2025 CVEs (page 260)
Page 260 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48817 | High | 8.8 | 2025-07-08 | Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
CVE-2025-48816 | High | 7.8 | 2025-07-08 | Integer overflow or wraparound in HID class driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-48815 | High | 7.8 | 2025-07-08 | Access of resource using incompatible type ('type confusion') in Windows SSDP Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-48814 | High | 7.5 | 2025-07-08 | Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an unauthorized attacker to bypass a security feature over a ne… |
CVE-2025-48812 | Medium | 5.5 | 2025-07-08 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. |
CVE-2025-48811 | Medium | 6.7 | 2025-07-08 | Missing support for integrity check in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. |
CVE-2025-48810 | Medium | 5.5 | 2025-07-08 | Processor optimization removal or modification of security-critical code in Windows Secure Kernel Mode allows an authorized attacker to disclose information lo… |
CVE-2025-48809 | Medium | 5.5 | 2025-07-08 | Processor optimization removal or modification of security-critical code in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-48808 | Medium | 5.5 | 2025-07-08 | Exposure of sensitive information to an unauthorized actor in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-48806 | High | 7.8 | 2025-07-08 | Use after free in Microsoft MPEG-2 Video Extension allows an authorized attacker to execute code locally. |
CVE-2025-48805 | High | 7.8 | 2025-07-08 | Heap-based buffer overflow in Microsoft MPEG-2 Video Extension allows an authorized attacker to execute code locally. |
CVE-2025-48804 | Medium | 6.8 | 2025-07-08 | Acceptance of extraneous untrusted data with trusted data in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical att… |
CVE-2025-48803 | Medium | 6.7 | 2025-07-08 | Missing support for integrity check in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. |
CVE-2025-48802 | Medium | 6.5 | 2025-07-08 | Improper certificate validation in Windows SMB allows an authorized attacker to perform spoofing over a network. |
CVE-2025-48800 | Medium | 6.8 | 2025-07-08 | Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2025-48799 | High | 7.8 | 2025-07-08 | Improper link resolution before file access ('link following') in Windows Update Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-48003 | Medium | 6.8 | 2025-07-08 | Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2025-48002 | Medium | 5.7 | 2025-07-08 | Integer overflow or wraparound in Windows Hyper-V allows an authorized attacker to disclose information over an adjacent network. |
CVE-2025-48001 | Medium | 6.8 | 2025-07-08 | Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2025-48000 | High | 7.8 | 2025-07-08 | Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-47999 | Medium | 6.8 | 2025-07-08 | Missing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network. |
CVE-2025-47998 | High | 8.8 | 2025-07-08 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
CVE-2025-47996 | High | 7.8 | 2025-07-08 | Integer underflow (wrap or wraparound) in Windows MBT Transport driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-47994 | High | 7.8 | 2025-07-08 | Deserialization of untrusted data in Microsoft Office allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-47993 | High | 7.8 | 2025-07-08 | Improper access control in Microsoft PC Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-47991 | High | 7.8 | 2025-07-08 | Use after free in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally. |
CVE-2025-47988 | High | 7.5 | 2025-07-08 | Improper control of generation of code ('code injection') in Azure Monitor Agent allows an unauthorized attacker to execute code over an adjacent network. |
CVE-2025-47987 | High | 7.8 | 2025-07-08 | Heap-based buffer overflow in Windows Cred SSProvider Protocol allows an authorized attacker to elevate privileges locally. |
CVE-2025-47986 | High | 8.8 | 2025-07-08 | Use after free in Universal Print Management Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-47985 | High | 7.8 | 2025-07-08 | Untrusted pointer dereference in Windows Event Tracing allows an authorized attacker to elevate privileges locally. |
CVE-2025-47984 | High | 7.5 | 2025-07-08 | Protection mechanism failure in Windows GDI allows an unauthorized attacker to disclose information over a network. |
CVE-2025-47982 | High | 7.8 | 2025-07-08 | Improper input validation in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-47981 | Critical | 9.8 | 2025-07-08 | Heap-based buffer overflow in Windows SPNEGO Extended Negotiation allows an unauthorized attacker to execute code over a network. |
CVE-2025-47980 | Medium | 6.2 | 2025-07-08 | Exposure of sensitive information to an unauthorized actor in Windows Imaging Component allows an unauthorized attacker to disclose information locally. |
CVE-2025-47978 | Medium | 6.5 | 2025-07-08 | Out-of-bounds read in Windows Kerberos allows an authorized attacker to deny service over a network. |
