2025 CVEs (page 273)
Page 273 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-6619 | Medium | 6.3 | 2025-06-25 | A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been declared as critical. Affected by this vulnerability is the function setUpgradeFW of the… |
CVE-2025-6618 | Medium | 6.3 | 2025-06-25 | A vulnerability was found in TOTOLINK CA300-PoE 6.2c.884. It has been classified as critical. Affected is the function SetWLanApcliSettings of the file wps.so… |
CVE-2025-6445 | High | 8.1 | 2025-06-25 | ServiceStack FindType Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2025-6444 | Medium | 5.9 | 2025-06-25 | ServiceStack GetErrorResponse Improper Input Validation NTLM Relay Vulnerability. This vulnerability allows remote attackers to relay NTLM credentials on affec… |
CVE-2025-5834 | High | 7.8 | 2025-06-25 | Pioneer DMH-WT7600NEX Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to bypass… |
CVE-2025-5833 | Medium | 6.8 | 2025-06-25 | Pioneer DMH-WT7600NEX Root Filesystem Insufficient Verification of Data Authenticity Vulnerability. This vulnerability allows physically present attackers to b… |
CVE-2025-5832 | Medium | 6.8 | 2025-06-25 | Pioneer DMH-WT7600NEX Software Update Signing Insufficient Verification of Data Authenticity Vulnerability. This vulnerability allows physically present attack… |
CVE-2025-5830 | High | 8.8 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial DLB_SlaveRegister Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adj… |
CVE-2025-5829 | Medium | 6.8 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial autocharge Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically presen… |
CVE-2025-5828 | Medium | 6.8 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial wLength Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to… |
CVE-2025-5827 | High | 8.8 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows networ… |
CVE-2025-5826 | Medium | 6.3 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial ble_process_esp32_msg Misinterpretation of Input Vulnerability. This vulnerability allows network-adjacent attackers to… |
CVE-2025-5825 | High | 7.5 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute… |
CVE-2025-5824 | High | 7.5 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial Origin Validation Error Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to by… |
CVE-2025-5823 | Medium | 6.5 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial Serial Number Exposed Dangerous Method Information Disclosure Vulnerability. This vulnerability allows remote attackers… |
CVE-2025-5822 | High | 8.8 | 2025-06-25 | Autel MaxiCharger AC Wallbox Commercial Technician API Incorrect Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers t… |
CVE-2025-49550 | Medium | 4.3 | 2025-06-25 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result… |
CVE-2025-49549 | Low | 2.7 | 2025-06-25 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Incorrect Authorization vulnerability that could result… |
CVE-2025-45332 | High | 7.5 | 2025-06-25 | vkoskiv c-ray 1.1 contains a Null Pointer Dereference (NPD) vulnerability in the parse_mtllib function of its data processing module, leading to unpredictable… |
CVE-2025-6617 | High | 8.8 | 2025-06-25 | A vulnerability was found in D-Link DIR-619L 2.06B01 and classified as critical. This issue affects the function formAdvanceSetup of the file /goform/formAdvan… |
CVE-2025-6616 | High | 8.8 | 2025-06-25 | A vulnerability has been found in D-Link DIR-619L 2.06B01 and classified as critical. This vulnerability affects the function formSetWAN_Wizard51 of the file /… |
CVE-2025-6442 | Medium | 5.9 | 2025-06-25 | Ruby WEBrick read_header HTTP Request Smuggling Vulnerability. This vulnerability allows remote attackers to smuggle arbitrary HTTP requests on affected instal… |
CVE-2025-5015 | High | 8.8 | 2025-06-25 | A cross-site scripting vulnerability exists in the AccuWeather and Custom RSS widget that allows an unauthenticated user to replace the RSS feed URL with a mal… |
CVE-2025-52999 | | 2025-06-25 | jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. In versions prior to 2.15.0, i… | |
CVE-2025-52894 | High | 7.5 | 2025-06-25 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0… |
