2025 CVEs (page 255)
Page 255 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-38311 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: iavf: get rid of the crit lock Get rid of the crit lock. That frees us from the error pro… |
CVE-2025-38310 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: seg6: Fix validation of nexthop addresses The kernel currently validates that the length… |
CVE-2025-38309 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: move xe_svm_init() earlier In xe_vm_close_and_put() we need to be able to call… |
CVE-2025-38308 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix possible null-ptr-deref when initing hw Search result of avs_dai_fi… |
CVE-2025-38307 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Verify content returned by parse_int_array() The first element of the r… |
CVE-2025-38306 | High | 7.8 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: fs/fhandle.c: fix a race in call of has_locked_children() may_decode_fh() is calling has_… |
CVE-2025-38305 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() There is no disagreement th… |
CVE-2025-38304 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Fix NULL pointer deference on eir_get_service_data The len parameter is consid… |
CVE-2025-38303 | High | 7.8 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: eir: Fix possible crashes on eir_create_adv_data eir_create_adv_data may attem… |
CVE-2025-38302 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: block: don't use submit_bio_noacct_nocheck in blk_zone_wplug_bio_work Bios queued up in t… |
CVE-2025-38301 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: nvmem: zynqmp_nvmem: unbreak driver after cleanup Commit 29be47fcd6a0 ("nvmem: zynqmp_nvm… |
CVE-2025-38300 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: crypto: sun8i-ce-cipher - fix error handling in sun8i_ce_cipher_prepare() Fix two DMA cle… |
CVE-2025-38299 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8195: Set ETDM1/2 IN/OUT to COMP_DUMMY() ETDM2_IN_BE and ETDM1_OUT_BE a… |
CVE-2025-38298 | High | 7.8 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: EDAC/skx_common: Fix general protection fault After loading i10nm_edac (which automatical… |
CVE-2025-38297 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: PM: EM: Fix potential division-by-zero error in em_compute_costs() When the device is of… |
CVE-2025-38296 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: ACPI: platform_profile: Avoid initializing on non-ACPI platforms The platform profile dri… |
CVE-2025-38295 | High | 7.8 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: perf/amlogic: Replace smp_processor_id() with raw_smp_processor_id() in meson_ddr_pmu_crea… |
CVE-2025-38294 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL access in assign channel context handler Currently, when ath12k_ma… |
CVE-2025-38293 | High | 8.8 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix node corruption in ar->arvifs list In current WLAN recovery code flow… |
CVE-2025-38292 | High | 8.8 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix invalid access to memory In ath12k_dp_rx_msdu_coalesce(), rxcb is fetch… |
CVE-2025-38291 | High | 8.8 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Prevent sending WMI commands to firmware during firmware crash Currently, w… |
CVE-2025-38290 | High | 8.8 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix node corruption in ar->arvifs list In current WLAN recovery code flow… |
CVE-2025-38289 | High | 7.8 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk Smatch detected a… |
CVE-2025-38288 | High | 7.8 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix smp_processor_id() call trace for preemptible kernels Correct kernel… |
CVE-2025-38287 | High | 7.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: IB/cm: Drop lockdep assert and WARN when freeing old msg The send completion handler can… |
CVE-2025-38286 | High | 7.1 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: at91: Fix possible out-of-boundary access at91_gpio_probe() doesn't check that g… |
CVE-2025-38285 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix WARN() in get_bpf_raw_tp_regs syzkaller reported an issue: WARNING: CPU: 3 PID… |
CVE-2025-38284 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: pci: configure manual DAC mode via PCI config API only To support 36-bit DMA… |
