2025 CVEs (page 27)
Page 27 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-32739 | Low | 2.8 | 2026-02-10 | Improper conditions check in some firmware for some Intel(R) Graphics Drivers and Intel LTS kernels within Ring 1: Device Drivers may allow a denial of service… |
CVE-2025-32735 | Medium | 5.5 | 2026-02-10 | Improper conditions check in some firmware for some Intel(R) NPU Drivers within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adv… |
CVE-2025-32467 | Medium | 4.1 | 2026-02-10 | Use of uninitialized variable for some TDX Module before version tdx1.5 within Ring 0: Hypervisor may allow an information disclosure. Authorized adversary wit… |
CVE-2025-32453 | Medium | 6.7 | 2026-02-10 | Incorrect default permissions for some Intel(R) Graphics Driver software within Ring 2: Privileged Process may allow an escalation of privilege. Unprivileged s… |
CVE-2025-32452 | Medium | 6.7 | 2026-02-10 | Uncontrolled search path for some AI Playground before version 2.6.1 beta within Ring 3: User Applications may allow an escalation of privilege. Unprivileged s… |
CVE-2025-32092 | Medium | 6.7 | 2026-02-10 | Insecure inherited permissions for some Intel(R) Graphics Software before version 25.30.1702.0 within Ring 3: User Applications may allow an escalation of priv… |
CVE-2025-32008 | High | 8.6 | 2026-02-10 | Out-of-bounds write in the firmware for the Intel(R) AMT and Intel(R) Standard Manageability within Ring 3: User Applications may allow a denial of service. Ne… |
CVE-2025-32007 | Medium | 4.4 | 2026-02-10 | Out-of-bounds read for some TDX before version tdx module 1.5.24 within Ring 0: Hypervisor may allow an information disclosure. Authorized adversary with a pri… |
CVE-2025-32003 | Medium | 6.5 | 2026-02-10 | Out-of-bounds read in the firmware for some 100GbE Intel(R) Ethernet Network Adapter E810 before version cvl fw 1.7.6, cpk 1.3.7 within Ring 0: Bare Metal OS m… |
CVE-2025-31944 | Medium | 5.3 | 2026-02-10 | Race condition for some TDX Module before version tdx1.5 within Ring 0: Hypervisor may allow a denial of service. Authorized adversary with a privileged user c… |
CVE-2025-31655 | Medium | 6.7 | 2026-02-10 | Incorrect default permissions for some Intel(R) Battery Life Diagnostic Tool within Ring 3: User Applications may allow an escalation of privilege. Unprivilege… |
CVE-2025-31648 | Low | 3.9 | 2026-02-10 | Improper handling of values in the microcode flow for some Intel(R) Processor Family may allow an escalation of privilege. Startup code and smm adversary with… |
CVE-2025-30513 | High | 7.9 | 2026-02-10 | Race condition for some TDX Module within Ring 0: Hypervisor may allow an escalation of privilege. System software adversary with a privileged user combined wi… |
CVE-2025-30508 | Medium | 6.5 | 2026-02-10 | Improper authorization in the Intel(R) Quick Assist Technology for some Intel(R) Platforms within Ring 0: Kernel may allow a denial of service. Unprivileged so… |
CVE-2025-27940 | Medium | 4.1 | 2026-02-10 | Out-of-bounds read for some TDX Module before version tdx1.5 within Ring 0: Hypervisor may allow an information disclosure. Software side channel adversary wit… |
CVE-2025-27708 | Medium | 4.1 | 2026-02-10 | Out-of-bounds read in the firmware for some Intel(R) Converged Security and Management Engine (CSME) Firmware (FW) within Ring 0: Kernel may allow an informati… |
CVE-2025-27572 | Medium | 4.1 | 2026-02-10 | Exposure of sensitive information during transient execution for some TDX within Ring 0: Hypervisor may allow an information disclosure. Authorized adversary w… |
CVE-2025-27560 | Medium | 6.0 | 2026-02-10 | Loop with unreachable exit condition ('infinite loop') for some Intel(R) Platform within Ring 0: Kernel may allow a denial of service. System software adversar… |
CVE-2025-27535 | Medium | 5.3 | 2026-02-10 | Exposed ioctl with insufficient access control in the firmware for some Intel(R) Ethernet Connection E825-C. before version NVM ver. 3.84 within Ring 0: Bare M… |
CVE-2025-27243 | Medium | 6.0 | 2026-02-10 | Out-of-bounds write in the firmware for some Intel(R) Ethernet Controller E810 before version cvl fw 1.7.8.x within Ring 0: Bare Metal OS may allow a denial of… |