CVE-2025-52893 | Medium | 4.5 | 2025-06-25 | OpenBao exists to provide a software solution to manage, store, and distribute sensitive data including secrets, certificates, and keys. OpenBao before v2.3.0… |
CVE-2025-52890 | High | 8.1 | 2025-06-25 | Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables ru… |
CVE-2025-52889 | Low | 3.4 | 2025-06-25 | Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus version 6.12 and 6.13 generates nftables ru… |
CVE-2025-52576 | Medium | 5.3 | 2025-06-25 | Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard is vulnerable to username enumeration and IP… |
CVE-2025-52569 | | 2025-06-25 | GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 5.9.1 lack input validation of input validation for user-provided value… | |
CVE-2025-52483 | Critical | 9.8 | 2025-06-25 | Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the cl… |
CVE-2025-52480 | Critical | 9.8 | 2025-06-25 | Registrator is a GitHub app that automates creation of registration pull requests for julia packages to the General registry. Prior to version 1.9.5, if the cl… |
CVE-2025-4656 | Low | 3.1 | 2025-06-25 | Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled cancellation by a Vault operator. Th… |
CVE-2025-49153 | | 2025-06-25 | The affected products could allow an unauthenticated attacker to overwrite files and execute arbitrary code. | |
CVE-2025-49152 | | 2025-06-25 | The affected products contain JSON Web Tokens (JWT) that do not expire, which could allow an attacker to gain access to the system. | |
CVE-2025-49151 | | 2025-06-25 | The affected products could allow an unauthenticated attacker to generate forged JSON Web Tokens (JWT) to bypass authentication. | |
CVE-2025-20282 | Critical | 10.0 | 2025-06-25 | A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to upload arbitrary files to an affected devi… |
CVE-2025-6615 | High | 8.8 | 2025-06-25 | A vulnerability, which was classified as critical, was found in D-Link DIR-619L 2.06B01. This affects the function formAutoDetecWAN_wizard4 of the file /goform… |
CVE-2025-6614 | High | 8.8 | 2025-06-25 | A vulnerability, which was classified as critical, has been found in D-Link DIR-619L 2.06B01. Affected by this issue is the function formSetWANType_Wizard5 of… |
CVE-2025-6612 | High | 7.3 | 2025-06-25 | A vulnerability was found in code-projects Inventory Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the fi… |
CVE-2025-6611 | High | 7.3 | 2025-06-25 | A vulnerability was found in code-projects Inventory Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the fi… |
CVE-2025-52479 | | 2025-06-25 | HTTP.jl provides HTTP client and server functionality for Julia, and URIs.jl parses and works with Uniform Resource Identifiers (URIs). URIs.jl prior to versio… | |
CVE-2025-50179 | Medium | 4.6 | 2025-06-25 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a cross-site request forgery vulnerabili… |
CVE-2025-50178 | | 2025-06-25 | GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 0.4.3 lack input validation for user provided values in certain functio… | |
CVE-2025-49845 | High | 7.5 | 2025-06-25 | Discourse is an open-source discussion platform. The visibility of posts typed `whisper` is controlled via the `whispers_allowed_groups` site setting. Only use… |
CVE-2025-44206 | Medium | 4.6 | 2025-06-25 | Hexagon HxGN OnCall Dispatch Advantage (Web) v10.2309.03.00264 and Hexagon HxGN OnCall Dispatch Advantage (Mobile) v10.2402 are vulnerable to Cross Site Script… |
CVE-2025-25905 | High | 7.1 | 2025-06-25 | Cross-Site Scripting (XSS) vulnerability in CADClick v1.13.0 and before allows remote attackers to inject arbitrary web script or HTML via the "tree" parameter. |
CVE-2025-20281 | Critical | 10.0 | 2025-06-25 | A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying op… |
CVE-2025-20264 | Medium | 6.4 | 2025-06-25 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass the autho… |
CVE-2025-6610 | Medium | 4.7 | 2025-06-25 | A vulnerability was found in itsourcecode Employee Management System up to 1.0. It has been classified as critical. This affects an unknown part of the file /a… |
CVE-2025-6609 | Medium | 6.3 | 2025-06-25 | A vulnerability was found in SourceCodester Best Salon Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality o… |
