2025 CVEs (page 265)
Page 265 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48939 | Medium | 4.2 | 2025-07-03 | tarteaucitron.js is a compliant and accessible cookie banner. Prior to version 1.22.0, a vulnerability was identified in tarteaucitron.js where document.curren… |
CVE-2025-53490 | Medium | 5.6 | 2025-07-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - CampaignEvents Ex… |
CVE-2025-45938 | Medium | 5.4 | 2025-07-03 | Akeles Out of Office Assistant for Jira 4.0.1 is vulberable to Cross Site Scripting (XSS) via the Jira fullName parameter. |
CVE-2025-5961 | High | 7.2 | 2025-07-03 | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in… |
CVE-2025-50263 | High | 8.1 | 2025-07-03 | Tenda AC6 v15.03.05.16_multi is vulnerable to Buffer Overflow in the fromSetRouteStatic function via the list parameter. |
CVE-2025-50262 | High | 7.5 | 2025-07-03 | Tenda AC6 v15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetQosBand function via the list parameter. |
CVE-2025-50260 | High | 7.5 | 2025-07-03 | Tenda AC6 v15.03.05.16_multi is vulnerable to Buffer Overflow in the formSetFirewallCfg function via the firewallEn parameter. |
CVE-2025-50258 | High | 8.1 | 2025-07-03 | Tenda AC6 v15.03.05.16_multi is vulnerable to Buffer Overflow in the SetSysTimeCfg function via the time parameter. |
CVE-2025-43713 | Medium | 6.5 | 2025-07-03 | ASNA Assist and ASNA Registrar before 2025-03-31 allow deserialization attacks against .NET remoting. These are Windows system services that support license ke… |
CVE-2025-49618 | Medium | 5.8 | 2025-07-03 | In Plesk Obsidian 18.0.69, unauthenticated requests to /login_up.php can reveal an AWS accessKeyId, secretAccessKey, region, and endpoint. |
CVE-2025-49595 | Medium | 4.9 | 2025-07-03 | n8n is a workflow automation platform. Prior to version 1.99.0, there is a denial of Service vulnerability in /rest/binary-data endpoint when processing empty… |
CVE-2025-49032 | Medium | 6.5 | 2025-07-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows S… |
CVE-2025-3702 | Medium | 5.4 | 2025-07-03 | Missing Authorization vulnerability in Melapress Melapress File Monitor website-file-changes-monitor allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-2932 | High | 8.8 | 2025-07-03 | The JKDEVKIT plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'font_upload_handler' function in al… |
CVE-2025-2537 | Medium | 6.4 | 2025-07-03 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled ThickBox JavaScript library (version 3.1) in various vers… |
CVE-2025-6563 | | 2025-07-03 | A cross-site scripting vulnerability is present in the hotspot of MikroTik's RouterOS on versions below 7.19.2. An attacker can inject the `javascript` protoco… | |
CVE-2025-40723 | | 2025-07-03 | Stored Cross-Site Scripting (XSS) vulnerability in versions prior to Flatboard 3.2.2 of Flatboard Pro, consisting of a stored XSS due to lack of proper validat… | |
CVE-2025-40722 | | 2025-07-03 | Stored Cross-Site Scripting (XSS) vulnerability in versions prior to Flatboard 3.2.2 of Flatboard Pro, consisting of a stored XSS due to lack of proper validat… | |
CVE-2025-2540 | Medium | 6.4 | 2025-07-03 | Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting via the plugin's bundled prettyPhoto library (version 3.1.6) in various versions d… |
CVE-2025-27461 | High | 7.6 | 2025-07-03 | During startup, the device automatically logs in the EPC2 Windows user without requesting a password. |
CVE-2025-27460 | High | 7.6 | 2025-07-03 | The hard drives of the device are not encrypted using a full volume encryption feature such as BitLocker. This allows an attacker with physical access to the d… |
CVE-2025-27459 | Medium | 4.4 | 2025-07-03 | The VNC application stores its passwords encrypted within the registry but uses DES for encryption. As DES is broken, the original passwords can be recovered. |
CVE-2025-27458 | Medium | 6.5 | 2025-07-03 | The VNC authentication mechanism bases on a challenge-response system where both server and client use the same password for encryption. The challenge is sent… |
CVE-2025-27457 | Medium | 6.5 | 2025-07-03 | All communication between the VNC server and client(s) is unencrypted. This allows an attacker to intercept the traffic and obtain sensitive data. |
CVE-2025-27456 | High | 7.5 | 2025-07-03 | The SMB server's login mechanism does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it… |
CVE-2025-27455 | Medium | 4.3 | 2025-07-03 | The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on s… |
CVE-2025-27454 | Medium | 4.3 | 2025-07-03 | The application is vulnerable to cross-site request forgery. An attacker can trick a valid, logged in user into submitting a web request that they did not inte… |
CVE-2025-27453 | Medium | 5.3 | 2025-07-03 | The HttpOnly flag is set to false on the PHPSESSION cookie. Therefore, the cookie can be accessed by other sources such as JavaScript. |
CVE-2025-27452 | Medium | 5.3 | 2025-07-03 | The configuration of the Apache httpd webserver which serves the MEAC300-FNADE4 web application, is partly insecure. There are modules activated that are not r… |
CVE-2025-27451 | Medium | 5.3 | 2025-07-03 | For failed login attempts, the application returns different error messages depending on whether the login failed due to an incorrect password or a non-existin… |
CVE-2025-27450 | Medium | 6.5 | 2025-07-03 | The Secure attribute is missing on multiple cookies provided by the MEAC300-FNADE4. An attacker can trick a user to establish an unencrypted HTTP connection to… |
