2025 CVEs (page 26)
Page 26 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12474 | Medium | 4.4 | 2026-02-11 | A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory. This can be done by causing the decoder to r… |
CVE-2025-61969 | | 2026-02-11 | Incorrect permission assignment in AMD µProf may allow a local user-privileged attacker to achieve privilege escalation, potentially resulting in arbitrary cod… | |
CVE-2025-52541 | High | 7.3 | 2026-02-11 | A DLL hijacking vulnerability in Vivado could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. |
CVE-2025-48518 | | 2026-02-11 | Improper input validation in AMD Graphics Driver could allow a local attacker to write out of bounds, potentially resulting in loss of integrity or denial of s… | |
CVE-2025-48508 | Medium | 6.0 | 2026-02-11 | Improper Hardware reset flow logic in the GPU GFX Hardware IP block could allow a privileged attacker in a guest virtual machine to control reset operation pot… |
CVE-2025-48503 | High | 7.8 | 2026-02-11 | A DLL hijacking vulnerability in the AMD Software Installer could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code exe… |
CVE-2025-12059 | Critical | 9.8 | 2026-02-11 | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Logo Software Industry and Trade Inc. Logo j-Platform allows E… |
CVE-2025-8668 | Critical | 9.4 | 2026-02-11 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in E-Kalite Software Hardware Engineering Design and… |
CVE-2025-8025 | Critical | 9.8 | 2026-02-11 | Missing Authentication for Critical Function, Improper Access Control vulnerability in Dinosoft Business Solutions Dinosoft ERP allows Accessing Functionality… |
CVE-2025-68406 | Medium | 6.5 | 2026-02-11 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-66278 | Medium | 6.5 | 2026-02-11 | A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability t… |
CVE-2025-66277 | Critical | 9.8 | 2026-02-11 | A link following vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to t… |
CVE-2025-66274 | Medium | 4.9 | 2026-02-11 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-62856 | Medium | 4.4 | 2026-02-11 | A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the vulner… |
CVE-2025-62855 | Medium | 4.4 | 2026-02-11 | A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the vulner… |
CVE-2025-62854 | Medium | 6.5 | 2026-02-11 | An uncontrolled resource consumption vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit… |
CVE-2025-62853 | Medium | 6.5 | 2026-02-11 | A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability t… |
CVE-2025-59386 | Medium | 4.9 | 2026-02-11 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-58472 | Medium | 4.9 | 2026-02-11 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator account, they can then exploit… |
CVE-2025-58471 | Medium | 4.9 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator ac… |
CVE-2025-58470 | Medium | 6.5 | 2026-02-11 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-58467 | Medium | 6.5 | 2026-02-11 | A relative path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnera… |
CVE-2025-58466 | Medium | 4.9 | 2026-02-11 | A use of uninitialized variable vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator a… |
CVE-2025-57713 | High | 7.5 | 2026-02-11 | A weak authentication vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to gain sensitive infor… |
CVE-2025-57711 | Medium | 4.9 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator ac… |
CVE-2025-57710 | Medium | 4.9 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator ac… |
CVE-2025-57709 | High | 8.1 | 2026-02-11 | A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability t… |
CVE-2025-57708 | Medium | 6.5 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-57707 | High | 8.8 | 2026-02-11 | An improper neutralization of directives in statically saved code ('Static Code Injection') vulnerability has been reported to affect File Station 5. If a remo… |
CVE-2025-54170 | Medium | 6.5 | 2026-02-11 | An out-of-bounds read vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerabili… |
CVE-2025-54169 | Medium | 6.5 | 2026-02-11 | An out-of-bounds read vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerabil… |
CVE-2025-54163 | Medium | 4.9 | 2026-02-11 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can then exploit… |
CVE-2025-54162 | Medium | 4.9 | 2026-02-11 | A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator account, they can then exploit the vulne… |
CVE-2025-54161 | Medium | 4.9 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator a… |
CVE-2025-54155 | Medium | 4.9 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains an administrator a… |
CVE-2025-54152 | Medium | 6.5 | 2026-02-11 | A use of out-of-range pointer offset vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit… |
CVE-2025-54151 | Medium | 5.5 | 2026-02-11 | An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit t… |
