2025 CVEs (page 28)
Page 28 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-31990 | Medium | 6.8 | 2026-02-07 | Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service (DoS) attacks. An attacker could flood the syst… |
CVE-2025-68621 | High | 7.4 | 2026-02-06 | Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. Prior to 0.101.0… |
CVE-2025-15320 | Low | 3.3 | 2026-02-06 | Tanium addressed a denial of service vulnerability in Tanium Client. |
CVE-2025-69216 | Medium | 6.5 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an authenticated SQL injection vulnerability… |
CVE-2025-69214 | High | 8.8 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an SQL Injection vulnerability exists in the… |
CVE-2025-69212 | High | 8.8 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a critical OS Command Injection vulnerabilit… |
CVE-2025-70963 | High | 7.6 | 2026-02-06 | Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HT… |
CVE-2025-64175 | High | 8.8 | 2026-02-06 | Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, Gogs’ 2FA recovery code validation does not scope codes by user, enabling cross-ac… |
CVE-2025-64111 | Critical | 9.8 | 2026-02-06 | Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, due to the insufficient patch for CVE-2024-56731, it's still possible to update fi… |
CVE-2025-13523 | High | 7.7 | 2026-02-06 | Mattermost Confluence plugin version <1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Conflu… |
CVE-2025-13818 | Medium | 6.7 | 2026-02-06 | Local privilege escalation vulnerability via insecure temporary batch file execution in ESET Management Agent |
CVE-2025-10753 | Medium | 5.3 | 2026-02-06 | The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 6.26.14. This is… |
CVE-2025-15566 | High | 8.8 | 2026-02-06 | A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-proxy-set-headers` Ingress annotation can be used to inject config… |
CVE-2025-68458 | Low | 3.7 | 2026-02-05 | Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be by… |
CVE-2025-68157 | Low | 3.7 | 2026-02-05 | Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces… |
CVE-2025-32393 | Medium | 6.5 | 2026-02-05 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autog… |
CVE-2025-12131 | Medium | 6.5 | 2026-02-05 | A truncated 802.15.4 packet can lead to an assert, resulting in a denial of service. |
CVE-2025-15343 | Medium | 6.5 | 2026-02-05 | Tanium addressed an incorrect default permissions vulnerability in Enforce. |
CVE-2025-15342 | Medium | 4.3 | 2026-02-05 | Tanium addressed an improper access controls vulnerability in Reputation. |
CVE-2025-15341 | Medium | 6.5 | 2026-02-05 | Tanium addressed an incorrect default permissions vulnerability in Benchmark. |
CVE-2025-15340 | Medium | 6.5 | 2026-02-05 | Tanium addressed an incorrect default permissions vulnerability in Comply. |
CVE-2025-15339 | Medium | 6.5 | 2026-02-05 | Tanium addressed an incorrect default permissions vulnerability in Discover. |
CVE-2025-15338 | Medium | 6.5 | 2026-02-05 | Tanium addressed an incorrect default permissions vulnerability in Partner Integration. |
CVE-2025-15337 | Medium | 6.5 | 2026-02-05 | Tanium addressed an incorrect default permissions vulnerability in Patch. |
CVE-2025-15336 | Medium | 6.5 | 2026-02-05 | Tanium addressed an incorrect default permissions vulnerability in Performance. |
CVE-2025-15335 | Medium | 4.3 | 2026-02-05 | Tanium addressed an information disclosure vulnerability in Threat Response. |
CVE-2025-15334 | Medium | 4.3 | 2026-02-05 | Tanium addressed an information disclosure vulnerability in Threat Response. |
CVE-2025-15333 | Medium | 4.3 | 2026-02-05 | Tanium addressed an information disclosure vulnerability in Threat Response. |
CVE-2025-15332 | Medium | 4.9 | 2026-02-05 | Tanium addressed an information disclosure vulnerability in Threat Response. |
CVE-2025-15331 | Medium | 4.3 | 2026-02-05 | Tanium addressed an uncontrolled resource consumption vulnerability in Connect. |
CVE-2025-15330 | High | 8.8 | 2026-02-05 | Tanium addressed an improper input validation vulnerability in Deploy. |
CVE-2025-15329 | Medium | 4.9 | 2026-02-05 | Tanium addressed an information disclosure vulnerability in Threat Response. |
CVE-2025-15328 | Medium | 5.0 | 2026-02-05 | Tanium addressed an improper link resolution before file access vulnerability in Enforce. |
CVE-2025-15327 | Medium | 4.3 | 2026-02-05 | Tanium addressed an improper access controls vulnerability in Deploy. |
CVE-2025-15326 | Medium | 4.3 | 2026-02-05 | Tanium addressed an improper access controls vulnerability in Patch. |
CVE-2025-15325 | Medium | 6.3 | 2026-02-05 | Tanium addressed an improper input validation vulnerability in Discover. |
CVE-2025-15324 | Medium | 6.6 | 2026-02-05 | Tanium addressed a documentation issue in Engage. |
CVE-2025-15323 | Low | 3.7 | 2026-02-05 | Tanium addressed an improper certificate validation vulnerability in Tanium Appliance. |