CVE-2025-27449 | High | 7.5 | 2025-07-03 | The MEAC300-FNADE4 does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susceptible t… |
CVE-2025-27448 | Medium | 6.8 | 2025-07-03 | The web application is susceptible to cross-site-scripting attacks. An attacker who can create new dashboards can inject JavaScript code into the dashboard nam… |
CVE-2025-27447 | High | 7.4 | 2025-07-03 | The web application is susceptible to cross-site-scripting attacks. An attacker can create a prepared URL, which injects JavaScript code into the website. The… |
CVE-2025-1711 | Medium | 4.3 | 2025-07-03 | Multiple services of the DUT as well as different scopes of the same service reuse the same credentials. |
CVE-2025-1710 | High | 7.5 | 2025-07-03 | The maxView Storage Manager does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it susc… |
CVE-2025-1709 | Medium | 6.5 | 2025-07-03 | Several credentials for the local PostgreSQL database are stored in plain text (partially base64 encoded). |
CVE-2025-1708 | High | 8.6 | 2025-07-03 | The application is vulnerable to SQL injection attacks. An attacker is able to dump the PostgreSQL database and read its content. |
CVE-2025-6587 | | 2025-07-03 | System environment variables are recorded in Docker Desktop diagnostic logs, when using shell auto-completion. This leads to unintentional disclosure of sensit… | |
CVE-2025-0885 | | 2025-07-03 | Incorrect Authorization vulnerability in OpenText™ GroupWise allows Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability could… | |
CVE-2025-38173 | High | 7.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: crypto: marvell/cesa - Handle zero-length skcipher requests Do not access random memory f… |
CVE-2025-38172 | High | 7.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: erofs: avoid using multiple devices with different type For multiple devices, both primar… |
CVE-2025-38171 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: power: supply: max77705: Fix workqueue error handling in probe The create_singlethread_wo… |
CVE-2025-38170 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: Discard stale CPU state when handling SME traps The logic for handling SME… |
CVE-2025-38169 | High | 7.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: Avoid clobbering kernel FPSIMD state with SMSTOP On system with SME, a thre… |
CVE-2025-38168 | High | 7.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: perf: arm-ni: Unregister PMUs on probe failure When a resource allocation fails in one cl… |
CVE-2025-38167 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: handle hdr_first_de() return value The hdr_first_de() function returns a pointe… |
CVE-2025-38166 | High | 7.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: bpf: fix ktls panic with sockmap [ 2172.936997] ------------[ cut here ]------------ [ 21… |
CVE-2025-38165 | High | 7.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix panic when calling skb_linearize The panic can be reproduced by executi… |
CVE-2025-38164 | High | 7.1 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: f2fs: zone: fix to avoid inconsistence in between SIT and SSA w/ below testcase, it will… |
CVE-2025-38163 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on sbi->total_valid_block_count syzbot reported a f2fs bug a… |
CVE-2025-38162 | High | 7.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: prevent overflow in lookup table allocation When calculating t… |
CVE-2025-38161 | High | 7.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction Upon RQ destruction if… |
CVE-2025-38160 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: clk: bcm: rpi: Add NULL check in raspberrypi_clk_register() devm_kasprintf() returns NULL… |
CVE-2025-38159 | High | 7.1 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6… |
CVE-2025-38158 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: hisi_acc_vfio_pci: fix XQE dma address error The dma addresses of EQE and AEQE are wrong… |
CVE-2025-38157 | High | 7.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k_htc: Abort software beacon handling if disabled A malicious USB device can se… |
CVE-2025-38156 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix null-ptr-deref in mt7996_mmio_wed_init() devm_ioremap() returns N… |
CVE-2025-38155 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: Fix null-ptr-deref in mt7915_mmio_wed_init() devm_ioremap() returns N… |
CVE-2025-38154 | High | 7.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Avoid using sk_socket after free when sending The sk->sk_socket is not lock… |
CVE-2025-38153 | High | 7.1 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: net: usb: aqc111: fix error handling of usbnet read calls Syzkaller, courtesy of syzbot… |
CVE-2025-38151 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: RDMA/cma: Fix hang when cma_netevent_callback fails to queue_work The cited commit fixed… |
CVE-2025-38150 | High | 7.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: af_packet: move notifier's packet_dev_mc out of rcu critical section Syzkaller reports th… |
CVE-2025-38149 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: net: phy: clear phydev->devlink when the link is deleted There is a potential crash issue… |
CVE-2025-38148 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: net: phy: mscc: Fix memory leak when using one step timestamping Fix memory leak when run… |