CVE-2025-25210 | High | 8.2 | 2026-02-10 | Improper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may allow an escalation of… |
CVE-2025-25058 | Low | 3.3 | 2026-02-10 | Improper initialization for some ESXi kernel mode driver for the Intel(R) Ethernet 800-Series before version 2.2.2.0 (esxi 8.0) & 2.2.3.0 (esxi 9.0) within… |
CVE-2025-24851 | Medium | 6.0 | 2026-02-10 | Uncaught exception in the firmware for some 100GbE Intel(R) Ethernet Controller E810 before version cvl fw 1.7.8.x within Ring 0: Bare Metal OS may allow a den… |
CVE-2025-22885 | Medium | 4.7 | 2026-02-10 | Improper buffer restrictions in the firmware for the TDX Module may allow an escalation of privilege. System software adversary with a privileged user combined… |
CVE-2025-22849 | Medium | 6.7 | 2026-02-10 | Incorrect default permissions for the Intel(R) Optane(TM) PMem management software before versions CR_MGMT_01.00.00.3584, CR_MGMT_02.00.00.4052, CR_MGMT_03.00… |
CVE-2025-22453 | High | 7.5 | 2026-02-10 | Improper input validation for some Server Firmware Update Utility(SysFwUpdt) before version 16.0.12 within Ring 3: User Applications may allow an escalation of… |
CVE-2025-20106 | Medium | 6.7 | 2026-02-10 | Uncontrolled search path in some software installer for some VTune(TM) Profiler software and Intel(R) oneAPI Base Toolkits before version 2025.0. within Ring 3… |
CVE-2025-20080 | Medium | 6.8 | 2026-02-10 | Null pointer dereference in the firmware for some Intel(R) AMT and Intel(R) Standard Manageability within Ring 0: Kernel may allow a denial of service. Network… |
CVE-2025-20070 | Medium | 6.7 | 2026-02-10 | Improper conditions check for the Intel(R) Optane(TM) PMem management software before versions CR_MGMT_02.00.00.4052, CR_MGMT_03.00.00.0538 within Ring 3: User… |
CVE-2025-70347 | Medium | 5.5 | 2026-02-10 | An issue in mquickjs before commit 74b7e (2026-01-15) allows a local attacker to cause a denial of service via a crafted file to the get_mblock_size function a… |
CVE-2025-68686 | Medium | 5.9 | 2026-02-10 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 thro… |
CVE-2025-64157 | Medium | 6.7 | 2026-02-10 | A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.11… |
CVE-2025-62676 | High | 7.1 | 2026-02-10 | An Improper Link Resolution Before File Access ('Link Following') vulnerability [CWE-59] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.4, Fort… |
CVE-2025-62439 | Medium | 4.2 | 2026-02-10 | An Improper Verification of Source of a Communication Channel vulnerability [CWE-940] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 thro… |
CVE-2025-55018 | Medium | 5.8 | 2026-02-10 | An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 al… |
CVE-2025-52436 | High | 8.8 | 2026-02-10 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 thr… |
CVE-2025-15572 | Low | 3.3 | 2026-02-10 | A vulnerability has been found in wasm3 up to 0.5.0. The affected element is the function NewCodePage. The manipulation leads to memory leak. The attack must b… |
CVE-2025-11004 | | 2026-02-10 | The Simplicity Device Manager Tool has a Reflected XSS (Cross-site-scripting) vulnerability in several API endpoints. The attacker needs to be on the same netw… | |
CVE-2025-7636 | High | 8.8 | 2026-02-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ergosis Security Systems Computer Industry and Trade Inc… |
CVE-2025-7347 | High | 8.8 | 2026-02-10 | Authorization Bypass Through User-Controlled Key vulnerability in Dinibh Puzzle Software Solutions Dinibh Patrol Tracking System allows Exploitation of Trusted… |
CVE-2025-15571 | Low | 3.3 | 2026-02-10 | A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file stream.c. Such manipu… |
CVE-2025-6967 | High | 8.7 | 2026-02-10 | Execution After Redirect (EAR) vulnerability in Sarman Soft Software and Technology Services Industry and Trade Ltd. Co. CMS allows JSON Hijacking (aka JavaScr… |
CVE-2025-15570 | Medium | 5.3 | 2026-02-10 | A vulnerability was found in ckolivas lrzip up to 0.651. This impacts the function lzma_decompress_buf of the file stream.c. Performing a manipulation results… |