CVE-2025-15321 | Low | 2.7 | 2026-02-05 | Tanium addressed an improper input validation vulnerability in Tanium Appliance. |
CVE-2025-15312 | Medium | 6.6 | 2026-02-05 | Tanium addressed an improper output sanitization vulnerability in Tanium Appliance. |
CVE-2025-15311 | High | 7.8 | 2026-02-05 | Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance. |
CVE-2025-15289 | Low | 3.1 | 2026-02-05 | Tanium addressed an improper access controls vulnerability in Interact. |
CVE-2025-70073 | High | 7.2 | 2026-02-05 | An issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via the template creation function |
CVE-2025-68121 | Critical | 10.0 | 2026-02-05 | During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed han… |
CVE-2025-58190 | Medium | 5.3 | 2026-02-05 | The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an a… |
CVE-2025-47911 | Medium | 5.3 | 2026-02-05 | The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if… |
CVE-2025-15557 | High | 8.8 | 2026-02-05 | An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept a… |
CVE-2025-15551 | Medium | 5.6 | 2026-02-05 | The response coming from TP-Link Archer MR200 v5.2, C20 v5 and v6, TL-WR850N v3, and TL-WR845N v4 for any request is getting executed by the JavaScript functio… |
CVE-2025-70792 | Medium | 6.1 | 2026-02-05 | Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19. An attacker can manipulate the "rel_id" parameter in a crafte… |
CVE-2025-70791 | Medium | 6.1 | 2026-02-05 | Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19. An attacker can manipulate the "orderDirection" parameter in… |
CVE-2025-69906 | High | 8.8 | 2026-02-05 | Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. The application relies on blacklist-based file extension valida… |
CVE-2025-69619 | Medium | 5.5 | 2026-02-05 | A path traversal in My Text Editor v1.6.2 allows attackers to cause a Denial of Service (DoS) via writing files to the internal storage. |
CVE-2025-68723 | Critical | 9.0 | 2026-02-05 | Axigen Mail Server before 10.5.57 contains multiple stored Cross-Site Scripting (XSS) vulnerabilities in the WebAdmin interface. Three instances exist: (1) the… |
CVE-2025-68643 | Medium | 5.4 | 2026-02-05 | Axigen Mail Server before 10.5.57 allows stored Cross-Site Scripting (XSS) in the handling of the timeFormat account preference parameter. Attackers can exploi… |
CVE-2025-68722 | High | 8.8 | 2026-02-05 | Axigen Mail Server before 10.5.57 and 10.6.x before 10.6.26 contains a Cross-Site Request Forgery (CSRF) vulnerability in the WebAdmin interface through improp… |
CVE-2025-68721 | High | 8.1 | 2026-02-05 | Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in the WebAdmin interface. A delegated admin account with zero permissions… |
CVE-2025-14150 | Medium | 6.5 | 2026-02-05 | IBM webMethods Integration (on prem) - Integration Server 10.15 through IS_10.15_Core_Fix2411.1 to IS_11.1_Core_Fix8 IBM webMethods Integration could disclose… |
CVE-2025-13491 | Medium | 5.1 | 2026-02-05 | IBM App Connect Enterprise Certified Container CD: 11.2.0 through 11.6.0, 12.1.0 through 12.19.0 and 12.0 LTS: 12.0.0 through 12.0.19 could allow an attacker t… |
CVE-2025-13379 | High | 8.6 | 2026-02-05 | IBM Aspera Console 3.4.0 through 3.4.8 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the att… |
CVE-2025-14079 | Medium | 5.3 | 2026-02-05 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.3.5… |
CVE-2025-13416 | Medium | 4.3 | 2026-02-05 | The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized user suspension due to a missing capability check on… |
CVE-2025-10258 | Medium | 6.3 | 2026-02-05 | Infinera DNA is vulnerable to a time-based SQL injection vulnerability due to insufficient input validation, which may result in leaking of sensitive informati… |
CVE-2025-15080 | | 2026-02-05 | Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric MELSEC iQ-R Series R08PCPU, R16PCPU, R32PCPU, and R120PCPU allows an un… | |
CVE-2025-61732 | High | 8.6 | 2026-02-05 | A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary. |
CVE-2025-10314 | High | 8.8 | 2026-02-05 | Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation FREQSHIP-mini for Windows versions 8.0.0 to 8.0.2 allows a local attacker to exe… |
CVE-2025-11730 | High | 7.2 | 2026-02-05 | A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V5.35 thro… |
CVE-2025-13192 | High | 8.2 | 2026-02-05 | The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to generic SQL Inject… |
CVE-2025-62616 | Critical | 9.8 | 2026-02-04 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autog… |
CVE-2025-62615 | Critical | 9.8 | 2026-02-04 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autog… |
CVE-2025-22873 | Low | 3.8 | 2026-02-04 | It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the par… |
CVE-2025-2134 | Low | 3.5 | 2026-02-04 | IBM Jazz Reporting Service could allow an authenticated user on the network to affect the system's performance using complicated queries due to insufficient re… |
