2025 CVEs (page 27)
Page 27 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48023 | Medium | 6.5 | 2026-02-13 | A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receives maliciously crafted packets… |
CVE-2025-48022 | Medium | 6.5 | 2026-02-13 | A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receives maliciously crafted packets… |
CVE-2025-48021 | Medium | 6.5 | 2026-02-13 | A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receives maliciously crafted packets… |
CVE-2025-15520 | Medium | 4.3 | 2026-02-13 | The RegistrationMagic WordPress plugin before 6.0.7.2 checks nonces but not capabilities, allowing for the disclosure of some sensitive data to subscribers an… |
CVE-2025-48020 | Medium | 6.5 | 2026-02-13 | A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receives maliciously crafted packets… |
CVE-2025-48019 | Medium | 6.5 | 2026-02-13 | A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receives maliciously crafted packets… |
CVE-2025-1924 | High | 8.2 | 2026-02-13 | A vulnerability has been found in Vnet/IP Interface Package provided by Yokogawa Electric Corporation. If affected product receive maliciously crafted packets… |
CVE-2025-9293 | High | 8.1 | 2026-02-13 | A vulnerability in the certificate validation logic may allow applications to accept untrusted or improperly validated server identities during TLS communicati… |
CVE-2025-9292 | High | 7.5 | 2026-02-13 | A permissive web security configuration may allow cross-origin restrictions enforced by modern browsers to be bypassed under specific circumstances. Exploitat… |
CVE-2025-40905 | High | 7.3 | 2026-02-13 | WWW::OAuth 1.000 and earlier for Perl uses the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic funct… |
CVE-2025-70092 | Medium | 5.5 | 2026-02-12 | A cross-site scripting (XSS) vulnerability in the Item Kits function of OpenSourcePOS v3.4.1 allows attackers to execute arbitrary web scripts or HTML via inje… |
CVE-2025-70845 | Medium | 6.1 | 2026-02-12 | lty628 aidigu v1.9.1 is vulnerable to Cross Site Scripting (XSS) exists in the /setting/ page where the "intro" field is not properly sanitized or escaped. |
CVE-2025-14282 | Medium | 5.4 | 2026-02-12 | A flaw was found in Dropbear. When running in multi-user mode and authenticating users, the dropbear ssh server does the socket forwardings requested by the re… |
CVE-2025-70314 | Critical | 9.8 | 2026-02-12 | webfsd 1.21 is vulnerable to a Buffer Overflow via a crafted request. This is due to the filename variable |
CVE-2025-67433 | High | 7.5 | 2026-02-12 | A heap buffer overflow in the processRequest function of Open TFTP Server MultiThreaded v1.7 allows attackers to cause a Denial of Service (DoS) via a crafted… |
CVE-2025-67432 | High | 7.5 | 2026-02-12 | A stack overflow in the ZBarcode_Encode function of Monkeybread Software MBS DynaPDF Plugin v21.3.1.1 allows attackers to cause a Denial of Service (DoS) via a… |
CVE-2025-70981 | Critical | 9.8 | 2026-02-12 | CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface (/user/list) via the departmentIds parameter. |
CVE-2025-69807 | High | 7.5 | 2026-02-12 | p2r3 Bareiron commit: 8e4d4020d is vulnerable to Buffer Overflow, which allows unauthenticated remote attackers to cause a denial of service via a packet sent… |
CVE-2025-69806 | High | 7.5 | 2026-02-12 | p2r3 bareiron commit: 8e4d4020d contains an Out-of-bounds Read, which allows unauthenticated remote attackers to get relative information leakage via a packet… |
CVE-2025-63421 | High | 7.8 | 2026-02-12 | An issue in filosoft Comerc.32 Commercial Invoicing v.16.0.0.3 allows a local attacker to execute arbitrary code via the comeinst.exe file |
CVE-2025-54519 | High | 7.3 | 2026-02-12 | A DLL hijacking vulnerability in Doc Nav could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. |
CVE-2025-52533 | | 2026-02-12 | Improper Access Control in an on-chip debug interface could allow a privileged attacker to enable a debug interface and potentially compromise data confidentia… | |
CVE-2025-61880 | High | 8.8 | 2026-02-12 | In Infoblox NIOS through 9.0.7, insecure deserialization can result in remote code execution. |