CVE-2025-38147 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: calipso: Don't call calipso functions for AF_INET sk. syzkaller reported a null-ptr-deref… |
CVE-2025-38146 | Critical | 9.4 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: Fix the dead loop of MPLS parse The unexpected MPLS packet may not end… |
CVE-2025-38145 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: soc: aspeed: Add NULL check in aspeed_lpc_enable_snoop() devm_kasprintf() returns NULL wh… |
CVE-2025-38144 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: watchdog: lenovo_se30_wdt: Fix possible devm_ioremap() NULL pointer dereference in lenovo_… |
CVE-2025-38143 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: backlight: pm8941: Add NULL check in wled_configure() devm_kasprintf() returns NULL when… |
CVE-2025-38142 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (asus-ec-sensors) check sensor index in read_string() Prevent a potential invalid… |
CVE-2025-38141 | High | 7.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: dm: fix dm_blk_report_zones If dm_get_live_table() returned NULL, dm_put_live_table() was… |
CVE-2025-38140 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: dm: limit swapping tables for devices with zone write plugs dm_revalidate_zones() only al… |
CVE-2025-38139 | Critical | 9.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix oops in write-retry from mis-resetting the subreq iterator Fix the resetting o… |
CVE-2025-38138 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: Add NULL check in udma_probe() devm_kasprintf() returns NULL when memory a… |
CVE-2025-38137 | High | 7.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: PCI/pwrctrl: Cancel outstanding rescan work when unregistering It's possible to trigger u… |
CVE-2025-38136 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: usb: renesas_usbhs: Reorder clock handling and power management in probe Reorder the init… |
CVE-2025-38135 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: serial: Fix potential null-ptr-deref in mlb_usio_probe() devm_ioremap() can return NULL o… |
CVE-2025-38134 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: usb: acpi: Prevent null pointer dereference in usb_acpi_add_usb4_devlink() As demonstrate… |
CVE-2025-38133 | High | 7.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad4851: fix ad4858 chan pointer handling The pointer returned from ad4851_parse… |
CVE-2025-38132 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: coresight: holding cscfg_csdev_lock while removing cscfg from csdev There'll be possible… |
CVE-2025-38131 | High | 7.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: coresight: prevent deactivate active config while enabling the config While enable active… |
CVE-2025-38130 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: drm/connector: only call HDMI audio helper plugged cb if non-null On driver remove, sound… |
CVE-2025-38129 | High | 7.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: page_pool: Fix use-after-free in page_pool_recycle_in_ring syzbot reported a uaf in page_… |
CVE-2025-38128 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: reject malformed HCI_CMD_SYNC commands In 'mgmt_hci_cmd_sync()', check w… |
CVE-2025-38127 | High | 7.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: ice: fix Tx scheduler error handling in XDP callback When the XDP program is loaded, the… |
CVE-2025-38126 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping The stmmac… |
CVE-2025-38125 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: net: stmmac: make sure that ptp_rate is not 0 before configuring EST If the ptp_rate reco… |
CVE-2025-38124 | High | 7.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: net: fix udp gso skb_segment after pull from frag_list Commit a1e40ac5b5e9 ("net: gso: fi… |
CVE-2025-38123 | Critical | 9.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: Fix napi rx poll issue When driver handles the napi rx polling requests… |
CVE-2025-38122 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO gve_alloc_pending_pa… |
CVE-2025-38121 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: avoid panic on init failure In case of an error during init, in_hw_re… |
CVE-2025-38120 | Critical | 9.4 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_set_pipapo_avx2: fix initial map fill If the first field doesn't cover the… |
CVE-2025-38119 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: scsi: core: ufs: Fix a hang in the error handler ufshcd_err_handling_prepare() calls ufsh… |
CVE-2025-38118 | High | 7.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete This reworks MGMT_OP_REMOVE_… |
CVE-2025-38117 | High | 7.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Protect mgmt_pending list with its own lock This uses a mutex to protect… |
CVE-2025-38116 | High | 7.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix uaf in ath12k_core_init() When the execution of ath12k_core_hw_group_as… |
CVE-2025-38115 | High | 7.8 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: net_sched: sch_sfq: fix a potential crash on gso_skb handling SFQ has an assumption of al… |
CVE-2025-38114 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: e1000: Move cancel_work_sync to avoid deadlock Previously, e1000_down called cancel_work_… |
CVE-2025-38113 | Medium | 5.5 | 2025-07-03 | In the Linux kernel, the following vulnerability has been resolved: ACPI: CPPC: Fix NULL pointer dereference when nosmp is used With nosmp in cmdline, other… |