2025 CVEs (page 265)
Page 265 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-38200 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: i40e: fix MMIO write access to an invalid page in i40e_clear_hw When the device sends a s… |
CVE-2025-38199 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Fix memory leak due to multiple rx_stats allocation rx_stats for each arsta… |
CVE-2025-38198 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: fbcon: Make sure modelist not set on unregistered console It looks like attempting to wri… |
CVE-2025-38197 | High | 7.3 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell_rbu: Fix list usage Pass the correct list head to list_for_each_entry*… |
CVE-2025-38196 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: validate buffer count with offset for cloning syzbot reports that it can t… |
CVE-2025-38195 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: Fix panic caused by NULL-PMD in huge_pte_offset() ERROR INFO: CPU 25 Unable t… |
CVE-2025-38194 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: jffs2: check that raw node were preallocated before writing summary Syzkaller detected a… |
CVE-2025-38193 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: reject invalid perturb period Gerrard Tai reported that SFQ perturb_p… |
CVE-2025-38192 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: net: clear the dst when changing skb protocol A not-so-careful NAT46 BPF program can cras… |
CVE-2025-38191 | High | 7.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix null pointer dereference in destroy_previous_session If client set ->PreviousS… |
CVE-2025-38190 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: atm: Revert atm_account_tx() if copy_from_iter_full() fails. In vcc_sendmsg(), we account… |
CVE-2025-38189 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Avoid NULL pointer dereference in `v3d_job_update_stats()` The following kernel… |
CVE-2025-38188 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/a7xx: Call CP_RESET_CONTEXT_STATE Calling this packet is necessary when we switch… |
CVE-2025-38187 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix a use-after-free in r535_gsp_rpc_push() The RPC container is released af… |
CVE-2025-38186 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix double invocation of bnxt_ulp_stop()/bnxt_ulp_start() Before the commit unde… |
CVE-2025-38185 | Medium | 5.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: atm: atmtcp: Free invalid length skb in atmtcp_c_send(). syzbot reported the splat below… |
CVE-2025-38184 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer The reproduction ste… |
CVE-2025-38183 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix potential out-of-bounds write in lan743x_ptp_io_event_clock_get() Befor… |
CVE-2025-38182 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: ublk: santizize the arguments from userspace when adding a device Sanity check the values… |
CVE-2025-38181 | High | 7.5 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). syzkaller reported a null-ptr… |
CVE-2025-38180 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: net: atm: fix /proc/net/atm/lec handling /proc/net/atm/lec must ensure safety against dev… |
CVE-2025-38179 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() This fixes the followin… |
CVE-2025-7061 | Low | 2.7 | 2025-07-04 | A vulnerability was found in Intelbras InControl up to 2.21.60.9. It has been declared as problematic. This vulnerability affects unknown code of the file /v1/… |
CVE-2025-49809 | High | 7.8 | 2025-07-04 | mtr through 0.95, in certain privileged contexts, mishandles execution of a program specified by the MTR_PACKET environment variable. NOTE: mtr on macOS may of… |
CVE-2025-48172 | Medium | 5.6 | 2025-07-04 | CHMLib through 2bef8d0, as used in SumatraPDF and other products, has a chm_lib.c _chm_decompress_block integer overflow. There is a resultant heap-based buffe… |
CVE-2025-38177 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: sch_hfsc: make hfsc_qlen_notify() idempotent hfsc_qlen_notify() is not idempotent either… |
CVE-2025-7066 | Medium | 6.1 | 2025-07-04 | Jirafeau normally prevents browser preview for text files due to the possibility that for example SVG and HTML documents could be exploited for cross site scri… |
CVE-2025-6740 | Medium | 6.1 | 2025-07-04 | The Contact Form 7 Database Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tmpD’ parameter in all versions up to, and includi… |
CVE-2025-6056 | | 2025-07-04 | Timing difference in password reset in Ergon Informatik AG's Airlock IAM 7.7.9, 8.0.8, 8.1.7, 8.2.4 and 8.3.1 allows unauthenticated attackers to enumerate use… | |
CVE-2025-52833 | Critical | 9.3 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in designthemes LMS lms allows SQL Injection.This issue affe… |
CVE-2025-52832 | Critical | 9.3 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpo-HR NGG Smart Image Search ngg-smart-image-search allo… |
CVE-2025-52831 | Critical | 9.3 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in thanhtungtnt Video List Manager video-list-manager allows… |
CVE-2025-52830 | Critical | 9.3 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in bSecure – Your Universal Checkout bSecure – Your Universa… |