CVE-2025-6608 | Medium | 6.3 | 2025-06-25 | A vulnerability has been found in SourceCodester Best Salon Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown func… |
CVE-2025-49135 | Medium | 6.5 | 2025-06-25 | CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.2.0 through 2.39.0 have no validation during the import proc… |
CVE-2025-6607 | Medium | 6.3 | 2025-06-25 | A vulnerability, which was classified as critical, was found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the file /p… |
CVE-2025-6606 | Medium | 6.3 | 2025-06-25 | A vulnerability, which was classified as critical, has been found in SourceCodester Best Salon Management System 1.0. This issue affects some unknown processin… |
CVE-2025-6605 | Medium | 6.3 | 2025-06-25 | A vulnerability classified as critical was found in SourceCodester Best Salon Management System 1.0. This vulnerability affects unknown code of the file /panel… |
CVE-2025-48991 | Medium | 4.6 | 2025-06-25 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a vulnerability present in Tuleap Commun… |
CVE-2025-48954 | High | 8.1 | 2025-06-25 | Discourse is an open-source discussion platform. Versions prior to 3.5.0.beta6 are vulnerable to cross-site scripting when the content security policy isn't en… |
CVE-2025-6604 | Medium | 6.3 | 2025-06-25 | A vulnerability classified as critical has been found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/add-s… |
CVE-2025-6543 | Critical | 9.8 | 2025-06-25 | Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN v… |
CVE-2025-25012 | Medium | 4.3 | 2025-06-25 | URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a speciall… |
CVE-2025-6603 | Medium | 5.3 | 2025-06-25 | A vulnerability was found in coldfunction qCUDA up to db0085400c2f2011eed46fbc04fdc0873141688e. It has been rated as problematic. Affected by this issue is the… |
CVE-2025-6613 | Low | 3.5 | 2025-06-25 | A vulnerability classified as problematic was found in PHPGurukul Hospital Management System 4.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-5927 | High | 7.5 | 2025-06-25 | The Everest Forms (Pro) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() func… |
CVE-2025-49797 | High | 7.8 | 2025-06-25 | Multiple Brother driver installers for Windows contain a privilege escalation vulnerability. If exploited, an arbitrary program may be executed with the admini… |
CVE-2025-41647 | Medium | 5.5 | 2025-06-25 | A local, low-privileged attacker can learn the password of the connected controller in PLC Designer V4 due to an incorrect implementation that results in the p… |
CVE-2025-41256 | High | 7.4 | 2025-06-25 | Cyberduck and Mountain Duck improper handle TLS certificate pinning for untrusted certificates (e.g., self-signed), since the certificate fingerprint is stored… |
CVE-2025-41255 | High | 8.0 | 2025-06-25 | Cyberduck and Mountain Duck improperly handle TLS certificate pinning for untrusted certificates (e.g., self-signed), unnecessarily installing it to the Window… |
CVE-2025-43880 | Medium | 4.3 | 2025-06-25 | Inefficient regular expression complexity issue exists in GROWI prior to v7.1.6. If exploited, a logged-in user may cause a denial of service (DoS) condition. |
CVE-2025-5585 | Medium | 6.4 | 2025-06-25 | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-url` DOM Element Attribute in all versions up to… |
CVE-2025-36004 | High | 8.8 | 2025-06-25 | IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for i. A malicious acto… |
CVE-2025-0966 | High | 7.6 | 2025-06-25 | IBM InfoSphere Information Server 11.7 vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attack… |
CVE-2025-6583 | Medium | 6.3 | 2025-06-25 | A vulnerability, which was classified as critical, was found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /view… |
CVE-2025-6582 | Medium | 6.3 | 2025-06-25 | A vulnerability, which was classified as critical, has been found in SourceCodester Best Salon Management System 1.0. Affected by this issue is some unknown fu… |
CVE-2025-6581 | Medium | 6.3 | 2025-06-24 | A vulnerability classified as critical was found in SourceCodester Best Salon Management System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2025-6580 | High | 7.3 | 2025-06-24 | A vulnerability classified as critical has been found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the component Logi… |