CVE-2025-38283 | High | 8.8 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: hisi_acc_vfio_pci: bugfix live migration function without VF device driver If the VF devi… |
CVE-2025-38282 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: kernfs: Relax constraint in draining guard The active reference lifecycle provides the br… |
CVE-2025-38281 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Add NULL check in mt7996_thermal_init devm_kasprintf() can return a N… |
CVE-2025-38280 | High | 7.8 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid __bpf_prog_ret0_warn when jit fails syzkaller reported an issue: WARNING: CPU… |
CVE-2025-38279 | High | 7.8 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: bpf: Do not include stack ptr register in precision backtracking bookkeeping Yi Lai repor… |
CVE-2025-38278 | High | 7.8 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: QOS: Refactor TC_HTB_LEAF_DEL_LAST callback This patch addresses below issu… |
CVE-2025-38277 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: mtd: nand: ecc-mxic: Fix use of uninitialized variable ret If ctx->steps is zero, the loo… |
CVE-2025-38276 | High | 7.8 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: fs/dax: Fix "don't skip locked entries when scanning entries" Commit 6be3e21d25ca ("fs/da… |
CVE-2025-38275 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qmp-usb: Fix an NULL vs IS_ERR() bug The qmp_usb_iomap() helper function curren… |
CVE-2025-38274 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: fpga: fix potential null pointer deref in fpga_mgr_test_img_load_sgt() fpga_mgr_test_img_… |
CVE-2025-38273 | High | 7.8 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: net: tipc: fix refcount warning in tipc_aead_encrypt syzbot reported a refcount warning [… |
CVE-2025-38272 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: net: dsa: b53: do not enable EEE on bcm63xx BCM63xx internal switches do not support EEE… |
CVE-2025-38271 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: net: prevent a NULL deref in rtnl_create_link() At the time rtnl_create_link() is running… |
CVE-2025-38270 | High | 7.8 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: net: drv: netdevsim: don't napi_complete() from netpoll netdevsim supports netpoll. Make… |
CVE-2025-38269 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: btrfs: exit after state insertion failure at btrfs_convert_extent_bit() If insert_state()… |
CVE-2025-38268 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: move tcpm_queue_vdm_unlocked to asynchronous work A state check was pre… |
CVE-2025-38267 | High | 7.8 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Do not trigger WARN_ON() due to a commit_overrun When reading a memory mappe… |
CVE-2025-38266 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: eint: Fix invalid pointer dereference for v1 platforms Commit 3ef9f710… |
CVE-2025-38265 | Medium | 5.5 | 2025-07-10 | In the Linux kernel, the following vulnerability has been resolved: serial: jsm: fix NPE during jsm_uart_port_init No device was set which caused serial_base… |
CVE-2025-32989 | Medium | 5.3 | 2025-07-10 | A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension durin… |
CVE-2025-32988 | Medium | 6.5 | 2025-07-10 | A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (S… |
CVE-2025-7387 | Medium | 5.5 | 2025-07-10 | The Lana Downloads Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the endpoint parameters in versions up to, and including, 1.10… |
CVE-2025-6236 | Medium | 4.8 | 2025-07-10 | The Hostel WordPress plugin before 1.1.5.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform S… |
CVE-2025-6234 | Medium | 6.1 | 2025-07-10 | The Hostel WordPress plugin before 1.1.5.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Sc… |
CVE-2025-46406 | Medium | 5.6 | 2025-07-10 | A Privilege Context Switching Error (CWE-270) in the Command Center Server could allow a privileged Operator with high level access in one Division to perform… |
CVE-2025-44003 | Medium | 4.3 | 2025-07-10 | Missing Release of Resource after Effective Lifetime (CWE-772) in the Gallagher T-Series Reader allows an attacker with physical access to the reader to perfor… |
