2025 CVEs (page 275)
Page 275 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-50178 | | 2025-06-25 | GitForge.jl is a unified interface for interacting with Git "forges." Versions prior to 0.4.3 lack input validation for user provided values in certain functio… | |
CVE-2025-49845 | High | 7.5 | 2025-06-25 | Discourse is an open-source discussion platform. The visibility of posts typed `whisper` is controlled via the `whispers_allowed_groups` site setting. Only use… |
CVE-2025-44206 | Medium | 4.6 | 2025-06-25 | Hexagon HxGN OnCall Dispatch Advantage (Web) v10.2309.03.00264 and Hexagon HxGN OnCall Dispatch Advantage (Mobile) v10.2402 are vulnerable to Cross Site Script… |
CVE-2025-25905 | High | 7.1 | 2025-06-25 | Cross-Site Scripting (XSS) vulnerability in CADClick v1.13.0 and before allows remote attackers to inject arbitrary web script or HTML via the "tree" parameter. |
CVE-2025-20281 | Critical | 10.0 | 2025-06-25 | A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to execute arbitrary code on the underlying op… |
CVE-2025-20264 | Medium | 6.4 | 2025-06-25 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass the autho… |
CVE-2025-6610 | Medium | 4.7 | 2025-06-25 | A vulnerability was found in itsourcecode Employee Management System up to 1.0. It has been classified as critical. This affects an unknown part of the file /a… |
CVE-2025-6609 | Medium | 6.3 | 2025-06-25 | A vulnerability was found in SourceCodester Best Salon Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality o… |
CVE-2025-6608 | Medium | 6.3 | 2025-06-25 | A vulnerability has been found in SourceCodester Best Salon Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown func… |
CVE-2025-49135 | Medium | 6.5 | 2025-06-25 | CVAT is an open source interactive video and image annotation tool for computer vision. Versions 2.2.0 through 2.39.0 have no validation during the import proc… |
CVE-2025-6607 | Medium | 6.3 | 2025-06-25 | A vulnerability, which was classified as critical, was found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the file /p… |
CVE-2025-6606 | Medium | 6.3 | 2025-06-25 | A vulnerability, which was classified as critical, has been found in SourceCodester Best Salon Management System 1.0. This issue affects some unknown processin… |
CVE-2025-6605 | Medium | 6.3 | 2025-06-25 | A vulnerability classified as critical was found in SourceCodester Best Salon Management System 1.0. This vulnerability affects unknown code of the file /panel… |
CVE-2025-48991 | Medium | 4.6 | 2025-06-25 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker could use a vulnerability present in Tuleap Commun… |
CVE-2025-48954 | High | 8.1 | 2025-06-25 | Discourse is an open-source discussion platform. Versions prior to 3.5.0.beta6 are vulnerable to cross-site scripting when the content security policy isn't en… |
CVE-2025-6604 | Medium | 6.3 | 2025-06-25 | A vulnerability classified as critical has been found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/add-s… |
CVE-2025-6543 | Critical | 9.8 | 2025-06-25 | Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gateway (VPN v… |
CVE-2025-25012 | Medium | 4.3 | 2025-06-25 | URL redirection to an untrusted site ('Open Redirect') in Kibana can lead to sending a user to an arbitrary site and server-side request forgery via a speciall… |
CVE-2025-6603 | Medium | 5.3 | 2025-06-25 | A vulnerability was found in coldfunction qCUDA up to db0085400c2f2011eed46fbc04fdc0873141688e. It has been rated as problematic. Affected by this issue is the… |
CVE-2025-6613 | Low | 3.5 | 2025-06-25 | A vulnerability classified as problematic was found in PHPGurukul Hospital Management System 4.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-5927 | High | 7.5 | 2025-06-25 | The Everest Forms (Pro) plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_entry_files() func… |
CVE-2025-49797 | High | 7.8 | 2025-06-25 | Multiple Brother driver installers for Windows contain a privilege escalation vulnerability. If exploited, an arbitrary program may be executed with the admini… |
CVE-2025-41647 | Medium | 5.5 | 2025-06-25 | A local, low-privileged attacker can learn the password of the connected controller in PLC Designer V4 due to an incorrect implementation that results in the p… |
CVE-2025-41256 | High | 7.4 | 2025-06-25 | Cyberduck and Mountain Duck improper handle TLS certificate pinning for untrusted certificates (e.g., self-signed), since the certificate fingerprint is stored… |
CVE-2025-41255 | High | 8.0 | 2025-06-25 | Cyberduck and Mountain Duck improperly handle TLS certificate pinning for untrusted certificates (e.g., self-signed), unnecessarily installing it to the Window… |
