2025 CVEs (page 263)
Page 263 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-53485 | High | 7.5 | 2025-07-04 | SetTranslationHandler.php does not validate that the user is an election admin, allowing any (even unauthenticated) user to change election-related translation… |
CVE-2025-53484 | Critical | 9.8 | 2025-07-04 | User-controlled inputs are improperly escaped in: * VotePage.php (poll option input) * ResultPage::getPagesTab() and getErrorsTab() (user-contro… |
CVE-2025-53483 | High | 8.8 | 2025-07-04 | ArchivePage.php, UnarchivePage.php, and VoterEligibilityPage#executeClear() do not validate request methods or CSRF tokens, allowing attackers to trigger sensi… |
CVE-2025-53482 | Medium | 6.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - IPInfo Extension… |
CVE-2025-53481 | High | 7.5 | 2025-07-04 | Uncontrolled Resource Consumption vulnerability in Wikimedia Foundation Mediawiki - IPInfo Extension allows Excessive Allocation.This issue affects Mediawiki -… |
CVE-2025-52497 | Medium | 4.8 | 2025-07-04 | Mbed TLS before 3.6.4 has a PEM parsing one-byte heap-based buffer underflow, in mbedtls_pem_read_buffer and two mbedtls_pk_parse functions, via untrusted PEM… |
CVE-2025-52496 | High | 7.8 | 2025-07-04 | Mbed TLS before 3.6.4 has a race condition in AESNI detection if certain compiler optimizations occur. An attacker may be able to extract an AES key from a mul… |
CVE-2025-49601 | Medium | 4.8 | 2025-07-04 | In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_import_public_key does not check that the input buffer is at least 4 bytes before reading a 32-bit field, allowing a… |
CVE-2025-49600 | Medium | 4.9 | 2025-07-04 | In MbedTLS 3.3.0 before 3.6.4, mbedtls_lms_verify may accept invalid signatures if hash computation fails and internal errors go unchecked, enabling LMS (Leigh… |
CVE-2025-46733 | High | 7.9 | 2025-07-04 | OP-TEE is a Trusted Execution Environment (TEE) designed as companion to a non-secure Linux kernel running on Arm; Cortex-A cores using the TrustZone technolog… |
CVE-2025-38234 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: sched/rt: Fix race in push_rt_task Overview ======== When a CPU chooses to call push_rt_t… |
CVE-2025-38233 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: powerpc64/ftrace: fix clobbered r15 during livepatching While r15 is clobbered always wit… |
CVE-2025-38232 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: NFSD: fix race between nfsd registration and exports_proc As of now nfsd calls create_pro… |
CVE-2025-38231 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: nfsd: Initialize ssc before laundromat_work to prevent NULL dereference In nfs4_state_sta… |
CVE-2025-38230 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: jfs: validate AG parameters in dbMount() to prevent crashes Validate db_agheight, db_agwi… |
CVE-2025-38229 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: media: cxusb: no longer judge rbuf when the write fails syzbot reported a uninit-value in… |
CVE-2025-38228 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: media: imagination: fix a potential memory leak in e5010_probe() Add video_device_release… |
CVE-2025-38227 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: media: vidtv: Terminating the subsequent process of initialization failure syzbot reporte… |
CVE-2025-38226 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: media: vivid: Change the siize of the composing syzkaller found a bug: BUG: KASAN: vmall… |
CVE-2025-38225 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: media: imx-jpeg: Cleanup after an allocation error When allocation failures are not clean… |
CVE-2025-38224 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: can: kvaser_pciefd: refine error prone echo_skb_max handling logic echo_skb_max should de… |
CVE-2025-38223 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: ceph: avoid kernel BUG for encrypted inode with unaligned file size The generic/397 test… |
CVE-2025-38222 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: ext4: inline: fix len overflow in ext4_prepare_inline_data When running the following cod… |
CVE-2025-38221 | High | 7.1 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix out of bounds punch offset Punching a hole with a start offset that exceeds max… |
CVE-2025-38220 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: ext4: only dirty folios when data journaling regular files fstest generic/388 occasionall… |
CVE-2025-38219 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: f2fs: prevent kernel warning due to negative i_nlink from corrupted image WARNING: CPU: 1… |
CVE-2025-38218 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on sit_bitmap_size w/ below testcase, resize will generate a… |
CVE-2025-38217 | Medium | 4.7 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (ftsteutates) Fix TOCTOU race in fts_read() In the fts_read() function, when handl… |
CVE-2025-38216 | High | 8.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Restore context entry setup order for aliased devices Commit 2031c469f816 ("i… |
CVE-2025-38215 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var If fb… |
