2025 CVEs (page 262)
Page 262 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-20694 | Medium | 6.5 | 2025-07-08 | In Bluetooth FW, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-20693 | Medium | 6.5 | 2025-07-08 | In wlan STA driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote (proximal/adjacent) information disclosu… |
CVE-2025-20692 | Medium | 5.5 | 2025-07-08 | In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution… |
CVE-2025-20691 | Medium | 5.5 | 2025-07-08 | In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution… |
CVE-2025-20690 | Medium | 5.5 | 2025-07-08 | In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution… |
CVE-2025-20689 | Medium | 5.5 | 2025-07-08 | In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution… |
CVE-2025-20688 | Medium | 5.5 | 2025-07-08 | In wlan AP driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with User execution… |
CVE-2025-20687 | Medium | 5.5 | 2025-07-08 | In Bluetooth driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local denial of service with User execution pr… |
CVE-2025-20686 | High | 8.8 | 2025-07-08 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with… |
CVE-2025-20685 | High | 8.8 | 2025-07-08 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote (proximal/adjacent) code execution with… |
CVE-2025-20684 | Critical | 9.8 | 2025-07-08 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User executi… |
CVE-2025-20683 | Critical | 9.8 | 2025-07-08 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User executi… |
CVE-2025-20682 | Critical | 9.8 | 2025-07-08 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User executi… |
CVE-2025-20681 | Critical | 9.8 | 2025-07-08 | In wlan AP driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User executi… |
CVE-2025-20680 | Critical | 9.8 | 2025-07-08 | In Bluetooth driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execu… |
CVE-2025-7156 | Medium | 6.3 | 2025-07-08 | A vulnerability has been found in hitsz-ids airda 0.0.3 and classified as critical. This vulnerability affects the function execute of the file /v1/chat/comple… |
CVE-2025-7146 | High | 7.5 | 2025-07-08 | The iPublish System developed by Jhenggao has an Arbitrary File Reading vulnerability, allowing unauthenticated remote attackers to read arbitrary system file. |
CVE-2025-7155 | High | 7.3 | 2025-07-08 | A vulnerability, which was classified as critical, was found in PHPGurukul Online Notes Sharing System 1.0. This affects an unknown part of the file /Dashboard… |
CVE-2025-7154 | Medium | 6.3 | 2025-07-08 | A vulnerability, which was classified as critical, has been found in TOTOLINK N200RE 9.3.5u.6095_B20200916/9.3.5u.6139_B20201216. Affected by this issue is the… |
CVE-2025-43001 | Medium | 6.9 | 2025-07-08 | SAPCAR allows an attacker logged in with high privileges to override the permissions of the current and parent directories of the user or process extracting th… |
CVE-2025-42992 | Medium | 6.9 | 2025-07-08 | SAPCAR allows an attacker logged in with high privileges to create a malicious SAR archive in SAPCAR. This could enable the attacker to exploit critical files… |
CVE-2025-42986 | Medium | 4.3 | 2025-07-08 | Due to a missing authorization check in an obsolete RFC enabled function module in SAP BASIS, an authenticated low-privileged attacker could call a Remote Func… |
CVE-2025-42985 | Medium | 6.1 | 2025-07-08 | Due to insufficient sanitization in the SAP BusinessObjects Content Administrator Workbench, attackers could craft malicious URLs and execute scripts in a vict… |
CVE-2025-42981 | Medium | 6.1 | 2025-07-08 | Due to an open redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft a URL link embedding a malicious script… |
CVE-2025-42980 | Critical | 9.1 | 2025-07-08 | SAP NetWeaver Enterprise Portal Federated Portal Network is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialize… |
CVE-2025-42979 | Medium | 5.6 | 2025-07-08 | The GuiXT application, which is integrated with SAP GUI for Windows, uses obfuscation algorithms instead of secure symmetric ciphers for storing the credential… |
CVE-2025-42978 | Low | 3.5 | 2025-07-08 | The widely used component that establishes outbound TLS connections in SAP NetWeaver Application Server Java does not reliably match the hostname that is used… |