CVE-2025-61879 | High | 7.7 | 2026-02-12 | In Infoblox NIOS through 9.0.7, a High-Privileged User Can Trigger an Arbitrary File Write via the Account Creation Mechanism. |
CVE-2025-55210 | High | 7.5 | 2026-02-12 | FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to 17.0.5 and 16.0.17, FreePBX module api (PBX API) is vulnerab… |
CVE-2025-54756 | High | 8.4 | 2026-02-12 | BrightSign players running BrightSign OS series 4 prior to v8.5.53.1 or series 5 prior to v9.0.166 use a default password that is guessable with knowledge of… |
CVE-2025-70886 | High | 7.5 | 2026-02-12 | An issue in halo v.2.22.4 and before allows a remote attacker to cause a denial of service via a crafted payload to the public comment submission endpoint |
CVE-2025-69752 | Medium | 4.3 | 2026-02-12 | An issue in the "My Details" user profile functionality of Ideagen Q-Pulse 7.1.0.32 allows an authenticated user to view other users' profile information by mo… |
CVE-2025-69634 | Critical | 9.0 | 2026-02-12 | Cross Site Request Forgery vulnerability in Dolibarr ERP & CRM v.22.0.9 allows a remote attacker to escalate privileges via the notes field in perms.php NOTE… |
CVE-2025-56647 | Medium | 6.5 | 2026-02-12 | npm @farmfe/core before 1.7.6 is Missing Origin Validation in WebSocket. The development (hot module reloading) server does not validate origin when connecting… |
CVE-2025-14014 | Critical | 9.8 | 2026-02-12 | Unrestricted Upload of File with Dangerous Type vulnerability in NTN Information Processing Services Computer Software Hardware Industry and Trade Ltd. Co. Sma… |
CVE-2025-13004 | Medium | 6.3 | 2026-02-12 | Authorization Bypass Through User-Controlled Key vulnerability in Farktor Software E-Commerce Services Inc. E-Commerce Package allows Manipulating User-Control… |
CVE-2025-13002 | High | 8.2 | 2026-02-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Farktor Software E-Commerce Services Inc. E-Commer… |
CVE-2025-10969 | Critical | 9.8 | 2026-02-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Farktor Software E-Commerce Services Inc. E-Commerce Pack… |
CVE-2025-15575 | Medium | 5.3 | 2026-02-12 | The firmware update functionality does not verify the authenticity of the supplied firmware update files. This allows attackers to flash malicious firmware upd… |
CVE-2025-15574 | Medium | 6.5 | 2026-02-12 | When connecting to the Solax Cloud MQTT server the username is the "registration number", which is the 10 character string printed on the SolaX Power Pocket de… |
CVE-2025-15573 | Critical | 9.4 | 2026-02-12 | The affected devices do not validate the server certificate when connecting to the SolaX Cloud MQTTS server hosted in the Alibaba Cloud (mqtt001.solaxcloud.com… |
CVE-2025-41117 | Medium | 6.8 | 2026-02-12 | Stack traces in Grafana's Explore Traces view can be rendered as raw HTML, and thus inject malicious JavaScript in the browser. This would require malicious Ja… |
CVE-2025-15577 | High | 7.5 | 2026-02-12 | An unauthenticated attacker can exploit this vulnerability by manipulating URL to achieve arbitrary file read access.This issue affects Valmet DNA Web Tools: C… |
CVE-2025-14892 | Critical | 9.8 | 2026-02-12 | The Prime Listing Manager WordPress plugin through 1.1 allows an attacker to gain administrative access without having any kind of account on the targeted site… |
CVE-2025-67135 | Critical | 9.8 | 2026-02-11 | Weak Security in the PF-50 1.2 keyfob of PGST PG107 Alarm System 1.25.05.hf allows attackers to compromise access control via a code replay attack. |
CVE-2025-64074 | Medium | 5.3 | 2026-02-11 | A path-traversal vulnerability in the logout functionality of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to delete arbitrary fi… |
CVE-2025-46310 | Medium | 6.0 | 2026-02-11 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26. An attacker with… |
CVE-2025-46305 | Medium | 5.7 | 2026-02-11 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS… |
CVE-2025-46304 | Medium | 5.7 | 2026-02-11 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS… |
CVE-2025-46303 | Medium | 5.7 | 2026-02-11 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS… |
CVE-2025-46302 | Medium | 5.7 | 2026-02-11 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS… |
