | 9.8 | 2025-07-18 | The LoginPress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 5.0.1. This is due to insufficient verific… |
CVE-2025-6226 | Medium | 6.5 | 2025-07-18 | Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by Pendin… |
CVE-2025-6197 | Medium | 4.2 | 2025-07-18 | An open redirect vulnerability has been identified in Grafana OSS organization switching functionality. Prerequisites for exploitation: - Multiple organizat… |
CVE-2025-6023 | High | 7.6 | 2025-07-18 | An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11… |
CVE-2025-38349 | High | 7.8 | 2025-07-18 | In the Linux kernel, the following vulnerability has been resolved: eventpoll: don't decrement ep refcount while still holding the ep mutex Jann Horn points… |
CVE-2025-26855 | Critical | 9.8 | 2025-07-18 | A SQL injection in Articles Calendar extension 1.0.0 - 1.0.1.0007 for Joomla allows attackers to execute arbitrary SQL commands. |
CVE-2025-26854 | Critical | 9.8 | 2025-07-18 | A SQL injection in Articles Good Search extension 1.0.0 - 1.2.4.0011 for Joomla allows attackers to execute arbitrary SQL commands. |
CVE-2025-7772 | Medium | 6.5 | 2025-07-18 | The Malcure Malware Scanner — #1 Toolset for WordPress Malware Removal plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and inc… |
CVE-2025-7438 | High | 7.5 | 2025-07-18 | The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'install_and_activate_plug… |
CVE-2025-7643 | Critical | 9.1 | 2025-07-18 | The Attachment Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the handle_actions() function… |
CVE-2025-6726 | Medium | 4.3 | 2025-07-18 | The Block Editor Gallery Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the classic_galler… |
CVE-2025-6719 | Medium | 4.4 | 2025-07-18 | The Terms descriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.4.8 due to… |
CVE-2025-6718 | High | 8.8 | 2025-07-18 | The B1.lt plugin for WordPress is vulnerable to SQL Injection due to a missing capability check on the b1_run_query AJAX action in all versions up to, and incl… |
CVE-2025-6717 | Medium | 6.5 | 2025-07-18 | The B1.lt plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 2.2.56 due to insufficient escaping… |
CVE-2025-6222 | Critical | 9.8 | 2025-07-18 | The WooCommerce Refund And Exchange with RMA - Warranty Management, Refund Policy, Manage User Wallet theme for WordPress is vulnerable to arbitrary file uploa… |
CVE-2025-5811 | Medium | 5.3 | 2025-07-18 | The Listly: Listicles For WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Init() fun… |
CVE-2025-5800 | Medium | 6.4 | 2025-07-18 | The Testimonial Post type plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘auto_play’ parameter in all versions up to, and including… |
CVE-2025-5767 | Medium | 6.4 | 2025-07-18 | The Crowdfunding for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to, and includi… |
CVE-2025-5754 | Medium | 6.4 | 2025-07-18 | The Useful Tab Block – Responsive & AMP-Compatible plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versi… |
CVE-2025-5752 | Medium | 6.4 | 2025-07-18 | The Vertical scroll image slideshow gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘width’ parameter in all versions up to… |
CVE-2025-7660 | Medium | 6.4 | 2025-07-18 | The Map My Locations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'map_my_locations' shortcode in all versions up to, and… |
CVE-2025-7648 | Medium | 6.4 | 2025-07-18 | The Ruven Themes: Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ruven_button' shortcode in all versions up to… |
CVE-2025-7638 | Medium | 4.9 | 2025-07-18 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to time-based SQL Injection via the `order_by` param… |
CVE-2025-6813 | High | 8.8 | 2025-07-18 | The aapanel WP Toolkit plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization checks within the auto_login() function in versi… |
CVE-2025-6781 | Medium | 4.3 | 2025-07-18 | The Copymatic – AI Content Writer & Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1. This… |
CVE-2025-6053 | Medium | 6.1 | 2025-07-18 | The Zuppler Online Ordering plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.0. This is due to missin… |
CVE-2025-5816 | Medium | 4.3 | 2025-07-18 | The Plugin Pengiriman WooCommerce Kurir Reguler, Instan, Kargo – Biteship plugin for WordPress is vulnerable to Insecure Direct Object Reference in all version… |
CVE-2025-3740 | High | 8.8 | 2025-07-18 | The School Management System for Wordpress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 93.1.0 via the 'pag… |
CVE-2025-7431 | Medium | 4.4 | 2025-07-18 | The Knowledge Base plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin slug setting in all versions up to, and including, 2.3.1 du… |