CVE-2025-52828 | High | 8.8 | 2025-07-04 | Deserialization of Untrusted Data vulnerability in designthemes Red Art redart allows Object Injection.This issue affects Red Art: from n/a through <= 3.8. |
CVE-2025-52813 | High | 8.1 | 2025-07-04 | Missing Authorization vulnerability in pietro MobiLoud allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MobiLoud: fr… |
CVE-2025-52807 | High | 8.1 | 2025-07-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ApusWP Kossy - Minimalist eCommerce Wo… |
CVE-2025-52805 | High | 7.5 | 2025-07-04 | Path Traversal: '.../...//' vulnerability in VaultDweller Leyka leyka allows PHP Local File Inclusion.This issue affects Leyka: from n/a through <= 3.32.1. |
CVE-2025-52798 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyecix JobSearch wp-jobsearch allows Reflected XSS.This i… |
CVE-2025-52796 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tggfref WP-Recall allows Reflected XSS. This issue affect… |
CVE-2025-52776 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in thanhtungtnt Video List Manager video-list-manager allows… |
CVE-2025-52718 | High | 7.2 | 2025-07-04 | Improper Control of Generation of Code ('Code Injection') vulnerability in Beplusthemes Alone alone allows Remote Code Inclusion.This issue affects Alone: from… |
CVE-2025-50039 | Medium | 6.5 | 2025-07-04 | Missing Authorization vulnerability in vgwort VG WORT METIS vgw-metis allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-50032 | Medium | 6.5 | 2025-07-04 | Missing Authorization vulnerability in Paytiko - Payment Orchestration Platform Paytiko for WooCommerce paytiko allows Exploiting Incorrectly Configured Access… |
CVE-2025-4414 | High | 8.1 | 2025-07-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cmsmasters CMSMasters Content Composer… |
CVE-2025-49870 | High | 7.5 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscrip… |
CVE-2025-49867 | Critical | 9.8 | 2025-07-04 | Incorrect Privilege Assignment vulnerability in InspiryThemes RealHomes realhomes allows Privilege Escalation.This issue affects RealHomes: from n/a through <=… |
CVE-2025-49866 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikel Beautiful Cookie Consent Banner beautiful-and-respo… |
CVE-2025-49431 | Medium | 6.5 | 2025-07-04 | Missing Authorization vulnerability in Gnuget MF Plus WPML mf-plus-wpml allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-49418 | High | 7.2 | 2025-07-04 | Server-Side Request Forgery (SSRF) vulnerability in TeconceTheme Allmart allmart-core allows Server Side Request Forgery.This issue affects Allmart: from n/a t… |
CVE-2025-49417 | Critical | 9.8 | 2025-07-04 | Deserialization of Untrusted Data vulnerability in BestWpDeveloper WooCommerce Product Multi-Action Woo-product-multiaction allows Object Injection.This issue… |
CVE-2025-49414 | Critical | 10.0 | 2025-07-04 | Unrestricted Upload of File with Dangerous Type vulnerability in Fastw3b LLC FW Gallery fw-gallery allows Using Malicious Files.This issue affects FW Gallery… |
CVE-2025-49303 | Medium | 6.8 | 2025-07-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Shabti Kaplan Frontend Admin by DynamiApps acf-frontend-form-el… |
CVE-2025-49302 | Critical | 10.0 | 2025-07-04 | Improper Control of Generation of Code ('Code Injection') vulnerability in Scott Paterson Easy Stripe easy-stripe allows Remote Code Inclusion.This issue affec… |
CVE-2025-49274 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in awordpresslife Neom Blog neom-blog allows Reflected XSS.T… |
CVE-2025-49247 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmoreira Team Showcase team-showcase-cm allows DOM-Based… |
CVE-2025-49245 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in cmoreira Testimonials Showcase testimonials-showcase allo… |
CVE-2025-49070 | High | 7.5 | 2025-07-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NasaTheme Elessi elessi-theme allows P… |
CVE-2025-48231 | Medium | 6.5 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Booking Calendar Contact Form booking-calendar… |
CVE-2025-47634 | Medium | 6.5 | 2025-07-04 | Missing Authorization vulnerability in Keylor Mendoza WC Pickup Store wc-pickup-store allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-47627 | High | 7.5 | 2025-07-04 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LCweb PrivateContent - Mail Actions al… |
CVE-2025-47565 | Medium | 6.3 | 2025-07-04 | Missing Authorization vulnerability in ashanjay EventON eventon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Even… |
CVE-2025-47479 | Medium | 5.3 | 2025-07-04 | Weak Authentication vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Authentication Abuse.This issue affects WP Compress: from n/a throug… |
CVE-2025-39487 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ValvePress Rankie valvepress-rankie allows Reflected XSS… |
CVE-2025-32311 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuanticaLabs Pressroom pressroom allows Reflected XSS.Thi… |
CVE-2025-32297 | High | 8.5 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in quantumcloud Simple Link Directory qc-simple-link-directo… |
CVE-2025-31037 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in favethemes Homey homey allows Reflected XSS.This issue af… |
CVE-2025-30933 | Critical | 10.0 | 2025-07-04 | Unrestricted Upload of File with Dangerous Type vulnerability in LiquidThemes LogisticsHub logistics-hub allows Upload a Web Shell to a Web Server.This issue a… |