CVE-2025-42974 | Medium | 4.3 | 2025-07-08 | Due to missing authorization check, an attacker authenticated as a non-administrative user could call a remote-enabled function module. This could enable acces… |
CVE-2025-42973 | Medium | 5.4 | 2025-07-08 | Due to a Cross-Site Scripting vulnerability in SAP Data Services Management Console, an authenticated attacker could exploit the search functionality associate… |
CVE-2025-42971 | Medium | 4.0 | 2025-07-08 | A memory corruption vulnerability exists in SAPCAR allowing an attacker to craft malicious SAPCAR archives. When a high privileged victim extracts this malicio… |
CVE-2025-42970 | Medium | 5.8 | 2025-07-08 | SAPCAR improperly sanitizes the file paths while extracting SAPCAR archives. Due to this, an attacker could craft a malicious SAPCAR archive containing directo… |
CVE-2025-42969 | Medium | 6.1 | 2025-07-08 | SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject a malicious script into a dynamically crafted URL. The vic… |
CVE-2025-42968 | Medium | 5.0 | 2025-07-08 | SAP NetWeaver allows an authenticated non-administrative user to call the remote-enabled function module which could grants access to non-sensitive information… |
CVE-2025-42967 | Critical | 9.9 | 2025-07-08 | SAP S/4HANA and SAP SCM Characteristic Propagation has remote code execution vulnerability. This allows an attacker with user level privileges to create a new… |
CVE-2025-42966 | Critical | 9.1 | 2025-07-08 | SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java deserialization vulnerabil… |
CVE-2025-42965 | Medium | 4.1 | 2025-07-08 | SAP CMC Promotion Management allows an authenticated attacker to enumerate internal network systems by submitting crafted requests during job source configurat… |
CVE-2025-42964 | Critical | 9.1 | 2025-07-08 | SAP NetWeaver Enterprise Portal Administration is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could p… |
CVE-2025-42963 | Critical | 9.1 | 2025-07-08 | A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe Java object deseri… |
CVE-2025-42962 | Medium | 6.1 | 2025-07-08 | SAP Business Warehouse (Business Explorer Web) allows an attacker to create a malicious link. If an authenticated user clicks on this link, the injected script… |
CVE-2025-42961 | Medium | 4.9 | 2025-07-08 | Due to a missing authorization check in SAP NetWeaver Application server for ABAP, an authenticated user with high privileges could exploit the insufficient va… |
CVE-2025-42960 | Medium | 4.3 | 2025-07-08 | SAP Business Warehouse and SAP BW/4HANA BEx Tools allow an authenticated attacker to gain higher access levels than intended by exploiting improper authorizati… |
CVE-2025-42959 | High | 8.1 | 2025-07-08 | An unauthenticated attacker may exploit a scenario where a Hashed Message Authentication Code (HMAC) credential, extracted from a system missing specific secur… |
CVE-2025-42954 | Low | 2.7 | 2025-07-08 | SAP NetWeaver Business Warehouse CCAW application allows a privileged attacker to cause a high CPU load by executing a RFC enabled function modules without any… |
CVE-2025-42953 | High | 8.1 | 2025-07-08 | SAP Netweaver System Configuration does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This could… |
CVE-2025-42952 | High | 7.7 | 2025-07-08 | SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to add fields to arbitrary SAP database tables and/or structures, potentially ren… |
CVE-2025-31326 | Medium | 4.1 | 2025-07-08 | SAP�BusinessObjects Business�Intelligence Platform (Web Intelligence) is vulnerable to HTML Injection, allowing an attacker with basic user privileges to injec… |
CVE-2025-7153 | Low | 3.5 | 2025-07-08 | A vulnerability classified as problematic was found in CodeAstro Simple Hospital Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2025-7152 | Medium | 6.3 | 2025-07-08 | A vulnerability classified as critical has been found in Campcodes Advanced Online Voting System 1.0. Affected is an unknown function of the file /admin/candid… |
CVE-2025-7151 | Medium | 6.3 | 2025-07-07 | A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been rated as critical. This issue affects some unknown processing of the file… |
CVE-2025-7150 | Medium | 6.3 | 2025-07-07 | A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file… |