CVE-2025-47976 | High | 7.8 | 2025-07-08 | Use after free in Windows SSDP Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-47975 | High | 7.0 | 2025-07-08 | Double free in Windows SSDP Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-47973 | High | 7.8 | 2025-07-08 | Buffer over-read in Virtual Hard Disk (VHDX) allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-47972 | High | 8.0 | 2025-07-08 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Input Method Editor (IME) allows an authorized attacke… |
CVE-2025-47971 | High | 7.8 | 2025-07-08 | Buffer over-read in Virtual Hard Disk (VHDX) allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-47178 | High | 8.0 | 2025-07-08 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to execut… |
CVE-2025-47159 | High | 7.8 | 2025-07-08 | Protection mechanism failure in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. |
CVE-2025-47109 | Medium | 5.5 | 2025-07-08 | After Effects versions 25.2, 24.6.6 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-service. An a… |
CVE-2025-43587 | Medium | 5.5 | 2025-07-08 | After Effects versions 25.2, 24.6.6 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2025-43580 | Medium | 5.5 | 2025-07-08 | Audition versions 25.2, 24.6.3 and earlier are affected by an Access of Memory Location After End of Buffer vulnerability that could result in application deni… |
CVE-2025-33054 | High | 8.1 | 2025-07-08 | Insufficient UI warning of dangerous operations in Remote Desktop Client allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-26636 | Medium | 5.5 | 2025-07-08 | Processor optimization removal or modification of security-critical code in Windows Kernel allows an authorized attacker to disclose information locally. |
CVE-2025-21195 | Medium | 6.0 | 2025-07-08 | Improper link resolution before file access ('link following') in Service Fabric allows an authorized attacker to elevate privileges locally. |
CVE-2025-21168 | Medium | 5.5 | 2025-07-08 | Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An atta… |
CVE-2025-21167 | Medium | 5.5 | 2025-07-08 | Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An atta… |
CVE-2025-21166 | High | 7.8 | 2025-07-08 | Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-21165 | High | 7.8 | 2025-07-08 | Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-21164 | High | 7.8 | 2025-07-08 | Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-7185 | High | 7.3 | 2025-07-08 | A vulnerability was found in code-projects Library System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /approve.p… |
CVE-2025-7184 | High | 7.3 | 2025-07-08 | A vulnerability was found in code-projects Library System 1.0. It has been classified as critical. This affects an unknown part of the file /user/teacher/books… |
CVE-2025-6771 | High | 7.2 | 2025-07-08 | OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2,12.4.0.3 and 12.3.0.3 allows a remote authenticated attacker with high p… |
CVE-2025-5464 | Medium | 6.5 | 2025-07-08 | Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 allows a local authenticated attacker to obtain that inform… |
CVE-2025-43019 | High | 7.8 | 2025-07-08 | A potential security vulnerability has been identified in the HP Support Assistant, which allows a local attacker to escalate privileges via an arbitrary file… |
CVE-2025-3648 | | 2025-07-08 | A vulnerability has been identified in the Now Platform that could result in data being inferred without authorization. Under certain conditional access contro… | |
CVE-2025-0293 | Medium | 6.6 | 2025-07-08 | CLRF injection in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with ad… |
CVE-2025-0292 | Medium | 5.5 | 2025-07-08 | SSRF in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated attacker with admin rights… |
CVE-2025-7326 | High | 7.0 | 2025-07-08 | Weak authentication in EOL ASP.NET Core allows an unauthorized attacker to elevate privileges over a network. NOTE: This CVE affects only End Of Life (EOL) so… |
CVE-2025-7183 | High | 7.3 | 2025-07-08 | A vulnerability was found in Campcodes Sales and Inventory System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the f… |
CVE-2025-7182 | Medium | 4.3 | 2025-07-08 | A vulnerability has been found in itsourcecode Student Transcript Processing System 1.0 and classified as problematic. Affected by this vulnerability is an unk… |
CVE-2025-7037 | High | 7.2 | 2025-07-08 | SQL injection in Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a remote authenticated attacker with admin privileges to… |
CVE-2025-6996 | High | 8.4 | 2025-07-08 | Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker… |
CVE-2025-6995 | High | 8.4 | 2025-07-08 | Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker… |
CVE-2025-6770 | High | 7.2 | 2025-07-08 | OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2 allows a remote authenticated attacker with high privileges to achieve re… |
CVE-2025-5463 | Medium | 5.5 | 2025-07-08 | Insertion of sensitive information into a log file in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a l… |
