2025 CVEs (page 261)
Page 261 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-53540 | | 2025-07-07 | arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Several OTA update examples and the HTTPU… | |
CVE-2025-53539 | High | 7.5 | 2025-07-07 | FastAPI Guard is a security library for FastAPI that provides middleware to control IPs, log requests, and detect penetration attempts. fastapi-guard's penetra… |
CVE-2025-53496 | Medium | 5.4 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MediaSearch Exten… |
CVE-2025-7141 | Low | 2.4 | 2025-07-07 | A vulnerability classified as problematic was found in SourceCodester Best Salon Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2025-7140 | Low | 2.4 | 2025-07-07 | A vulnerability classified as problematic has been found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the file /panel… |
CVE-2025-6044 | Medium | 6.1 | 2025-07-07 | An Improper Access Control vulnerability in the Stylus Tools component of Google ChromeOS version 16238.64.0 on the garaged stylus devices allows a physical at… |
CVE-2025-53499 | Critical | 9.1 | 2025-07-07 | Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFi… |
CVE-2025-53498 | Medium | 5.3 | 2025-07-07 | Insufficient Logging vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Data Leakage Attacks.This issue affects Mediawiki - AbuseFi… |
CVE-2025-53495 | Critical | 9.1 | 2025-07-07 | Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFi… |
CVE-2025-53488 | Medium | 6.1 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiHiero Extensi… |
CVE-2025-53478 | Medium | 5.4 | 2025-07-07 | The CheckUser extension’s Special:Investigate interface is vulnerable to reflected XSS due to improper escaping of certain internationalized system messages re… |
CVE-2025-7139 | Low | 2.4 | 2025-07-07 | A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of t… |
CVE-2025-7138 | Medium | 6.3 | 2025-07-07 | A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the… |
CVE-2025-53536 | High | 8.1 | 2025-07-07 | Roo Code is an AI-powered autonomous coding agent. Prior to 3.22.6, if the victim had "Write" auto-approved, an attacker with the ability to submit prompts to… |
CVE-2025-53535 | | 2025-07-07 | Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affect… | |
CVE-2025-20325 | Low | 3.1 | 2025-07-07 | In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.113, and 9.2.2406.119, the… |
CVE-2025-20324 | Medium | 5.4 | 2025-07-07 | In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.7, and 9.1.10 and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, a lo… |
CVE-2025-20323 | Medium | 4.3 | 2025-07-07 | In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could turn of… |
CVE-2025-20322 | Medium | 4.3 | 2025-07-07 | In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, an… |
CVE-2025-20321 | Medium | 6.5 | 2025-07-07 | In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.114, and 9.2.2406.119, an u… |
CVE-2025-20320 | Medium | 6.3 | 2025-07-07 | In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.107, 9.3.2408.117, and 9.2.2406.121, a lo… |
CVE-2025-20319 | Medium | 6.8 | 2025-07-07 | In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a user who holds a role that contains the high-privilege capability `edit_scripted` and `l… |
CVE-2025-20300 | Medium | 4.3 | 2025-07-07 | In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.6, and 9.1.9 and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.112, and 9.2.2406.119, a low… |
CVE-2025-7137 | Medium | 6.3 | 2025-07-07 | A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been classified as critical. This affects an unknown part of the file /pan… |
CVE-2025-7136 | High | 7.3 | 2025-07-07 | A vulnerability, which was classified as critical, was found in Campcodes Online Recruitment Management System 1.0. Affected is an unknown function of the file… |
CVE-2025-53532 | Medium | 5.3 | 2025-07-07 | giscus is a commenting system powered by GitHub Discussions. A bug in giscus' discussions creation API allowed an unauthorized user to create discussions on an… |
CVE-2025-53531 | High | 7.5 | 2025-07-07 | WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This… |
CVE-2025-53530 | High | 7.5 | 2025-07-07 | WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This… |
CVE-2025-53529 | Critical | 9.8 | 2025-07-07 | WeGIA is a web manager for charitable institutions. An SQL Injection vulnerability was identified in the /html/funcionario/profile_funcionario.php endpoint. Th… |
CVE-2025-53527 | Critical | 9.8 | 2025-07-07 | WeGIA is a web manager for charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in the almox parameter of the /controle/relat… |
CVE-2025-53526 | Medium | 6.1 | 2025-07-07 | WeGIA is a web manager for charitable institutions. An XSS Injection vulnerability was identified in novo_memorando.php. After the memo was submitted, the vuln… |
CVE-2025-53525 | Medium | 6.1 | 2025-07-07 | WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the profile_familiar.php endpoint of… |
CVE-2025-53497 | Medium | 5.4 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - RelatedArticles E… |
CVE-2025-53491 | Medium | 5.4 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - FlaggedRevs Exten… |
CVE-2025-53377 | Medium | 6.1 | 2025-07-07 | WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the cadastro_dependente_pessoa_nova… |