CVE-2025-7149 | Medium | 6.3 | 2025-07-07 | A vulnerability was found in Campcodes Advanced Online Voting System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/c… |
CVE-2025-7148 | Low | 3.5 | 2025-07-07 | A vulnerability was found in CodeAstro Simple Hospital Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionalit… |
CVE-2025-7147 | High | 7.3 | 2025-07-07 | A vulnerability has been found in CodeAstro Patient Record Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown funct… |
CVE-2025-7144 | Low | 2.4 | 2025-07-07 | A vulnerability has been found in SourceCodester Best Salon Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the… |
CVE-2025-7143 | Low | 2.4 | 2025-07-07 | A vulnerability, which was classified as problematic, was found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /p… |
CVE-2025-7142 | Low | 2.4 | 2025-07-07 | A vulnerability, which was classified as problematic, has been found in SourceCodester Best Salon Management System 1.0. Affected by this issue is some unknown… |
CVE-2025-53543 | Medium | 4.2 | 2025-07-07 | Kestra is an event-driven orchestration platform. The error message in execution "Overview" tab is vulnerable to stored XSS due to improper handling of HTTP re… |
CVE-2025-53540 | | 2025-07-07 | arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Several OTA update examples and the HTTPU… | |
CVE-2025-53539 | High | 7.5 | 2025-07-07 | FastAPI Guard is a security library for FastAPI that provides middleware to control IPs, log requests, and detect penetration attempts. fastapi-guard's penetra… |
CVE-2025-53496 | Medium | 5.4 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - MediaSearch Exten… |
CVE-2025-7141 | Low | 2.4 | 2025-07-07 | A vulnerability classified as problematic was found in SourceCodester Best Salon Management System 1.0. Affected by this vulnerability is an unknown functional… |
CVE-2025-7140 | Low | 2.4 | 2025-07-07 | A vulnerability classified as problematic has been found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the file /panel… |
CVE-2025-6044 | Medium | 6.1 | 2025-07-07 | An Improper Access Control vulnerability in the Stylus Tools component of Google ChromeOS version 16238.64.0 on the garaged stylus devices allows a physical at… |
CVE-2025-53499 | Critical | 9.1 | 2025-07-07 | Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFi… |
CVE-2025-53498 | Medium | 5.3 | 2025-07-07 | Insufficient Logging vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Data Leakage Attacks.This issue affects Mediawiki - AbuseFi… |
CVE-2025-53495 | Critical | 9.1 | 2025-07-07 | Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFi… |
CVE-2025-53488 | Medium | 6.1 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - WikiHiero Extensi… |
CVE-2025-53478 | Medium | 5.4 | 2025-07-07 | The CheckUser extension’s Special:Investigate interface is vulnerable to reflected XSS due to improper escaping of certain internationalized system messages re… |
CVE-2025-7139 | Low | 2.4 | 2025-07-07 | A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of t… |
CVE-2025-7138 | Medium | 6.3 | 2025-07-07 | A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the… |
CVE-2025-53536 | High | 8.1 | 2025-07-07 | Roo Code is an AI-powered autonomous coding agent. Prior to 3.22.6, if the victim had "Write" auto-approved, an attacker with the ability to submit prompts to… |
CVE-2025-53535 | | 2025-07-07 | Better Auth is an authentication and authorization library for TypeScript. An open redirect has been found in the originCheck middleware function, which affect… | |
CVE-2025-20325 | Low | 3.1 | 2025-07-07 | In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.113, and 9.2.2406.119, the… |
CVE-2025-20324 | Medium | 5.4 | 2025-07-07 | In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.7, and 9.1.10 and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, a lo… |
CVE-2025-20323 | Medium | 4.3 | 2025-07-07 | In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a low-privileged user that does not hold the "admin" or "power" Splunk roles could turn of… |
CVE-2025-20322 | Medium | 4.3 | 2025-07-07 | In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.113, and 9.2.2406.119, an… |