CVE-2025-54150 | Medium | 5.5 | 2026-02-11 | An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit t… |
CVE-2025-54149 | Medium | 5.5 | 2026-02-11 | An uncontrolled resource consumption vulnerability has been reported to affect Qsync Central. If a local attacker gains a user account, they can then exploit t… |
CVE-2025-54148 | Medium | 6.5 | 2026-02-11 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-54147 | Medium | 6.5 | 2026-02-11 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-54146 | Medium | 6.5 | 2026-02-11 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-53598 | Medium | 6.5 | 2026-02-11 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-52870 | High | 8.1 | 2026-02-11 | A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability t… |
CVE-2025-52869 | High | 8.1 | 2026-02-11 | A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability t… |
CVE-2025-52868 | High | 8.1 | 2026-02-11 | A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability t… |
CVE-2025-48725 | High | 8.1 | 2026-02-11 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user account, they can then ex… |
CVE-2025-48724 | High | 8.1 | 2026-02-11 | A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability t… |
CVE-2025-48723 | High | 8.1 | 2026-02-11 | A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability t… |
CVE-2025-48722 | Medium | 6.5 | 2026-02-11 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-47209 | Medium | 6.5 | 2026-02-11 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-47205 | Medium | 4.9 | 2026-02-11 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-30276 | High | 8.8 | 2026-02-11 | An out-of-bounds write vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerabil… |
CVE-2025-30269 | High | 8.1 | 2026-02-11 | A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then… |
CVE-2025-30266 | Medium | 6.5 | 2026-02-11 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulner… |
CVE-2025-8099 | High | 7.5 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.8 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain c… |
CVE-2025-7659 | High | 8.0 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that could have allow… |
CVE-2025-14594 | Low | 3.5 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.11 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain… |
CVE-2025-14592 | Low | 3.7 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain c… |
CVE-2025-14560 | High | 7.3 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain c… |
CVE-2025-12575 | Medium | 5.4 | 2026-02-11 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain cond… |
CVE-2025-12073 | Medium | 4.3 | 2026-02-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.0 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain c… |
CVE-2025-10174 | High | 8.3 | 2026-02-11 | Cleartext Transmission of Sensitive Information vulnerability in Pan Software & Information Technologies Ltd. PanCafe Pro allows Flooding. This issue affects… |
CVE-2025-15096 | High | 8.8 | 2026-02-11 | The 'Videospirecore Theme Plugin' plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.6… |
CVE-2025-9986 | High | 8.2 | 2026-02-11 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vadi Corporate Information Systems Ltd. Co. DIGIKENT allows Excavat… |
CVE-2025-15440 | High | 7.2 | 2026-02-11 | The iONE360 configurator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Contact Form Parameters in all versions up to, and includin… |
CVE-2025-13651 | High | 7.5 | 2026-02-11 | Exposure of Sensitive System Information to an Unauthorized Actor vulnerability in Microcom ZeusWeb allows Web Application Fingerprinting of sensitive data. Th… |
CVE-2025-13650 | Medium | 6.1 | 2026-02-11 | An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is not necessary, but the action must be performed)… |
CVE-2025-13649 | Medium | 6.1 | 2026-02-11 | An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is not necessary, but the action must be performe… |
CVE-2025-13648 | Medium | 6.1 | 2026-02-11 | An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is required) who has the vulnerable software coul… |
CVE-2025-10913 | High | 8.3 | 2026-02-11 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saastech Cleaning and Internet Services Inc. Temiz… |
CVE-2025-10912 | Medium | 5.4 | 2026-02-11 | Authorization Bypass Through User-Controlled Key vulnerability in Saastech Cleaning and Internet Services Inc. TemizlikYolda allows Manipulating User-Controlle… |
CVE-2025-15400 | Medium | 6.5 | 2026-02-11 | The OpenPix for WooCommerce WordPress plugin through 2.13.3 allows any authenticated user to trigger AJAX actions that reset payment gateway configuration opti… |
CVE-2025-15524 | Medium | 4.3 | 2026-02-11 | The Gallery by FooGallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax_get_gallery_info() fu… |
CVE-2025-14541 | High | 7.2 | 2026-02-11 | The Lucky Wheel Giveaway plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.22 via the conditional_tags para… |