CVE-2025-36014 | High | 8.2 | 2025-07-07 | IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.5 is vulnerable to code injection by a privileged user with access to the IIB install directory. |
CVE-2025-1351 | Medium | 6.7 | 2025-07-07 | IBM Storage Virtualize 8.5, 8.6, and 8.7 products could allow a user to escalate their privileges to that of another user logging in at the same time due to a… |
CVE-2025-7259 | Medium | 6.5 | 2025-07-07 | An authorized user can issue queries with duplicate _id fields, that leads to unexpected behavior in MongoDB Server, which may result to crash. This issue can… |
CVE-2025-7135 | High | 7.3 | 2025-07-07 | A vulnerability, which was classified as critical, has been found in Campcodes Online Recruitment Management System 1.0. This issue affects some unknown proces… |
CVE-2025-7134 | High | 7.3 | 2025-07-07 | A vulnerability classified as critical was found in Campcodes Online Recruitment Management System 1.0. This vulnerability affects unknown code of the file /ad… |
CVE-2025-7057 | Medium | 5.4 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Quiz Extension al… |
CVE-2025-53487 | Medium | 5.4 | 2025-07-07 | The ApprovedRevs extension for MediaWiki is vulnerable to stored XSS in multiple locations where system messages are inserted into raw HTML without proper esca… |
CVE-2025-53376 | High | 8.8 | 2025-07-07 | Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated, low-priv… |
CVE-2025-53375 | Medium | 6.5 | 2025-07-07 | Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated attacker… |
CVE-2025-53374 | Medium | 4.3 | 2025-07-07 | Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated low-privi… |
CVE-2025-53373 | | 2025-07-07 | Natours is a Tour Booking API. The attacker can easily take over any victim account by injecting an attacker-controlled server domain in the Host header when r… | |
CVE-2025-52492 | High | 7.5 | 2025-07-07 | A vulnerability has been discovered in the firmware of Paxton Paxton10 before 4.6 SR6. The firmware file, rootfs.tar.gz, contains hard-coded credentials for th… |
CVE-2025-48367 | High | 7.5 | 2025-07-07 | Redis is an open source, in-memory database that persists on disk. An unauthenticated connection can cause repeated IP protocol errors, leading to client starv… |
CVE-2025-47202 | Critical | 9.1 | 2025-07-07 | In RRC in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580, 9110, W920, W930… |
CVE-2025-45479 | Critical | 9.8 | 2025-07-07 | Insufficient security mechanisms for created containers in educoder challenges v1.0 allow attackers to execute arbitrary code via injecting crafted content int… |
CVE-2025-45065 | Critical | 9.8 | 2025-07-07 | employee record management system in php and mysql v1 was discovered to contain a SQL injection vulnerability via the loginerms.php endpoint. |
CVE-2025-43933 | Critical | 9.8 | 2025-07-07 | fblog through 983bede allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP he… |
CVE-2025-43932 | Critical | 9.8 | 2025-07-07 | JobCenter through 7e7b0b2 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTT… |
CVE-2025-43931 | Critical | 9.8 | 2025-07-07 | flask-boilerplate through a170e7c allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the… |
CVE-2025-32023 | High | 7.0 | 2025-07-07 | Redis is an open source, in-memory database that persists on disk. From 2.8 to before 8.0.3, 7.4.5, 7.2.10, and 6.2.19, an authenticated user may use a special… |
CVE-2025-26780 | High | 7.5 | 2025-07-07 | An issue was discovered in L2 in Samsung Mobile Processor and Modem Exynos 2400 and Modem 5400. The lack of a length check leads to a Denial of Service via a m… |
CVE-2025-7133 | Medium | 4.3 | 2025-07-07 | A vulnerability classified as problematic has been found in CodeAstro Online Movie Ticket Booking System 1.0. This affects an unknown part. The manipulation le… |
CVE-2025-7132 | High | 7.3 | 2025-07-07 | A vulnerability was found in Campcodes Payroll Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of th… |
CVE-2025-6811 | Critical | 9.8 | 2025-07-07 | Mescius ActiveReports.NET TypeResolutionService Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attacke… |
CVE-2025-6810 | Critical | 9.8 | 2025-07-07 | Mescius ActiveReports.NET ReadValue Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut… |
CVE-2025-6807 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole getDriverTmpPath Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sens… |
CVE-2025-6806 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole decryptFile Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbitrary fil… |
CVE-2025-6805 | Critical | 9.1 | 2025-07-07 | Marvell QConvergeConsole deleteEventLogFile Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arb… |
CVE-2025-6804 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole compressFirmwareDumpFiles Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disc… |
CVE-2025-6803 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole compressDriverFiles Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose s… |
CVE-2025-6802 | Critical | 9.8 | 2025-07-07 | Marvell QConvergeConsole getFileFromURL Unrestricted File Upload Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arb… |
CVE-2025-6801 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole saveNICParamsToFile Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbit… |
CVE-2025-6800 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole restoreESwitchConfig Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose… |