CVE-2025-20321 | Medium | 6.5 | 2025-07-07 | In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.104, 9.3.2408.114, and 9.2.2406.119, an u… |
CVE-2025-20320 | Medium | 6.3 | 2025-07-07 | In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7 and 9.1.10, and Splunk Cloud Platform versions below 9.3.2411.107, 9.3.2408.117, and 9.2.2406.121, a lo… |
CVE-2025-20319 | Medium | 6.8 | 2025-07-07 | In Splunk Enterprise versions below 9.4.3, 9.3.5, 9.2.7, and 9.1.10, a user who holds a role that contains the high-privilege capability `edit_scripted` and `l… |
CVE-2025-20300 | Medium | 4.3 | 2025-07-07 | In Splunk Enterprise versions below 9.4.2, 9.3.5, 9.2.6, and 9.1.9 and Splunk Cloud Platform versions below 9.3.2411.103, 9.3.2408.112, and 9.2.2406.119, a low… |
CVE-2025-7137 | Medium | 6.3 | 2025-07-07 | A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been classified as critical. This affects an unknown part of the file /pan… |
CVE-2025-7136 | High | 7.3 | 2025-07-07 | A vulnerability, which was classified as critical, was found in Campcodes Online Recruitment Management System 1.0. Affected is an unknown function of the file… |
CVE-2025-53532 | Medium | 5.3 | 2025-07-07 | giscus is a commenting system powered by GitHub Discussions. A bug in giscus' discussions creation API allowed an unauthorized user to create discussions on an… |
CVE-2025-53531 | High | 7.5 | 2025-07-07 | WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This… |
CVE-2025-53530 | High | 7.5 | 2025-07-07 | WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This… |
CVE-2025-53529 | Critical | 9.8 | 2025-07-07 | WeGIA is a web manager for charitable institutions. An SQL Injection vulnerability was identified in the /html/funcionario/profile_funcionario.php endpoint. Th… |
CVE-2025-53527 | Critical | 9.8 | 2025-07-07 | WeGIA is a web manager for charitable institutions. A Time-Based Blind SQL Injection vulnerability was discovered in the almox parameter of the /controle/relat… |
CVE-2025-53526 | Medium | 6.1 | 2025-07-07 | WeGIA is a web manager for charitable institutions. An XSS Injection vulnerability was identified in novo_memorando.php. After the memo was submitted, the vuln… |
CVE-2025-53525 | Medium | 6.1 | 2025-07-07 | WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the profile_familiar.php endpoint of… |
CVE-2025-53497 | Medium | 5.4 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - RelatedArticles E… |
CVE-2025-53491 | Medium | 5.4 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - FlaggedRevs Exten… |
CVE-2025-53377 | Medium | 6.1 | 2025-07-07 | WeGIA is a web manager for charitable institutions. A Reflected Cross-Site Scripting (XSS) vulnerability was identified in the cadastro_dependente_pessoa_nova… |
CVE-2025-36014 | High | 8.2 | 2025-07-07 | IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.5 is vulnerable to code injection by a privileged user with access to the IIB install directory. |
CVE-2025-1351 | Medium | 6.7 | 2025-07-07 | IBM Storage Virtualize 8.5, 8.6, and 8.7 products could allow a user to escalate their privileges to that of another user logging in at the same time due to a… |
CVE-2025-7259 | Medium | 6.5 | 2025-07-07 | An authorized user can issue queries with duplicate _id fields, that leads to unexpected behavior in MongoDB Server, which may result to crash. This issue can… |
CVE-2025-7135 | High | 7.3 | 2025-07-07 | A vulnerability, which was classified as critical, has been found in Campcodes Online Recruitment Management System 1.0. This issue affects some unknown proces… |
CVE-2025-7134 | High | 7.3 | 2025-07-07 | A vulnerability classified as critical was found in Campcodes Online Recruitment Management System 1.0. This vulnerability affects unknown code of the file /ad… |
CVE-2025-7057 | Medium | 5.4 | 2025-07-07 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Quiz Extension al… |
CVE-2025-53487 | Medium | 5.4 | 2025-07-07 | The ApprovedRevs extension for MediaWiki is vulnerable to stored XSS in multiple locations where system messages are inserted into raw HTML without proper esca… |
CVE-2025-53376 | High | 8.8 | 2025-07-07 | Dokploy is a self-hostable Platform as a Service (PaaS) that simplifies the deployment and management of applications and databases. An authenticated, low-priv… |