CVE-2025-38214 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var If fb_add_videomod… |
CVE-2025-38212 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: ipc: fix to protect IPCS lookups using RCU syzbot reported that it discovered a use-after… |
CVE-2025-38211 | Critical | 9.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction The commit 59c68ac3… |
CVE-2025-38210 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: configfs-tsm-report: Fix NULL dereference of tsm_ops Unlike sysfs, the lifetime of config… |
CVE-2025-38209 | Critical | 9.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: remove tag set when second admin queue config fails Commit 104d0e2f6222 ("nvme-… |
CVE-2025-38208 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: smb: client: add NULL check in automount_fullpath page is checked for null in __build_pat… |
CVE-2025-38207 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: mm: fix uprobe pte be overwritten when expanding vma Patch series "Fix uprobe pte be over… |
CVE-2025-38206 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: exfat: fix double free in delayed_free The double free could happen in the following path… |
CVE-2025-38205 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid divide by zero by initializing dummy pitch to 1 [Why] If the dummy… |
CVE-2025-38204 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: jfs: fix array-index-out-of-bounds read in add_missing_indices stbl is s8 but it must con… |
CVE-2025-38203 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: jfs: Fix null-ptr-deref in jfs_ioc_trim [ Syzkaller Report ] Oops: general protection fa… |
CVE-2025-38202 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: bpf: Check rcu_read_lock_trace_held() in bpf_map_lookup_percpu_elem() bpf_map_lookup_perc… |
CVE-2025-38201 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX Otherwise, it is poss… |
CVE-2025-38200 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: i40e: fix MMIO write access to an invalid page in i40e_clear_hw When the device sends a s… |
CVE-2025-38199 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix memory leak due to multiple rx_stats allocation rx_stats for each arsta… |
CVE-2025-38198 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: fbcon: Make sure modelist not set on unregistered console It looks like attempting to wri… |
CVE-2025-38197 | High | 7.3 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell_rbu: Fix list usage Pass the correct list head to list_for_each_entry*… |
CVE-2025-38196 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: validate buffer count with offset for cloning syzbot reports that it can t… |
CVE-2025-38195 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() ERROR INFO: CPU 25 Unable t… |
CVE-2025-38194 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: jffs2: check that raw node were preallocated before writing summary Syzkaller detected a… |
CVE-2025-38193 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: reject invalid perturb period Gerrard Tai reported that SFQ perturb_p… |
CVE-2025-38192 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: net: clear the dst when changing skb protocol A not-so-careful NAT46 BPF program can cras… |
CVE-2025-38191 | High | 7.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in destroy_previous_session If client set ->PreviousS… |
CVE-2025-38190 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: atm: Revert atm_account_tx() if copy_from_iter_full() fails. In vcc_sendmsg(), we account… |
CVE-2025-38189 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` The following kernel… |
CVE-2025-38188 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE Calling this packet is necessary when we switch… |
CVE-2025-38187 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() The RPC container is released af… |
CVE-2025-38186 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() Before the commit unde… |
CVE-2025-38185 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: atm: atmtcp: Free invalid length skb in atmtcp_c_send(). syzbot reported the splat below… |
CVE-2025-38184 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer The reproduction ste… |
CVE-2025-38183 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() Befor… |
CVE-2025-38182 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: ublk: santizize the arguments from userspace when adding a device Sanity check the values… |
CVE-2025-38181 | High | 7.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). syzkaller reported a null-ptr… |
CVE-2025-38180 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: net: atm: fix /proc/net/atm/lec handling /proc/net/atm/lec must ensure safety against dev… |
CVE-2025-38179 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() This fixes the followin… |
CVE-2025-7061 | Low | 2.7 | 2025-07-04 | A vulnerability was found in Intelbras InControl up to 2.21.60.9. It has been declared as problematic. This vulnerability affects unknown code of the file /v1/… |
CVE-2025-49809 | High | 7.8 | 2025-07-04 | mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: mtr on macOS may of… |