CVE-2025-7767 | Low | 3.5 | 2025-07-18 | A vulnerability, which was classified as problematic, has been found in PHPGurukul Art Gallery Management System 1.1. Affected by this issue is some unknown fu… |
CVE-2025-6185 | Critical | 9.3 | 2025-07-18 | Leviton AcquiSuite and Energy Monitoring Hub are susceptible to a cross-site scripting vulnerability, allowing an attacker to craft a malicious payload in UR… |
CVE-2025-7765 | High | 7.3 | 2025-07-17 | A vulnerability classified as critical was found in code-projects Online Appointment Booking System 1.0. Affected by this vulnerability is an unknown functiona… |
CVE-2025-7764 | High | 7.3 | 2025-07-17 | A vulnerability classified as critical has been found in code-projects Online Appointment Booking System 1.0. Affected is an unknown function of the file /admi… |
CVE-2025-7763 | Medium | 4.3 | 2025-07-17 | A vulnerability, which was classified as problematic, was found in thinkgem JeeSite up to 5.12.0. Affected is the function select of the file src/main/java/com… |
CVE-2025-7762 | High | 8.8 | 2025-07-17 | A vulnerability, which was classified as critical, has been found in D-Link DI-8100 16.07.26A1. This issue affects some unknown processing of the file /menu_na… |
CVE-2025-7759 | Medium | 6.3 | 2025-07-17 | A vulnerability was identified in thinkgem JeeSite up to 5.12.0. This vulnerability affects unknown code of the file modules/core/src/main/java/com/jeesite/com… |
CVE-2025-7758 | High | 8.8 | 2025-07-17 | A vulnerability, which was classified as critical, has been found in TOTOLINK T6 up to 4.1.5cu.748_B20211015. Affected by this issue is the function setDiagnos… |
CVE-2025-7398 | Critical | 9.1 | 2025-07-17 | Brocade ASCG before 3.3.0 allows for the use of medium strength cryptography algorithms on internal ports ports 9000 and 8036. |
CVE-2025-7397 | High | 7.1 | 2025-07-17 | A vulnerability in the ascgshell, of Brocade ASCG before 3.3.0 stores any command executed in the Command Line Interface (CLI) in plain text within the comma… |
CVE-2025-6391 | Critical | 9.1 | 2025-07-17 | Brocade ASCG before 3.3.0 logs JSON Web Tokens (JWT) in log files. An attacker with access to the log files can withdraw the unencrypted tokens with securit… |
CVE-2025-7757 | High | 7.3 | 2025-07-17 | A vulnerability classified as critical was found in PHPGurukul Land Record System 1.0. Affected by this vulnerability is an unknown functionality of the file /… |
CVE-2025-7756 | Medium | 4.3 | 2025-07-17 | A vulnerability classified as problematic has been found in code-projects E-Commerce Site 1.0. Affected is an unknown function. The manipulation leads to cross… |
CVE-2025-7755 | Medium | 6.3 | 2025-07-17 | A vulnerability was found in code-projects Online Ordering System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /a… |
CVE-2025-23269 | Medium | 4.7 | 2025-07-17 | NVIDIA Jetson Linux contains a vulnerability in the kernel where an attacker may cause an exposure of sensitive information due to a shared microarchitectural… |
CVE-2025-7754 | Medium | 6.3 | 2025-07-17 | A vulnerability was found in code-projects Patient Record Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of t… |
CVE-2025-7753 | High | 7.3 | 2025-07-17 | A vulnerability was found in code-projects Online Appointment Booking System 1.0. It has been classified as critical. This affects an unknown part of the file… |
CVE-2025-7752 | High | 7.3 | 2025-07-17 | A vulnerability was found in code-projects Online Appointment Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionali… |
CVE-2025-7751 | High | 7.3 | 2025-07-17 | A vulnerability has been found in code-projects Online Appointment Booking System 1.0 and classified as critical. Affected by this vulnerability is an unknown… |
CVE-2025-7433 | High | 8.8 | 2025-07-17 | A local privilege escalation vulnerability in Sophos Intercept X for Windows with Central Device Encryption 2025.1 and older allows arbitrary code execution. |
CVE-2025-6249 | Medium | 6.7 | 2025-07-17 | An authentication bypass vulnerability was reported in FileZ client application that could allow a local attacker with elevated permissions access to applicati… |
CVE-2025-6248 | High | 7.4 | 2025-07-17 | A cross-site scripting (XSS) vulnerability was reported in the Lenovo Browser that could allow an attacker to obtain sensitive information if a user visits a w… |
CVE-2025-6232 | High | 7.8 | 2025-07-17 | An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated pe… |
CVE-2025-6231 | High | 7.8 | 2025-07-17 | An improper validation vulnerability was reported in Lenovo Vantage that under certain conditions could allow a local attacker to execute code with elevated pe… |
CVE-2025-6230 | Medium | 5.3 | 2025-07-17 | A SQL injection vulnerability was reported in Lenovo Vantage that could allow a local attacker to modify the local SQLite database and execute limited SQLite c… |