CVE-2025-46301 | Medium | 5.7 | 2026-02-11 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS… |
CVE-2025-46300 | Medium | 5.7 | 2026-02-11 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS… |
CVE-2025-46290 | High | 7.5 | 2026-02-11 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS So… |
CVE-2025-43537 | Medium | 5.5 | 2026-02-11 | A path handling issue was addressed with improved validation. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2. Restoring a malici… |
CVE-2025-43417 | Medium | 5.5 | 2026-02-11 | A path handling issue was addressed with improved logic. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2. An app may be able… |
CVE-2025-43403 | Medium | 5.5 | 2026-02-11 | An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26. An app m… |
CVE-2025-68663 | Medium | 5.3 | 2026-02-11 | Outline is a service that allows for collaborative documentation. Prior to 1.1.0, a vulnerability was found in Outline's WebSocket authentication mechanism tha… |
CVE-2025-64487 | High | 7.6 | 2026-02-11 | Outline is a service that allows for collaborative documentation. Prior to 1.1.0, a privilege escalation vulnerability exists in the Outline document managemen… |
CVE-2025-70297 | Medium | 6.1 | 2026-02-11 | A stored cross-site scripting (XSS) vulnerability in the recipe asset upload and media serving component in Mealie 3.3.1 allows remote authenticated users to i… |
CVE-2025-70296 | Medium | 5.4 | 2026-02-11 | A stored HTML injection vulnerability in the Recipe Notes rendering component in Mealie 3.3.1 allows remote authenticated users to inject arbitrary HTML, resul… |
CVE-2025-69873 | Low | 2.9 | 2026-02-11 | ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern k… |
CVE-2025-69872 | Critical | 9.8 | 2026-02-11 | DiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. An attacker with write access to the cache directory can achieve ar… |
CVE-2025-69871 | High | 8.1 | 2026-02-11 | A race condition vulnerability exists in MedusaJS Medusa v2.12.2 and earlier in the registerUsage() function of the promotion module. The function performs a n… |
CVE-2025-70085 | Critical | 9.8 | 2026-02-11 | An issue was discovered in OpenSatKit 2.2.1. The EventErrStr buffer has a fixed size of 256 bytes. The code uses sprintf to format two filenames (Source1Filena… |
CVE-2025-70084 | High | 7.5 | 2026-02-11 | Directory traversal vulnerability in OpenSatKit 2.2.1 allows attackers to gain access to sensitive information or delete arbitrary files via crafted value to t… |
CVE-2025-70083 | High | 7.8 | 2026-02-11 | An issue was discovered in OpenSatKit 2.2.1. The DirName field in the telecommand is provided by the ground segment and must be treated as untrusted input. The… |
CVE-2025-70029 | High | 7.5 | 2026-02-11 | An issue in Sunbird-Ed SunbirdEd-portal v1.13.4 allows attackers to obtain sensitive information. The application disables TLS/SSL certificate validation by se… |
CVE-2025-69874 | Critical | 9.8 | 2026-02-11 | nanotar through 0.2.0 has a path traversal vulnerability in parseTar() and parseTarGzip() that allows remote attackers to write arbitrary files outside the int… |
CVE-2025-65480 | High | 8.8 | 2026-02-11 | An issue was discovered in Pacom Unison Client 5.13.1. Authenticated users can inject malicious scripts in the Report Templates which are executed when certain… |
CVE-2025-65128 | High | 8.1 | 2026-02-11 | A missing authentication mechanism in the web management API components of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows unauthenticated attackers… |
CVE-2025-65127 | Medium | 6.5 | 2026-02-11 | A lack of session validation in the web API component of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote unauthenticated attackers to access a… |
CVE-2025-13391 | Medium | 5.8 | 2026-02-11 | The Product Options and Price Calculation Formulas for WooCommerce – Uni CPO (Premium) plugin for WordPress is vulnerable to unauthorized loss of data due to a… |
CVE-2025-64075 | Critical | 10.0 | 2026-02-11 | A path traversal vulnerability in the check_token function of Shenzhen Zhibotong Electronics ZBT WE2001 23.09.27 allows remote attackers to bypass authenticati… |
CVE-2025-12474 | Medium | 4.4 | 2026-02-11 | A specially-crafted file can cause libjxl's decoder to read pixel data from uninitialized (but allocated) memory. This can be done by causing the decoder to r… |