CVE-2025-43880 | Medium | 4.3 | 2025-06-25 | Inefficient regular expression complexity issue exists in GROWI prior to v7.1.6. If exploited, a logged-in user may cause a denial of service (DoS) condition. |
CVE-2025-5585 | Medium | 6.4 | 2025-06-25 | The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-url` DOM Element Attribute in all versions up to… |
CVE-2025-36004 | High | 8.8 | 2025-06-25 | IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user to gain elevated privileges due to an unqualified library call in IBM Facsimile Support for i. A malicious acto… |
CVE-2025-0966 | High | 7.6 | 2025-06-25 | IBM InfoSphere Information Server 11.7 vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attack… |
CVE-2025-6583 | Medium | 6.3 | 2025-06-25 | A vulnerability, which was classified as critical, was found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /view… |
CVE-2025-6582 | Medium | 6.3 | 2025-06-25 | A vulnerability, which was classified as critical, has been found in SourceCodester Best Salon Management System 1.0. Affected by this issue is some unknown fu… |
CVE-2025-6581 | Medium | 6.3 | 2025-06-24 | A vulnerability classified as critical was found in SourceCodester Best Salon Management System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2025-6580 | High | 7.3 | 2025-06-24 | A vulnerability classified as critical has been found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the component Logi… |
CVE-2025-52884 | | 2025-06-24 | RISC Zero is a zero-knowledge verifiable general computing platform, with Ethereum integration. The risc0-ethereum repository contains Solidity verifier contra… | |
CVE-2025-52883 | Medium | 5.3 | 2025-06-24 | Meshtastic-Android is an Android application for the mesh radio software Meshtastic. Prior to version 2.5.21, an attacker is able to send an unencrypted direct… |
CVE-2025-52572 | Critical | 10.0 | 2025-06-24 | Hikka, a Telegram userbot, has vulnerability affects all users on all versions of Hikka. Two scenarios are possible. 1. Web interface does not have an authenti… |
CVE-2025-6579 | High | 7.3 | 2025-06-24 | A vulnerability was found in code-projects Car Rental System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /messag… |
CVE-2025-6578 | High | 7.3 | 2025-06-24 | A vulnerability was found in code-projects Simple Online Hotel Reservation System 1.0. It has been declared as critical. This vulnerability affects unknown cod… |
CVE-2025-6557 | Medium | 5.4 | 2025-06-24 | Insufficient data validation in DevTools in Google Chrome on Windows prior to 138.0.7204.49 allowed a remote attacker who convinced a user to engage in specifi… |
CVE-2025-6556 | Medium | 5.4 | 2025-06-24 | Insufficient policy enforcement in Loader in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to bypass content security policy via a crafted HTM… |
CVE-2025-6555 | Medium | 5.4 | 2025-06-24 | Use after free in Animation in Google Chrome prior to 138.0.7204.49 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2025-53021 | Medium | 4.2 | 2025-06-24 | A session fixation vulnerability in Moodle 3.x through 3.11.18 allows unauthenticated attackers to hijack user sessions via the sesskey parameter. The sesskey… |
CVE-2025-52888 | High | 7.5 | 2025-06-24 | Allure 2 is the version 2.x branch of Allure Report, a multi-language test reporting tool. A critical XML External Entity (XXE) vulnerability exists in the xun… |
CVE-2025-52882 | | 2025-06-24 | Claude Code is an agentic coding tool. Claude Code extensions in VSCode and forks (e.g., Cursor, Windsurf, and VSCodium) and JetBrains IDEs (e.g., IntelliJ, Py… | |
CVE-2025-52880 | Medium | 4.2 | 2025-06-24 | Komga is a media server for comics, mangas, BDs, magazines and eBooks. A Cross-Site Scripting (XSS) vulnerability has been discovered in versions 1.8.0 through… |
CVE-2025-52571 | Critical | 9.6 | 2025-06-24 | Hikka is a Telegram userbot. A vulnerability affects all users of versions below 1.6.2, including most of the forks. It allows an unauthenticated attacker to g… |
CVE-2025-52471 | Critical | 9.8 | 2025-06-24 | ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. An integer underflow vulnerability has been identified in the ESP-NOW protocol impleme… |
CVE-2025-49853 | Critical | 9.1 | 2025-06-24 | ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to SQL injections which could allow an attacker to leak arbitrary information and ins… |
CVE-2025-49852 | High | 7.5 | 2025-06-24 | ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to a server-side request forgery vulnerability which could allow an unauthenticated a… |