CVE-2025-53964 | Critical | 9.6 | 2025-07-17 | GoldenDict 1.5.0 and 1.5.1 has an exposed dangerous method that allows reading and modifying files when a user adds a crafted dictionary and then searches for… |
CVE-2025-4657 | Medium | 6.7 | 2025-07-17 | A buffer overflow vulnerability was reported in the Lenovo Protection Driver, prior to version 5.1.1110.4231, used in Lenovo PC Manager, Lenovo Browser, and Le… |
CVE-2025-3753 | High | 7.8 | 2025-07-17 | A code execution vulnerability has been identified in the Robot Operating System (ROS) 'rosbag' tool, affecting ROS distributions Noetic Ninjemys and earlier… |
CVE-2025-2818 | Low | 3.5 | 2025-07-17 | A vulnerability was reported in version 1.0 of the Bluetooth Transmission Alliance protocol adopted by Motorola Smart Connect Android Application that could al… |
CVE-2025-23270 | High | 7.1 | 2025-07-17 | NVIDIA Jetson Linux contains a vulnerability in UEFI Management mode, where an unprivileged local attacker may cause exposure of sensitive information via a si… |
CVE-2025-23267 | High | 8.5 | 2025-07-17 | NVIDIA Container Toolkit for all platforms contains a vulnerability in the update-ldcache hook, where an attacker could cause a link following by using a speci… |
CVE-2025-23266 | Critical | 9.0 | 2025-07-17 | NVIDIA Container Toolkit for all platforms contains a vulnerability in some hooks used to initialize the container, where an attacker could execute arbitrary c… |
CVE-2025-1729 | Medium | 6.7 | 2025-07-17 | A DLL hijacking vulnerability was reported in TrackPoint Quick Menu software that, under certain conditions, could allow a local attacker to escalate privilege… |
CVE-2025-1700 | High | 7.0 | 2025-07-17 | A DLL hijacking vulnerability was reported in the Motorola Software Fix (Rescue and Smart Assistant) installer that could allow a local attacker to escalate pr… |
CVE-2025-0886 | High | 7.8 | 2025-07-17 | An incorrect permissions vulnerability was reported in Elliptic Labs Virtual Lock Sensor that could allow a local, authenticated user to escalate privileges. |
CVE-2025-7750 | High | 7.3 | 2025-07-17 | A vulnerability, which was classified as critical, was found in code-projects Online Appointment Booking System 1.0. Affected is an unknown function of the fil… |
CVE-2025-7472 | High | 7.5 | 2025-07-17 | A local privilege escalation vulnerability in the Intercept X for Windows installer prior version 1.22 can lead to a local user gaining system level privileges… |
CVE-2025-54070 | | 2025-07-17 | OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 5.2.0 and prior to version 5.4.0, the `lastIndexOf(bytes,byte,ui… | |
CVE-2025-54068 | Critical | 9.8 | 2025-07-17 | Livewire is a full-stack framework for Laravel. In Livewire v3 up to and including v3.6.3, a vulnerability allows unauthenticated attackers to achieve remote c… |
CVE-2025-53817 | High | 7.5 | 2025-07-17 | 7-Zip is a file archiver with a high compression ratio. 7-Zip supports extracting from Compound Documents. Prior to version 25.0.0, a null pointer dereference… |
CVE-2025-53816 | High | 7.5 | 2025-07-17 | 7-Zip is a file archiver with a high compression ratio. Zeroes written outside heap buffer in RAR5 handler may lead to memory corruption and denial of service… |
CVE-2025-50240 | Critical | 9.8 | 2025-07-17 | nbcio-boot v1.0.3 was discovered to contain a SQL injection vulnerability via the userIds parameter at /sys/user/deleteRecycleBin. |
CVE-2025-46102 | Medium | 5.4 | 2025-07-17 | Cross Site Scripting vulnerability in Beakon Software Beakon Learning Management System Sharable Content Object Reference Model (SCORM) version V.5.4.3 allows… |
CVE-2025-7749 | High | 7.3 | 2025-07-17 | A vulnerability, which was classified as critical, has been found in code-projects Online Appointment Booking System 1.0. This issue affects some unknown proce… |
CVE-2025-7748 | Low | 3.5 | 2025-07-17 | A vulnerability classified as problematic was found in ZCMS 3.6.0. This vulnerability affects unknown code of the component Create Article Page. The manipulati… |
CVE-2025-7747 | High | 8.8 | 2025-07-17 | A vulnerability classified as critical has been found in Tenda FH451 1.0.0.9. This affects the function fromWizardHandle of the file /goform/WizardHandle of th… |
CVE-2025-53644 | Critical | 9.8 | 2025-07-17 | OpenCV is an Open Source Computer Vision Library. Versions 4.10.0 and 4.11.0 have an uninitialized pointer variable on stack that may lead to arbitrary heap bu… |
CVE-2025-53638 | | 2025-07-17 | Solady is software that provides Solidity snippets with APIs. Starting in version 0.0.125 and prior to version 0.1.24, when an account is deployed via a proxy… | |
CVE-2025-51497 | Medium | 5.5 | 2025-07-17 | An issue was discovered in AdGuard plugin before 1.11.22 for Safari on MacOS. AdGaurd verbosely logged each url that Safari accessed when the plugin was active… |