CVE-2025-52884 | | 2025-06-24 | RISC Zero is a zero-knowledge verifiable general computing platform, with Ethereum integration. The risc0-ethereum repository contains Solidity verifier contra… | |
CVE-2025-52883 | Medium | 5.3 | 2025-06-24 | Meshtastic-Android is an Android application for the mesh radio software Meshtastic. Prior to version 2.5.21, an attacker is able to send an unencrypted direct… |
CVE-2025-52572 | Critical | 10.0 | 2025-06-24 | Hikka, a Telegram userbot, has vulnerability affects all users on all versions of Hikka. Two scenarios are possible. 1. Web interface does not have an authenti… |
CVE-2025-6579 | High | 7.3 | 2025-06-24 | A vulnerability was found in code-projects Car Rental System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /messag… |
CVE-2025-6578 | High | 7.3 | 2025-06-24 | A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been declared as critical. This vulnerability affects unknown cod… |
CVE-2025-6557 | Medium | 5.4 | 2025-06-24 | Insufficient data validation in DevTools in Google Chrome on Windows prior to 138.0.7204.49 allowed a remote attacker who convinced a user to engage in specifi… |
CVE-2025-6556 | Medium | 5.4 | 2025-06-24 | Insufficient policy enforcement in Loader in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to bypass content security policy via a crafted HTM… |
CVE-2025-6555 | Medium | 5.4 | 2025-06-24 | Use after free in Animation in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2025-53021 | Medium | 4.2 | 2025-06-24 | A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey… |
CVE-2025-52888 | High | 7.5 | 2025-06-24 | Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity (XXE) vulnerability exists in the xun… |
CVE-2025-52882 | | 2025-06-24 | Claude Code is an agentic coding tool. Claude Code extensions in VSCode and forks (e.g., Cursor, Windsurf, and VSCodium) and JetBrains IDEs (e.g., IntelliJ, Py… | |
CVE-2025-52880 | Medium | 4.2 | 2025-06-24 | Komga is a media server for comics, mangas, BDs, magazines and eBooks. A Cross-Site Scripting (XSS) vulnerability has been discovered in versions 1.8.0 through… |
CVE-2025-52571 | Critical | 9.6 | 2025-06-24 | Hikka is a Telegram userbot. A vulnerability affects all users of versions below 1.6.2, including most of the forks. It allows an unauthenticated attacker to g… |
CVE-2025-52471 | Critical | 9.8 | 2025-06-24 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. An integer underflow vulnerability has been identified in the ESP-NOW protocol impleme… |
CVE-2025-49853 | Critical | 9.1 | 2025-06-24 | ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to SQL injections which could allow an attacker to leak arbitrary information and ins… |
CVE-2025-49852 | High | 7.5 | 2025-06-24 | ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to a server-side request forgery vulnerability which could allow an unauthenticated a… |
CVE-2025-49851 | Critical | 9.8 | 2025-06-24 | ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to an improper authentication vulnerability which could allow an attacker to bypass a… |
CVE-2025-5087 | | 2025-06-24 | Kaleris NAVIS N4 ULC (Ultra Light Client) communicates insecurely using zlib-compressed data over HTTP. An attacker capable of observing network traffic betwee… | |
CVE-2025-2566 | | 2025-06-24 | Kaleris NAVIS N4 ULC (Ultra Light Client) contains an unsafe Java deserialization vulnerability. An unauthenticated attacker can make specially crafted request… | |
CVE-2025-53073 | Medium | 4.2 | 2025-06-24 | In Sentry 25.1.0 through 25.5.1, an authenticated attacker can access a project's issue endpoint and perform unauthorized actions (such as adding a comment) wi… |
CVE-2025-49147 | Medium | 5.3 | 2025-06-24 | Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1. Via a request… |
CVE-2025-23260 | Medium | 5.0 | 2025-06-24 | NVIDIA AIStore contains a vulnerability in the AIS Operator where a user may gain elevated k8s cluster access by using the ServiceAccount attached to the Clust… |
CVE-2025-4378 | Critical | 10.0 | 2025-06-24 | Cleartext Transmission of Sensitive Information, Use of Hard-coded Credentials vulnerability in Ataturk University ATA-AOF Mobile Application allows Authentica… |
CVE-2025-6570 | Medium | 6.3 | 2025-06-24 | A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 4.0. Affected by this issue is some unknown function… |