CVE-2025-15569 | High | 7.0 | 2026-02-10 | A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The impacted element is the function get_system_dpi of the file platform/x11/win_main.c. This m… |
CVE-2025-11537 | Medium | 5.0 | 2026-02-10 | A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' pattern), sensitive hea… |
CVE-2025-40587 | High | 7.6 | 2026-02-10 | A vulnerability has been identified in Polarion V2404 (All versions < V2404.5), Polarion V2410 (All versions < V2410.2). The affected application allows arbitr… |
CVE-2025-14895 | Medium | 5.4 | 2026-02-10 | The PopupKit plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.0. This is due to the plugin not properly ver… |
CVE-2025-11242 | Critical | 9.8 | 2026-02-10 | Server-Side Request Forgery (SSRF) vulnerability in Teknolist Computer Systems Software Publishing Industry and Trade Inc. Okulistik allows Server Side Request… |
CVE-2025-12063 | Medium | 5.7 | 2026-02-10 | An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions. |
CVE-2025-13064 | Medium | 4.5 | 2026-02-10 | A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server. This at… |
CVE-2025-12757 | Medium | 4.6 | 2026-02-10 | An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to. |
CVE-2025-11547 | High | 7.8 | 2026-02-10 | AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user. |
CVE-2025-11142 | High | 7.1 | 2026-02-10 | The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited afte… |
CVE-2025-15314 | Medium | 5.5 | 2026-02-10 | Tanium addressed an arbitrary file deletion vulnerability in end-user-cx. |
CVE-2025-15313 | Medium | 5.5 | 2026-02-10 | Tanium addressed an arbitrary file deletion vulnerability in Tanium EUSS. |
CVE-2025-15310 | High | 7.8 | 2026-02-10 | Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools. |
CVE-2025-15147 | Medium | 4.3 | 2026-02-10 | The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all version… |
CVE-2025-15319 | High | 7.8 | 2026-02-09 | Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools. |
CVE-2025-15318 | Medium | 5.5 | 2026-02-09 | Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools. |
CVE-2025-15317 | Medium | 6.5 | 2026-02-09 | Tanium addressed an uncontrolled resource consumption vulnerability in Tanium Server. |
CVE-2025-15316 | Medium | 6.7 | 2026-02-09 | Tanium addressed a local privilege escalation vulnerability in Tanium Server. |
CVE-2025-15315 | Medium | 6.7 | 2026-02-09 | Tanium addressed a local privilege escalation vulnerability in Tanium Module Server. |
CVE-2025-14778 | Medium | 5.4 | 2026-02-09 | A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating… |
CVE-2025-7432 | | 2026-02-09 | DPA countermeasures in Silicon Labs' Series 2 devices are not reseeded under certain conditions. This may allow an attacker to eventually extract secret keys… | |
CVE-2025-66630 | Critical | 9.4 | 2026-02-09 | Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the underlying crypto/rand implementation can return an… |
CVE-2025-63354 | Medium | 4.8 | 2026-02-09 | Hitron HI3120 v7.2.4.5.2b1 allows stored XSS via the Parental Control option when creating a new filter. The device fails to properly handle inputs, allowing a… |
CVE-2025-59024 | Medium | 6.5 | 2026-02-09 | Crafted delegations or IP fragments can poison cached delegations in Recursor. |
CVE-2025-59023 | High | 8.2 | 2026-02-09 | Crafted delegations or IP fragments can poison cached delegations in Recursor. |
CVE-2025-14831 | Medium | 5.3 | 2026-02-09 | A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially… |
CVE-2025-10465 | High | 8.8 | 2026-02-09 | Unrestricted Upload of File with Dangerous Type vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Sensaway allows Upload a Web Shel… |
CVE-2025-10464 | Medium | 6.5 | 2026-02-09 | Insecure Storage of Sensitive Information vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Retrieve Embedded Sensi… |
CVE-2025-7708 | Medium | 6.8 | 2026-02-09 | Insertion of Sensitive Information Into Sent Data vulnerability in Atlas Educational Software Industry Ltd. Co. K12net allows Communication Channel Manipulatio… |
CVE-2025-6830 | Critical | 9.8 | 2026-02-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpoda Türkiye Information Technology Inc. Password Module… |