CVE-2025-5451 | Medium | 4.9 | 2025-07-08 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1.5 allows a remote authenticated a… |
CVE-2025-5450 | Medium | 6.3 | 2025-07-08 | Improper access control in the certificate management component of Ivanti Connect Secure before version 22.7R2.8 and Ivanti Policy Secure before version 22.7R1… |
CVE-2025-53545 | | 2025-07-08 | Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service (SaaS). Users can circumvent 2F… | |
CVE-2025-53480 | Medium | 5.4 | 2025-07-08 | The CheckUser extension’s Special:Investigate page has a vulnerability in the Account information tab, where specific internationalized messages are rendered w… |
CVE-2025-53372 | High | 7.5 | 2025-07-08 | node-code-sandbox-mcp is a Node.js–based Model Context Protocol server that spins up disposable Docker containers to execute arbitrary JavaScript. Prior to 1.3… |
CVE-2025-3630 | Medium | 6.4 | 2025-07-08 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6, 6.2.0.0 through 6.2.0.4, IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 … |
CVE-2025-36600 | High | 8.2 | 2025-07-08 | Dell Client Platform BIOS contains an Improper Access Control Applied to Mirrored or Aliased Memory Regions vulnerability in an externally developed component… |
CVE-2025-2827 | Medium | 4.3 | 2025-07-08 | IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 could disclose sensitive installation directory information to an authent… |
CVE-2025-2793 | Medium | 5.4 | 2025-07-08 | IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.6, 6.2.0.0 through 6.2.0.4, IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6, and 6.2.0.0 through 6.2.0.4 … |
CVE-2025-29267 | Medium | 6.5 | 2025-07-08 | SQL Injection vulnerability in Abis, Inc Adjutant Core Accounting ERP build v.PreBeta250F allows a remote attacker to obtain a sensitive information via the ci… |
CVE-2025-24474 | Low | 2.7 | 2025-07-08 | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] in FortiManager 7.6.0 through 7.6.1, 7.4.0 throu… |
CVE-2025-7345 | High | 7.5 | 2025-07-08 | A flaw exists in gdk‑pixbuf within the gdk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c). When pro… |
CVE-2025-7181 | Medium | 6.3 | 2025-07-08 | A vulnerability, which was classified as critical, was found in code-projects Staff Audit System 1.0. Affected is an unknown function of the file /test.php. Th… |
CVE-2025-7180 | High | 7.3 | 2025-07-08 | A vulnerability, which was classified as critical, has been found in code-projects Staff Audit System 1.0. This issue affects some unknown processing of the fi… |
CVE-2025-47422 | High | 7.5 | 2025-07-08 | Advanced Installer before 22.6 has an uncontrolled search path element local privilege escalation vulnerability. When running as SYSTEM in certain configuratio… |
CVE-2025-7179 | High | 7.3 | 2025-07-08 | A vulnerability classified as critical was found in code-projects Library System 1.0. This vulnerability affects unknown code of the file /add-teacher.php. The… |
CVE-2025-7178 | High | 7.3 | 2025-07-08 | A vulnerability classified as critical has been found in code-projects Food Distributor Site 1.0. This affects an unknown part of the file /admin/login.php. Th… |
CVE-2025-50130 | High | 7.8 | 2025-07-08 | A heap-based buffer overflow vulnerability exists in VS6Sim.exe contained in V-SFT and TELLUS provided by FUJI ELECTRIC CO., LTD. Opening V9 files or X1 files… |
CVE-2025-27061 | High | 7.8 | 2025-07-08 | Memory corruption whhile handling the subsystem failure memory during the parsing of video packets received from the video firmware. |
CVE-2025-27058 | High | 7.8 | 2025-07-08 | Memory corruption while processing packet data with exceedingly large packet. |
CVE-2025-27057 | High | 7.5 | 2025-07-08 | Transient DOS while handling beacon frames with invalid IE header length. |
CVE-2025-27056 | High | 7.8 | 2025-07-08 | Memory corruption during sub-system restart while processing clean-up to free up resources. |
CVE-2025-27055 | High | 7.8 | 2025-07-08 | Memory corruption during the image encoding process. |
CVE-2025-27052 | High | 7.8 | 2025-07-08 | Memory corruption while processing data packets in diag received from Unix clients. |
CVE-2025-27051 | High | 7.8 | 2025-07-08 | Memory corruption while processing command message in WLAN Host. |
CVE-2025-27050 | High | 7.8 | 2025-07-08 | Memory corruption while processing event close when client process terminates abruptly. |
CVE-2025-27047 | High | 7.8 | 2025-07-08 | Memory corruption while processing the TESTPATTERNCONFIG escape path. |
CVE-2025-27046 | High | 7.8 | 2025-07-08 | Memory corruption while processing multiple simultaneous escape calls. |
CVE-2025-27044 | High | 7.8 | 2025-07-08 | Memory corruption while executing timestamp video decode command with large input values. |
CVE-2025-27043 | High | 7.8 | 2025-07-08 | Memory corruption while processing manipulated payload in video firmware. |
CVE-2025-27042 | High | 7.8 | 2025-07-08 | Memory corruption while processing video packets received from video firmware. |