CVE-2025-13431 | Medium | 6.5 | 2026-02-11 | The SlimStat Analytics plugin for WordPress is vulnerable to time-based SQL Injection via the ‘args’ parameter in all versions up to, and including, 5.3.1 due… |
CVE-2025-12699 | Medium | 5.5 | 2026-02-10 | The ZOLL ePCR IOS application reflects unsanitized user input into a WebView. Attacker-controlled strings placed into PCR fields (run number, incident, call si… |
CVE-2025-54514 | | 2026-02-10 | Improper isolation of shared resources on a system on a chip by a malicious local attacker with high privileges could potentially lead to a partial loss of int… | |
CVE-2025-52536 | | 2026-02-10 | Improper Prevention of Lock Bit Modification in SEV firmware could allow a privileged attacker to downgrade firmware potentially resulting in a loss of integri… | |
CVE-2025-52534 | | 2026-02-10 | Improper bound check within AMD CPU microcode can allow a malicious guest to write to host memory, potentially resulting in loss of integrity. | |
CVE-2025-48517 | | 2026-02-10 | Insufficient Granularity of Access Control in SEV firmware could allow a privileged user with a malicious hypervisor to create a SEV-ES guest with an ASID in t… | |
CVE-2025-48515 | | 2026-02-10 | Insufficient parameter sanitization in AMD Secure Processor (ASP) Boot Loader could allow an attacker with access to SPIROM upgrade to overwrite the memory, po… | |
CVE-2025-48514 | | 2026-02-10 | Insufficient Granularity of Access Control in SEV firmware can allow a privileged attacker to create a SEV-ES Guest to attack SNP guest, potentially resulting… | |
CVE-2025-48509 | | 2026-02-10 | Missing Checks in certain functions related to RMP initialization can allow a local admin privileged attacker to cause misidentification of I/O memory, potenti… | |
CVE-2025-29952 | | 2026-02-10 | Improper Initialization within the AMD Secure Encrypted Virtualization (SEV) firmware can allow an admin privileged attacker to corrupt RMP covered memory, pot… | |
CVE-2025-29951 | | 2026-02-10 | A buffer overflow in the AMD Secure Processor (ASP) bootloader could allow an attacker to overwrite memory, potentially resulting in privilege escalation and a… | |
CVE-2025-29950 | | 2026-02-10 | Improper input validation in system management mode (SMM) could allow a privileged attacker to overwrite stack memory leading to arbitrary code execution. | |
CVE-2025-29949 | | 2026-02-10 | Insufficient input parameter sanitization in AMD Secure Processor (ASP) Boot Loader (legacy recovery mode only) could allow an attacker to write out-of-bounds… | |
CVE-2025-29948 | | 2026-02-10 | Improper access control in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to bypass RMP protections, potentially resulti… | |
CVE-2025-29946 | | 2026-02-10 | Insufficient or Incomplete Data Removal in Hardware Component in SEV firmware doesn't fully flush IOMMU. This can potentially lead to a loss of confidentiality… | |
CVE-2025-29939 | | 2026-02-10 | Improper access control in secure encrypted virtualization (SEV) could allow a privileged attacker to write to the reverse map page (RMP) during secure nested… | |
CVE-2025-0031 | | 2026-02-10 | A use after free in the SEV firmware could allow a malicous hypervisor to activate a migrated guest with the SINGLE_SOCKET policy on a different socket than th… | |
CVE-2025-0029 | | 2026-02-10 | Improper handling of error condition during host-induced faults can allow a local high-privileged attack to selectively drop guest DMA writes, potentially resu… | |
CVE-2025-0012 | | 2026-02-10 | Improper handling of overlap between the segmented reverse map table (RMP) and system management mode (SMM) memory could allow a privileged attacker corrupt or… | |
CVE-2025-36522 | Medium | 6.7 | 2026-02-10 | Incorrect default permissions for some Intel(R) Chipset Software before version 10.1.20266.8668 or later. within Ring 3: User Applications may allow an escalat… |
CVE-2025-36511 | Medium | 6.7 | 2026-02-10 | Incorrect default permissions for some Intel(R) Memory and Storage Tool before version 2.5.2 within Ring 3: User Applications may allow an escalation of privil… |
CVE-2025-35999 | Medium | 6.7 | 2026-02-10 | Incorrect permission assignment for critical resource for some System Firmware Update Utility (SysFwUpdt) for Intel(R) Server Boards and Intel(R) Server System… |
CVE-2025-35998 | High | 7.9 | 2026-02-10 | Missing protection mechanism for alternate hardware interface in the Intel(R) Quick Assist Technology for some Intel(R) Platforms within Ring 0: Kernel may all… |
CVE-2025-35992 | Medium | 4.7 | 2026-02-10 | Improper conditions check in some firmware for some Intel(R) NPU Drivers within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adv… |
CVE-2025-33030 | Low | 3.3 | 2026-02-10 | Improper conditions check in some firmware for some Intel(R) NPU Drivers within Ring 3: User Applications may allow an escalation of privilege. Unprivileged so… |