CVE-2025-6799 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole getFileUploadBytes Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose se… |
CVE-2025-6798 | Critical | 9.1 | 2025-07-07 | Marvell QConvergeConsole deleteAppFile Directory Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrar… |
CVE-2025-6797 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole getFileUploadBytes Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose se… |
CVE-2025-6796 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole getAppFileBytes Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensi… |
CVE-2025-6795 | High | 7.5 | 2025-07-07 | Marvell QConvergeConsole getFileUploadSize Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sen… |
CVE-2025-6794 | Critical | 9.8 | 2025-07-07 | Marvell QConvergeConsole saveAsText Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2025-6793 | Critical | 9.4 | 2025-07-07 | Marvell QConvergeConsole QLogicDownloadImpl Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability. This vulnerability allows rem… |
CVE-2025-6714 | High | 7.5 | 2025-07-07 | MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data. This affects MongoDB when configured… |
CVE-2025-6713 | High | 7.7 | 2025-07-07 | An unauthorized user may leverage a specially crafted aggregation pipeline to access data without proper authorization due to improper handling of the $mergeCu… |
CVE-2025-6712 | Medium | 6.5 | 2025-07-07 | MongoDB Server may be susceptible to disruption caused by high memory usage, potentially leading to server crash. This condition is linked to inefficiencies in… |
CVE-2025-6711 | Medium | 4.4 | 2025-07-07 | An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered… |
CVE-2025-6663 | High | 7.8 | 2025-07-07 | GStreamer H266 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary c… |
CVE-2025-5987 | High | 8.1 | 2025-07-07 | A flaw was found in libssh when using the ChaCha20 cipher with the OpenSSL library. If an attacker manages to exhaust the heap space, this error is not detecte… |
CVE-2025-53486 | Medium | 5.4 | 2025-07-07 | The WikiCategoryTagCloud extension is vulnerable to reflected XSS via the linkstyle attribute, which is improperly concatenated into inline HTML without escapi… |
CVE-2025-43930 | Critical | 9.8 | 2025-07-07 | Hashview 0.8.1 allows account takeover via the password reset feature because SERVER_NAME is not configured and thus a reset depends on the Host HTTP header. |
CVE-2025-7131 | High | 7.3 | 2025-07-07 | A vulnerability was found in Campcodes Payroll Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functional… |
CVE-2025-7130 | High | 7.3 | 2025-07-07 | A vulnerability was found in Campcodes Payroll Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /ajax.php… |
CVE-2025-7056 | Medium | 6.3 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - UrlShortener Exte… |
CVE-2025-7129 | High | 7.3 | 2025-07-07 | A vulnerability was found in Campcodes Payroll Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /ajax.p… |
CVE-2025-7128 | High | 7.3 | 2025-07-07 | A vulnerability has been found in Campcodes Payroll Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /ajax… |
CVE-2025-6209 | High | 7.5 | 2025-07-07 | A path traversal vulnerability exists in run-llama/llama_index versions 0.12.27 through 0.12.40, specifically within the `encode_image` function in `generic_ut… |
CVE-2025-7127 | Medium | 4.7 | 2025-07-07 | A vulnerability, which was classified as critical, was found in itsourcecode Employee Management System up to 1.0. This affects an unknown part of the file /ad… |
CVE-2025-7126 | Medium | 6.3 | 2025-07-07 | A vulnerability, which was classified as critical, has been found in itsourcecode Employee Management System up to 1.0. Affected by this issue is some unknown… |
CVE-2025-7125 | Medium | 6.3 | 2025-07-07 | A vulnerability classified as critical was found in itsourcecode Employee Management System up to 1.0. Affected by this vulnerability is an unknown functionali… |
CVE-2025-7124 | Medium | 6.3 | 2025-07-07 | A vulnerability classified as critical has been found in code-projects Online Note Sharing 1.0. Affected is an unknown function of the file /dashboard/userprof… |
CVE-2025-7123 | Medium | 4.7 | 2025-07-07 | A vulnerability was found in Campcodes Complaint Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /… |
CVE-2025-7122 | High | 7.3 | 2025-07-07 | A vulnerability was found in Campcodes Complaint Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /… |
CVE-2025-6386 | High | 7.5 | 2025-07-07 | The parisneo/lollms repository is affected by a timing attack vulnerability in the `authenticate_user` function within the `lollms_authentication.py` file. Thi… |
CVE-2025-6210 | Medium | 6.2 | 2025-07-07 | A vulnerability in the ObsidianReader class of the run-llama/llama_index repository, specifically in version 0.12.27, allows for hardlink-based path traversal… |
CVE-2025-5472 | Medium | 6.5 | 2025-07-07 | The JSONReader in run-llama/llama_index versions 0.12.28 is vulnerable to a stack overflow due to uncontrolled recursive JSON parsing. This vulnerability allow… |
CVE-2025-4779 | Medium | 6.1 | 2025-07-07 | lunary-ai/lunary versions prior to 1.9.24 are vulnerable to stored cross-site scripting (XSS). An unauthenticated attacker can inject malicious JavaScript into… |
CVE-2025-3777 | Low | 3.5 | 2025-07-07 | Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the `image_utils.py` file. The vulnerability aris… |