CVE-2025-35983 | Medium | 6.5 | 2025-07-10 | Improper Certificate Validation (CWE-295) in the Controller 7000 OneLink implementation could allow an unprivileged attacker to perform a limited denial of ser… |
CVE-2025-5807 | Medium | 6.1 | 2025-07-10 | The Gwolle Guestbook plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘gwolle_gb_content’ parameter in all versions up to, and includi… |
CVE-2025-4406 | Medium | 5.4 | 2025-07-10 | The wpForo Forum plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.4.5 due to insu… |
CVE-2025-6976 | Medium | 6.4 | 2025-07-09 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in a… |
CVE-2025-6975 | Medium | 6.1 | 2025-07-09 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘calendar_header’ para… |
CVE-2025-6970 | High | 7.5 | 2025-07-09 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all v… |
CVE-2025-0141 | | 2025-07-09 | An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on enables a locally authenticated non administrative user to esca… | |
CVE-2025-0140 | | 2025-07-09 | An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrativ… | |
CVE-2025-0139 | | 2025-07-09 | An incorrect privilege assignment vulnerability in Palo Alto Networks Autonomous Digital Experience Manager allows a locally authenticated low privileged user… | |
CVE-2025-6377 | High | 7.8 | 2025-07-09 | A remote code execution security issue exists in the Rockwell Automation Arena®. A crafted DOE file can force Arena Simulation to write beyond the boundaries… |
CVE-2025-6376 | High | 7.8 | 2025-07-09 | A remote code execution security issue exists in the Rockwell Automation Arena®. A crafted DOE file can force Arena Simulation to write beyond the boundaries… |
CVE-2025-53624 | Critical | 10.0 | 2025-07-09 | The Docusaurus gists plugin adds a page to your Docusaurus instance, displaying all public gists of a GitHub user. docusaurus-plugin-content-gists versions pri… |
CVE-2025-52357 | Medium | 4.1 | 2025-07-09 | Cross-Site Scripting (XSS) vulnerability exists in the ping diagnostic feature of FiberHome FD602GW-DX-R410 router (firmware V2.2.14), allowing an authenticate… |
CVE-2025-53620 | | 2025-07-09 | @builder.io/qwik-city is the meta-framework for Qwik. When a Qwik Server Action QRL is executed it dynamically load the file containing the symbol. When an inv… | |
CVE-2025-36599 | Medium | 4.3 | 2025-07-09 | Dell PowerFlex Manager VM, versions prior to 4.6.2.1, contains an Insertion of Sensitive Information into Log File vulnerability. A low privileged attacker wit… |
CVE-2025-53548 | High | 7.5 | 2025-07-09 | Clerk helps developers build user management. Applications that use the verifyWebhook() helper to verify incoming Clerk webhooks are susceptible to accepting i… |
CVE-2025-53645 | High | 7.5 | 2025-07-09 | Zimbra Collaboration (ZCS) before 9.0.0 Patch 46, 10.0.x before 10.0.15, and 10.1.x before 10.1.9 is vulnerable to a denial of service condition due to imprope… |
CVE-2025-44525 | Medium | 6.5 | 2025-07-09 | Texas Instruments CC2652RB LaunchPad SimpleLink CC13XX CC26XX SDK 7.41.00.17 was discovered to utilize insufficient permission checks on critical fields within… |
CVE-2025-7381 | Medium | 5.3 | 2025-07-09 | ImpactThis is an information disclosure vulnerability originating from PHP's base image. This vulnerability exposes the PHP version through an X-Powered-By hea… |
CVE-2025-53743 | Medium | 5.3 | 2025-07-09 | Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not mask Applitools API keys displayed on the job configuration form, increasing the potential for attac… |
CVE-2025-53742 | Medium | 6.5 | 2025-07-09 | Jenkins Applitools Eyes Plugin 1.16.5 and earlier stores Applitools API keys unencrypted in job config.xml files on the Jenkins controller, where they can be v… |
CVE-2025-53678 | Medium | 6.5 | 2025-07-09 | Jenkins User1st uTester Plugin 1.1 and earlier stores the uTester JWT token unencrypted in its global configuration file on the Jenkins controller, where it ca… |
CVE-2025-53677 | Medium | 5.3 | 2025-07-09 | Jenkins Xooa Plugin 0.0.7 and earlier does not mask the Xooa Deployment Token on the global configuration form, increasing the potential for attackers to obser… |
CVE-2025-53676 | Medium | 6.5 | 2025-07-09 | Jenkins Xooa Plugin 0.0.7 and earlier stores the Xooa Deployment Token unencrypted in its global configuration file on the Jenkins controller, where it can be… |