CVE-2025-61969 | | 2026-02-11 | Incorrect permission assignment in AMD µProf may allow a local user-privileged attacker to achieve privilege escalation, potentially resulting in arbitrary cod… | |
CVE-2025-52541 | High | 7.3 | 2026-02-11 | A DLL hijacking vulnerability in Vivado could allow a local attacker to achieve privilege escalation, potentially resulting in arbitrary code execution. |
CVE-2025-48518 | | 2026-02-11 | Improper input validation in AMD Graphics Driver could allow a local attacker to write out of bounds, potentially resulting in loss of integrity or denial of s… | |
CVE-2025-48508 | Medium | 6.0 | 2026-02-11 | Improper Hardware reset flow logic in the GPU GFX Hardware IP block could allow a privileged attacker in a guest virtual machine to control reset operation pot… |
CVE-2025-48503 | High | 7.8 | 2026-02-11 | A DLL hijacking vulnerability in the AMD Software Installer could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code exe… |
CVE-2025-12059 | Critical | 9.8 | 2026-02-11 | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Logo Software Industry and Trade Inc. Logo j-Platform allows E… |
CVE-2025-8668 | Critical | 9.4 | 2026-02-11 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in E-Kalite Software Hardware Engineering Design and… |
CVE-2025-8025 | Critical | 9.8 | 2026-02-11 | Missing Authentication for Critical Function, Improper Access Control vulnerability in Dinosoft Business Solutions Dinosoft ERP allows Accessing Functionality… |
CVE-2025-68406 | Medium | 6.5 | 2026-02-11 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-66278 | Medium | 6.5 | 2026-02-11 | A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability t… |
CVE-2025-66277 | Critical | 9.8 | 2026-02-11 | A link following vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to t… |
CVE-2025-66274 | Medium | 4.9 | 2026-02-11 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-62856 | Medium | 4.4 | 2026-02-11 | A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the vulner… |
CVE-2025-62855 | Medium | 4.4 | 2026-02-11 | A path traversal vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the vulner… |
CVE-2025-62854 | Medium | 6.5 | 2026-02-11 | An uncontrolled resource consumption vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit… |
CVE-2025-62853 | Medium | 6.5 | 2026-02-11 | A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability t… |
CVE-2025-59386 | Medium | 4.9 | 2026-02-11 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-58472 | Medium | 4.9 | 2026-02-11 | A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator account, they can then exploit… |
CVE-2025-58471 | Medium | 4.9 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator ac… |
CVE-2025-58470 | Medium | 6.5 | 2026-02-11 | A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to… |
CVE-2025-58467 | Medium | 6.5 | 2026-02-11 | A relative path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnera… |
CVE-2025-58466 | Medium | 4.9 | 2026-02-11 | A use of uninitialized variable vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator a… |
CVE-2025-57713 | High | 7.5 | 2026-02-11 | A weak authentication vulnerability has been reported to affect File Station 5. The remote attackers can then exploit the vulnerability to gain sensitive infor… |
CVE-2025-57711 | Medium | 4.9 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator ac… |
CVE-2025-57710 | Medium | 4.9 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains an administrator ac… |
CVE-2025-57709 | High | 8.1 | 2026-02-11 | A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability t… |
CVE-2025-57708 | Medium | 6.5 | 2026-02-11 | An allocation of resources without limits or throttling vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, the… |
CVE-2025-57707 | High | 8.8 | 2026-02-11 | An improper neutralization of directives in statically saved code ('Static Code Injection') vulnerability has been reported to affect File Station 5. If a remo… |
CVE-2025-54170 | Medium | 6.5 | 2026-02-11 | An out-of-bounds read vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerabili… |