CVE-2025-49851 | Critical | 9.8 | 2025-06-24 | ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to an improper authentication vulnerability which could allow an attacker to bypass a… |
CVE-2025-5087 | | 2025-06-24 | Kaleris NAVIS N4 ULC (Ultra Light Client) communicates insecurely using zlib-compressed data over HTTP. An attacker capable of observing network traffic betwee… | |
CVE-2025-2566 | | 2025-06-24 | Kaleris NAVIS N4 ULC (Ultra Light Client) contains an unsafe Java deserialization vulnerability. An unauthenticated attacker can make specially crafted request… | |
CVE-2025-53073 | Medium | 4.2 | 2025-06-24 | In Sentry 25.1.0 through 25.5.1, an authenticated attacker can access a project's issue endpoint and perform unauthorized actions (such as adding a comment) wi… |
CVE-2025-49147 | Medium | 5.3 | 2025-06-24 | Umbraco, a free and open source .NET content management system, has a vulnerability in versions 10.0.0 through 10.8.10 and 13.0.0 through 13.9.1. Via a request… |
CVE-2025-23260 | Medium | 5.0 | 2025-06-24 | NVIDIA AIStore contains a vulnerability in the AIS Operator where a user may gain elevated k8s cluster access by using the ServiceAccount attached to the Clust… |
CVE-2025-4378 | Critical | 10.0 | 2025-06-24 | Cleartext Transmission of Sensitive Information, Use of Hard-coded Credentials vulnerability in Ataturk University ATA-AOF Mobile Application allows Authentica… |
CVE-2025-6570 | Medium | 6.3 | 2025-06-24 | A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 4.0. Affected by this issue is some unknown function… |
CVE-2025-50699 | Medium | 6.1 | 2025-06-24 | PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in odms/admin/view-user-queries.php. |
CVE-2025-50695 | Medium | 6.1 | 2025-06-24 | PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Cross Site Scripting (XSS) in /admin/view-booking-detail.php and /admin/invoice-generating… |
CVE-2025-50693 | Medium | 6.5 | 2025-06-24 | PHPGurukul Online DJ Booking Management System 2.0 is vulnerable to Insecure Direct Object Reference (IDOR) in odms/request-details.php. |
CVE-2025-4383 | Critical | 9.3 | 2025-06-24 | Improper Restriction of Excessive Authentication Attempts vulnerability in Art-in Bilişim Teknolojileri ve Yazılım Hizm. Tic. Ltd. Şti. Wi-Fi Cloud Hotspot all… |
CVE-2025-44531 | High | 7.5 | 2025-06-24 | An issue in Realtek RTL8762EKF-EVB RTL8762E SDK v1.4.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted before a pairing public key is… |
CVE-2025-23265 | High | 7.8 | 2025-06-24 | NVIDIA Megatron-LM for all platforms contains a vulnerability in a python component where an attacker may cause a code injection issue by providing a malicious… |
CVE-2025-23264 | High | 7.8 | 2025-06-24 | NVIDIA Megatron-LM for all platforms contains a vulnerability in a python component where an attacker may cause a code injection issue by providing a malicious… |
CVE-2025-6569 | Medium | 4.3 | 2025-06-24 | A vulnerability classified as problematic was found in code-projects School Fees Payment System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2025-6568 | High | 8.8 | 2025-06-24 | A vulnerability classified as critical has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is an unknown function of the file /boafrm/formIpv6S… |
CVE-2025-6567 | High | 7.3 | 2025-06-24 | A vulnerability was found in Campcodes Online Recruitment Management System 1.0. It has been rated as critical. This issue affects some unknown processing of t… |
CVE-2025-36537 | High | 7.0 | 2025-06-24 | Incorrect Permission Assignment for Critical Resource in the TeamViewer Client (Full and Host) of TeamViewer Remote and Tensor prior Version 15.67 on Windows a… |
CVE-2025-32978 | High | 7.5 | 2025-06-24 | Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1… |
CVE-2025-32977 | Critical | 9.6 | 2025-06-24 | Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1… |
CVE-2025-32976 | High | 8.8 | 2025-06-24 | Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1… |
CVE-2025-32975 | Critical | 10.0 | 2025-06-24 | Quest KACE Systems Management Appliance (SMA) 13.0.x before 13.0.385, 13.1.x before 13.1.81, 13.2.x before 13.2.183, 14.0.x before 14.0.341 (Patch 5), and 14.1… |
CVE-2025-6032 | High | 8.3 | 2025-06-24 | A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue… |
CVE-2025-5318 | Medium | 5.4 | 2025-06-24 | A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect com… |
CVE-2025-27828 | High | 7.1 | 2025-06-24 | A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4, 10.1.0.0 through 10.1.0.5, and 10.2.0.0 through 10.2.0.4 coul… |