CVE-2025-53675 | Medium | 6.5 | 2025-07-09 | Jenkins Warrior Framework Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by us… |
CVE-2025-53674 | Medium | 5.3 | 2025-07-09 | Jenkins Sensedia Api Platform tools Plugin 1.0 does not mask the Sensedia API Manager integration token on the global configuration form, increasing the potent… |
CVE-2025-53673 | Medium | 6.5 | 2025-07-09 | Jenkins Sensedia Api Platform tools Plugin 1.0 stores the Sensedia API Manager integration token unencrypted in its global configuration file on the Jenkins co… |
CVE-2025-53672 | Medium | 6.5 | 2025-07-09 | Jenkins Kryptowire Plugin 0.2 and earlier stores the Kryptowire API key unencrypted in its global configuration file on the Jenkins controller, where it can be… |
CVE-2025-53671 | Medium | 6.5 | 2025-07-09 | Jenkins Nouvola DiveCloud Plugin 1.08 and earlier does not mask DiveCloud API Keys and Credentials Encryption Keys displayed on the job configuration form, inc… |
CVE-2025-53670 | Medium | 6.5 | 2025-07-09 | Jenkins Nouvola DiveCloud Plugin 1.08 and earlier stores DiveCloud API Keys and Credentials Encryption Keys unencrypted in job config.xml files on the Jenkins… |
CVE-2025-53669 | Medium | 4.3 | 2025-07-09 | Jenkins VAddy Plugin 1.2.8 and earlier does not mask Vaddy API Auth Keys displayed on the job configuration form, increasing the potential for attackers to obs… |
CVE-2025-53668 | Medium | 6.5 | 2025-07-09 | Jenkins VAddy Plugin 1.2.8 and earlier stores Vaddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by us… |
CVE-2025-53667 | Medium | 5.3 | 2025-07-09 | Jenkins Dead Man's Snitch Plugin 0.1 does not mask Dead Man's Snitch tokens displayed on the job configuration form, increasing the potential for attackers to… |
CVE-2025-53666 | Medium | 6.5 | 2025-07-09 | Jenkins Dead Man's Snitch Plugin 0.1 stores Dead Man's Snitch tokens unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by… |
CVE-2025-53665 | Medium | 4.3 | 2025-07-09 | Jenkins Apica Loadtest Plugin 1.10 and earlier does not mask Apica Loadtest LTP authentication tokens displayed on the job configuration form, increasing the p… |
CVE-2025-53664 | Medium | 6.5 | 2025-07-09 | Jenkins Apica Loadtest Plugin 1.10 and earlier stores Apica Loadtest LTP authentication tokens unencrypted in job config.xml files on the Jenkins controller, w… |
CVE-2025-53663 | Medium | 6.5 | 2025-07-09 | Jenkins IBM Cloud DevOps Plugin 2.0.16 and earlier stores SonarQube authentication tokens unencrypted in job config.xml files on the Jenkins controller, where… |
CVE-2025-53662 | Medium | 6.5 | 2025-07-09 | Jenkins IFTTT Build Notifier Plugin 1.2 and earlier stores IFTTT Maker Channel Keys unencrypted in job config.xml files on the Jenkins controller, where they c… |
CVE-2025-53661 | Medium | 4.3 | 2025-07-09 | Jenkins Testsigma Test Plan run Plugin 1.6 and earlier does not mask Testsigma API keys displayed on the job configuration form, increasing the potential for a… |
CVE-2025-53660 | Medium | 4.3 | 2025-07-09 | Jenkins QMetry Test Management Plugin 1.13 and earlier does not mask Qmetry Automation API Keys displayed on the job configuration form, increasing the potenti… |
CVE-2025-53659 | Medium | 6.5 | 2025-07-09 | Jenkins QMetry Test Management Plugin 1.13 and earlier stores Qmetry Automation API Keys unencrypted in job config.xml files on the Jenkins controller, where t… |
CVE-2025-53658 | Medium | 5.4 | 2025-07-09 | Jenkins Applitools Eyes Plugin 1.16.5 and earlier does not escape the Applitools URL on the build page, resulting in a stored cross-site scripting (XSS) vulner… |
CVE-2025-53657 | Medium | 4.3 | 2025-07-09 | Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier does not mask SLM License Access Keys, client secrets, and passwords displayed on the job configura… |
CVE-2025-53656 | Medium | 6.5 | 2025-07-09 | Jenkins ReadyAPI Functional Testing Plugin 1.11 and earlier stores SLM License Access Keys, client secrets, and passwords unencrypted in job config.xml files o… |
CVE-2025-53655 | Medium | 5.3 | 2025-07-09 | Jenkins Statistics Gatherer Plugin 2.0.3 and earlier does not mask the AWS Secret Key on the global configuration form, increasing the potential for attackers… |
CVE-2025-53654 | Medium | 6.5 | 2025-07-09 | Jenkins Statistics Gatherer Plugin 2.0.3 and earlier stores the AWS Secret Key unencrypted in its global configuration file on the Jenkins controller, where it… |