CVE-2025-10463 | High | 7.3 | 2026-02-09 | Improper Authentication vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Authentication Abuse. This issue affects… |
CVE-2025-7799 | High | 8.6 | 2026-02-09 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc. E-Taxpayer Acc… |
CVE-2025-66598 | High | 7.5 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product supports old SSL/TLS versions, potentially allowing an… |
CVE-2025-66597 | High | 7.5 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product supports weak cryptographic algorithms, potentially all… |
CVE-2025-66596 | Medium | 6.1 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly validate request headers. When an att… |
CVE-2025-66595 | Medium | 5.4 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product is vulnerable to Cross-Site Request Forgery (CSRF). Whe… |
CVE-2025-66594 | Medium | 5.3 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. Detailed messages are displayed on the error page. This information co… |
CVE-2025-66608 | High | 7.5 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly validate URLs. An attacker could send… |
CVE-2025-66607 | Medium | 5.3 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The response header contains an insecure setting. Users could be red… |
CVE-2025-66606 | Critical | 9.6 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly encode URLs. An attacker could tamper… |
CVE-2025-66605 | Medium | 5.3 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. Since there are input fields on this webpage with the autocomplete a… |
CVE-2025-66604 | Medium | 5.3 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The library version could be displayed on the web page. This informa… |
CVE-2025-66603 | Critical | 9.8 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The web server accepts the OPTIONS method. An attacker could potenti… |
CVE-2025-66602 | Critical | 9.8 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The web server accepts access by IP address. When a worm that random… |
CVE-2025-66601 | Medium | 6.1 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not specify MIME types. When an attacker performs… |
CVE-2025-66600 | | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product lacks HSTS (HTTP Strict Transport Security) configurati… | |
CVE-2025-66599 | | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. Physical paths could be displayed on web pages. This information cou… | |
CVE-2025-15100 | High | 8.8 | 2026-02-08 | The JAY Login & Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.6.03. This is due to the plugin all… |
CVE-2025-15027 | Critical | 9.8 | 2026-02-08 | The JAY Login & Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.6.03. This is due to the plugin all… |
CVE-2025-15564 | Low | 3.3 | 2026-02-07 | A vulnerability has been found in Mapnik up to 4.2.0. This vulnerability affects the function mapnik::detail::mod<...>::operator of the file src/value.cpp. The… |
CVE-2025-15477 | Medium | 6.5 | 2026-02-07 | The Bucketlister plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode `category` and `id` attributes in all versions up to, and inclu… |
CVE-2025-15476 | Medium | 4.3 | 2026-02-07 | The The Bucketlister plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bucketlister_do_admin_aja… |
CVE-2025-15491 | Medium | 5.5 | 2026-02-07 | The Post Slides WordPress plugin through 1.0.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, al… |
CVE-2025-15267 | Medium | 6.4 | 2026-02-07 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_accordion_item shortcode in all versions up to… |
CVE-2025-13463 | Medium | 6.4 | 2026-02-07 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Grid component in all versions up to, and including, 5.5.3… |
CVE-2025-12803 | Medium | 6.4 | 2026-02-07 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin 'bt_bb_tabs' shortcode in all versions up to, and includ… |
CVE-2025-12159 | Medium | 6.4 | 2026-02-07 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_raw_content shortcode in all versions up to, and… |