CVE-2025-27827 | High | 7.1 | 2025-06-24 | A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.2.0.3 could allow an unauthenticated attacker to conduct an informat… |
CVE-2025-6566 | Medium | 5.3 | 2025-06-24 | A vulnerability was found in oatpp Oat++ up to 1.3.1. It has been declared as critical. This vulnerability affects the function deserializeArray of the file sr… |
CVE-2025-6565 | High | 8.8 | 2025-06-24 | A vulnerability was found in Netgear WNCE3001 1.0.0.50. It has been classified as critical. This affects the function http_d of the component HTTP POST Request… |
CVE-2025-6436 | High | 8.1 | 2025-06-24 | Memory safety bugs present in Firefox 139 and Thunderbird 139. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2025-6435 | High | 8.1 | 2025-06-24 | If a user saved a response from the Network tab in Devtools using the Save As context menu option, that file may not have been saved with the `.download` file… |
CVE-2025-6434 | Medium | 4.3 | 2025-06-24 | The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker… |
CVE-2025-6433 | Critical | 9.8 | 2025-06-24 | If a user visited a webpage with an invalid TLS certificate, and granted an exception, the webpage was able to provide a WebAuthn challenge that the user would… |
CVE-2025-6432 | High | 8.6 | 2025-06-24 | When Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was invalid or the SOCKS proxy was not respondin… |
CVE-2025-6431 | Medium | 6.5 | 2025-06-24 | When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed th… |
CVE-2025-6430 | Medium | 6.1 | 2025-06-24 | When a file download is specified via the `Content-Disposition` header, that directive would be ignored if the file was included via a `<embed>` or `<… |
CVE-2025-6429 | Medium | 6.5 | 2025-06-24 | Firefox could have incorrectly parsed a URL and rewritten it to the youtube.com domain when parsing the URL specified in an `embed` tag. This could have bypas… |
CVE-2025-6428 | Medium | 4.3 | 2025-06-24 | When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing… |
CVE-2025-6427 | Critical | 9.1 | 2025-06-24 | An attacker was able to bypass the `connect-src` directive of a Content Security Policy by manipulating subdocuments. This would have also hidden the connectio… |
CVE-2025-6426 | High | 8.8 | 2025-06-24 | The executable file warning did not warn users before opening files with the `terminal` extension. *This bug only affects Firefox for macOS. Other versions of… |
CVE-2025-6425 | Medium | 4.3 | 2025-06-24 | An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between cont… |
CVE-2025-6424 | Critical | 9.8 | 2025-06-24 | A use-after-free in FontFaceSet resulted in a potentially exploitable crash. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.1… |
CVE-2025-39205 | Medium | 6.5 | 2025-06-24 | A vulnerability exists in the IEC 61850 in MicroSCADA X SYS600 product. The certificate validation of the TLS protocol allows remote Man-in-the-Middle attack d… |
CVE-2025-39204 | Medium | 6.5 | 2025-06-24 | A vulnerability exists in the Web interface of the MicroSCADA X SYS600 product. The filtering query in the Web interface can be malformed, so returning data ca… |
CVE-2025-39203 | Medium | 6.5 | 2025-06-24 | A vulnerability exists in the IEC 61850 of the MicroSCADA X SYS600 product. An IEC 61850-8 crafted message content from IED or remote system can cause a denial… |
CVE-2025-39202 | High | 7.3 | 2025-06-24 | A vulnerability exists in in the Monitor Pro interface of the MicroSCADA X SYS600 product. An authenticated user with low privileges can see and overwrite file… |
CVE-2025-39201 | Medium | 6.1 | 2025-06-24 | A vulnerability exists in MicroSCADA X SYS600 product. If exploited this could allow a local unauthenticated attacker to tamper a system file, making denial of… |
CVE-2025-2403 | High | 7.5 | 2025-06-24 | A denial-of-service vulnerability due to improper prioritization of network traffic over protection mechanism exists in Relion 670/650 and SAM600-IO series dev… |
CVE-2025-1718 | Medium | 6.5 | 2025-06-24 | An authenticated user with file access privilege via FTP access can cause the Relion 670/650 and SAM600-IO series device to reboot due to improper disk space m… |
CVE-2025-6206 | High | 7.5 | 2025-06-24 | The Aiomatic - Automatic AI Content Writer & Editor, GPT-3 & GPT-4, ChatGPT ChatBot & AI Toolkit plugin for WordPress is vulnerable to arbitrary file uploads d… |
CVE-2025-3092 | High | 7.5 | 2025-06-24 | An unauthenticated remote attacker can enumerate valid user names from an unprotected endpoint. |