CVE-2025-48172 | Medium | 5.6 | 2025-07-04 | CHMLib through 2bef8d0, as used in SumatraPDF and other products, has a chm_lib.c _chm_decompress_block integer overflow. There is a resultant heap-based buffe… |
CVE-2025-38177 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make hfsc_qlen_notify() idempotent hfsc_qlen_notify() is not idempotent either… |
CVE-2025-7066 | Medium | 6.1 | 2025-07-04 | Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents could be exploited for cross site scri… |
CVE-2025-6740 | Medium | 6.1 | 2025-07-04 | The Contact Form 7 Database Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tmpD’ parameter in all versions up to, and includi… |
CVE-2025-6056 | | 2025-07-04 | Timing difference in password reset in Ergon Informatik AG's Airlock IAM 7.7.9, 8.0.8, 8.1.7, 8.2.4 and 8.3.1 allows unauthenticated attackers to enumerate use… | |
CVE-2025-52833 | Critical | 9.3 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in designthemes LMS lms allows SQL Injection.This issue affe… |
CVE-2025-52832 | Critical | 9.3 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpo-HR NGG Smart Image Search ngg-smart-image-search allo… |
CVE-2025-52831 | Critical | 9.3 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in thanhtungtnt Video List Manager video-list-manager allows… |
CVE-2025-52830 | Critical | 9.3 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bSecure – Your Universal Checkout bSecure – Your Universa… |
CVE-2025-52828 | High | 8.8 | 2025-07-04 | Deserialization of Untrusted Data vulnerability in designthemes Red Art redart allows Object Injection.This issue affects Red Art: from n/a through <= 3.8. |
CVE-2025-52813 | High | 8.1 | 2025-07-04 | Missing Authorization vulnerability in pietro MobiLoud allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MobiLoud: fr… |
CVE-2025-52807 | High | 8.1 | 2025-07-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusWP Kossy - Minimalist eCommerce Wo… |
CVE-2025-52805 | High | 7.5 | 2025-07-04 | Path Traversal: '.../...//' vulnerability in VaultDweller Leyka leyka allows PHP Local File Inclusion.This issue affects Leyka: from n/a through <= 3.32.1. |
CVE-2025-52798 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Reflected XSS.This i… |
CVE-2025-52796 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tggfref WP-Recall allows Reflected XSS. This issue affect… |
CVE-2025-52776 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thanhtungtnt Video List Manager video-list-manager allows… |
CVE-2025-52718 | High | 7.2 | 2025-07-04 | Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Remote Code Inclusion.This issue affects Alone: from… |
CVE-2025-50039 | Medium | 6.5 | 2025-07-04 | Missing Authorization vulnerability in vgwort VG WORT METIS vgw-metis allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-50032 | Medium | 6.5 | 2025-07-04 | Missing Authorization vulnerability in Paytiko - Payment Orchestration Platform Paytiko for WooCommerce paytiko allows Exploiting Incorrectly Configured Access… |
CVE-2025-4414 | High | 8.1 | 2025-07-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cmsmasters CMSMasters Content Composer… |
CVE-2025-49870 | High | 7.5 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscrip… |
CVE-2025-49867 | Critical | 9.8 | 2025-07-04 | Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes realhomes allows Privilege Escalation.This issue affects RealHomes: from n/a through <=… |
CVE-2025-49866 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikel Beautiful Cookie Consent Banner beautiful-and-respo… |
CVE-2025-49431 | Medium | 6.5 | 2025-07-04 | Missing Authorization vulnerability in Gnuget MF Plus WPML mf-plus-wpml allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-49418 | High | 7.2 | 2025-07-04 | Server-Side Request Forgery (SSRF) vulnerability in TeconceTheme Allmart allmart-core allows Server Side Request Forgery.This issue affects Allmart: from n/a t… |
CVE-2025-49417 | Critical | 9.8 | 2025-07-04 | Deserialization of Untrusted Data vulnerability in BestWpDeveloper WooCommerce Product Multi-Action Woo-product-multiaction allows Object Injection.This issue… |
CVE-2025-49414 | Critical | 10.0 | 2025-07-04 | Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Gallery fw-gallery allows Using Malicious Files.This issue affects FW Gallery… |
CVE-2025-49303 | Medium | 6.8 | 2025-07-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-el… |
CVE-2025-49302 | Critical | 10.0 | 2025-07-04 | Improper Control of Generation of Code ('Code Injection') vulnerability in Scott Paterson Easy Stripe easy-stripe allows Remote Code Inclusion.This issue affec… |
CVE-2025-49274 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awordpresslife Neom Blog neom-blog allows Reflected XSS.T… |
CVE-2025-49247 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmoreira Team Showcase team-showcase-cm allows DOM-Based… |
CVE-2025-49245 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmoreira Testimonials Showcase testimonials-showcase allo… |
CVE-2025-49070 | High | 7.5 | 2025-07-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NasaTheme Elessi elessi-theme allows P… |