CVE-2025-28983 | Critical | 9.8 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge Click & Pledge Connect allows Privilege Es… |
CVE-2025-28980 | High | 7.7 | 2025-07-04 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in machouinard Aviation Weather from NOAA aviation-weather-from-no… |
CVE-2025-28978 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hung Trang Si SB Breadcrumbs sb-breadcrumbs allows Reflec… |
CVE-2025-28976 | Medium | 6.5 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dsrodzin Email Address Security by WebEmailProtector webe… |
CVE-2025-28968 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vladimir Prelovac WP Wall wp-wall allows Reflected XSS.Th… |
CVE-2025-24780 | High | 8.5 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in printcart Printcart Web to Print Product Designer for Woo… |
CVE-2025-24771 | High | 7.1 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Content Manager Light content-manager-light all… |
CVE-2025-23970 | Critical | 9.8 | 2025-07-04 | Incorrect Privilege Assignment vulnerability in aonetheme Service Finder Booking sf-booking allows Privilege Escalation.This issue affects Service Finder Booki… |
CVE-2025-7060 | Medium | 4.1 | 2025-07-04 | A vulnerability was found in Monitorr up to 1.7.6m. It has been classified as problematic. This affects an unknown part of the file assets/config/_installation… |
CVE-2025-38176 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: binder: fix use-after-free in binderfs_evict_inode() Running 'stress-ng --binderfs 16 --t… |
CVE-2025-38175 | High | 7.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: binder: fix yet another UAF in binder_devices Commit e77aff5528a18 ("binderfs: fix use-af… |
CVE-2025-38174 | High | 8.8 | 2025-07-04 | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Do not double dequeue a configuration request Some of our devices crash in t… |
CVE-2025-5920 | High | 7.5 | 2025-07-04 | The Sharable Password Protected Posts before version 1.1.1 allows access to password protected posts by providing a secret key in a GET parameter. However, the… |
CVE-2025-5351 | Medium | 6.5 | 2025-07-04 | A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serial… |
CVE-2025-53569 | Medium | 4.3 | 2025-07-04 | Cross-Site Request Forgery (CSRF) vulnerability in Trust Payments Trust Payments Gateway for WooCommerce (JavaScript Library) trust-payments-gateway-3ds2 allow… |
CVE-2025-53568 | Medium | 4.3 | 2025-07-04 | Cross-Site Request Forgery (CSRF) vulnerability in Tony Zeoli Radio Station radio-station allows Cross Site Request Forgery.This issue affects Radio Station: f… |
CVE-2025-53566 | Medium | 6.5 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-st… |
CVE-2025-30983 | Medium | 6.5 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus Card flip image slideshow card-flip-image-slides… |
CVE-2025-30979 | High | 8.5 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Pixelating image slideshow gallery pixelating-im… |
CVE-2025-30969 | High | 8.5 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus iFrame Images Gallery wp-iframe-images-gallery a… |
CVE-2025-30947 | High | 8.5 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in gopiplus Cool fade popup cool-fade-popup allows Blind SQL… |
CVE-2025-30943 | Medium | 6.5 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aakif Kadiwala Posts Slider Shortcode posts-slider-shortc… |
CVE-2025-30929 | Medium | 5.3 | 2025-07-04 | Missing Authorization vulnerability in amazewp fluXtore fluxtore allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects flu… |
CVE-2025-29012 | Medium | 5.3 | 2025-07-04 | Missing Authorization vulnerability in kamleshyadav CF7 7 Mailchimp Add-on CF7-mailchimp-addon allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-29007 | Medium | 4.3 | 2025-07-04 | Missing Authorization vulnerability in LMSACE LMSACE Connect lmsace-connect allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-29001 | Medium | 4.3 | 2025-07-04 | Missing Authorization vulnerability in ZoomIt WooCommerce Shop Page Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue… |
CVE-2025-28971 | Medium | 5.9 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CWD Web Designer Easy Elements Hider easy-elements-hider… |
CVE-2025-28969 | High | 8.5 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in cybio Gallery Widget gallery-widget allows SQL Injection… |
CVE-2025-28967 | High | 8.5 | 2025-07-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Steve Truman Contact Us page - Contact people LITE contac… |
CVE-2025-28963 | Medium | 5.4 | 2025-07-04 | Server-Side Request Forgery (SSRF) vulnerability in Md Yeasin Ul Haider URL Shortener exact-links allows Server Side Request Forgery.This issue affects URL Sho… |
CVE-2025-28957 | Medium | 6.5 | 2025-07-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OwnerRez OwnerRez API ownerrez allows Stored XSS.This iss… |
CVE-2025-28951 | Critical | 9.1 | 2025-07-04 | Unrestricted Upload of File with Dangerous Type vulnerability in CreedAlly Bulk Featured Image bulk-featured-image allows Upload a Web Shell to a Web Server.Th… |
CVE-2025-27358 | Medium | 4.6 | 2025-07-04 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in N-Media Frontend File Manager nmedia-user-file-uploader allows C… |