CVE-2025-27550 | Low | 3.5 | 2026-02-04 | IBM Jazz Reporting Service could allow an authenticated user on the host network to obtain sensitive information about other projects that reside on the server. |
CVE-2025-1823 | Low | 3.5 | 2026-02-04 | IBM Jazz Reporting Service could allow an authenticated user on the host network to cause a denial of service using specially crafted SQL query that consumes e… |
CVE-2025-15555 | High | 7.3 | 2026-02-04 | A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function hss_ogs_diam_cx_mar_cb of the file src/hss/hss-cx-pa… |
CVE-2025-13375 | Critical | 9.8 | 2026-02-04 | IBM Common Cryptographic Architecture (CCA) 7.5.52 and 8.4.82 could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the… |
CVE-2025-71031 | High | 7.5 | 2026-02-04 | Water-Melon Melon commit 9df9292 and below is vulnerable to Denial of Service. The HTTP component doesn't have any maximum length. As a result, an excessive re… |
CVE-2025-68699 | Medium | 6.5 | 2026-02-04 | NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In version 0.24.6, NanoMQ has a protocol parsing / forwarding inconsistency when handling… |
CVE-2025-69215 | High | 8.8 | 2026-02-04 | OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior, there is a SQL Injection vulnerability… |
CVE-2025-69213 | High | 8.8 | 2026-02-04 | OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior, a SQL Injection vulnerability exists i… |
CVE-2025-64712 | Critical | 9.8 | 2026-02-04 | The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many mo… |
CVE-2025-71199 | | 2026-02-04 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver at91_adc_i… | |
CVE-2025-71198 | | 2026-02-04 | In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection The st_lsm6ds… | |
CVE-2025-71197 | | 2026-02-04 | In the Linux kernel, the following vulnerability has been resolved: w1: therm: Fix off-by-one buffer overflow in alarms_store The sysfs buffer passed to alar… | |
CVE-2025-71196 | | 2026-02-04 | In the Linux kernel, the following vulnerability has been resolved: phy: stm32-usphyc: Fix off by one in probe() The "index" variable is used as an index int… | |
CVE-2025-71195 | | 2026-02-04 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinx: xdma: Fix regmap max_register The max_register field is assigned the s… | |
CVE-2025-71194 | | 2026-02-04 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type When wait_cur… | |
CVE-2025-71193 | | 2026-02-04 | In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qusb2: Fix NULL pointer dereference on early suspend Enabling runtime PM before… | |
CVE-2025-61917 | High | 7.7 | 2026-02-04 | n8n is an open source workflow automation platform. From version 1.65.0 to before 1.114.3, the use of Buffer.allocUnsafe() and Buffer.allocUnsafeSlow() in the… |
CVE-2025-71192 | High | 7.0 | 2026-02-04 | In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97: fix a double free in snd_ac97_controller_register() If ac97_add_adapter() fai… |
CVE-2025-70545 | Medium | 6.1 | 2026-02-04 | A stored cross-site scripting (XSS) vulnerability exists in the web management interface of the PPC (Belden) ONT 2K05X router running firmware v1.1.9_206L. The… |
CVE-2025-70997 | Medium | 6.5 | 2026-02-04 | A vulnerability has been discovered in eladmin v2.7 and before. This vulnerability allows for an arbitrary user password reset under any user permission level. |
CVE-2025-69618 | Medium | 6.5 | 2026-02-04 | An arbitrary file overwrite vulnerability in the file import process of Tarot, Astro & Healing v11.4.0 allows attackers to overwrite critical internal files, p… |
CVE-2025-5329 | Critical | 9.8 | 2026-02-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Martcode Software Inc. Delta Course Automation allows SQL… |
CVE-2025-15368 | High | 8.8 | 2026-02-04 | The SportsPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.7.26 via shortcodes 'template_name' attribut… |
CVE-2025-14740 | Medium | 6.7 | 2026-02-04 | Docker Desktop for Windows contains multiple incorrect permission assignment vulnerabilities in the installer's handling of the C:\ProgramData\DockerDesktop di… |
CVE-2025-59818 | Critical | 10.0 | 2026-02-04 | This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file name of an uploaded file. |
CVE-2025-41085 | | 2026-02-04 | Stored Cross-Site Scripting (XSS) vulnerability type in Apidog in the version 2.7.15, where SVG image uploads are not properly sanitized. This allows attacker… | |
CVE-2025-15508 | Medium | 5.3 | 2026-02-04 | The Magic Import Document Extractor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.4 via the ge… |
CVE-2025-15507 | Medium | 5.3 | 2026-02-04 | The Magic Import Document Extractor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_sync_… |
CVE-2025-15487 | Medium | 4.9 | 2026-02-04 | The Code Explorer plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.6 via the 'file' parameter. This makes it poss… |