2025 CVEs (page 280)
Page 280 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-38029 | Medium | 5.5 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: kasan: avoid sleepable page allocation from atomic context apply_to_pte_range() enters th… |
CVE-2025-38028 | High | 7.8 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: NFS/localio: Fix a race in nfs_local_open_fh() Once the clp->cl_uuid.lock has been droppe… |
CVE-2025-38027 | High | 7.1 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: regulator: max20086: fix invalid memory access max20086_parse_regulators_dt() calls of_re… |
CVE-2025-38025 | Medium | 5.5 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad7606: check for NULL before calling sw_mode_config() Check that the sw_mode_c… |
CVE-2025-38024 | High | 7.8 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug Call Trace: <TASK> __du… |
CVE-2025-38023 | Medium | 5.5 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: nfs: handle failure of nfs_get_lock_context in unlock path When memory is insufficient, t… |
CVE-2025-38022 | High | 7.8 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem Call Trace… |
CVE-2025-38021 | Medium | 5.5 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix null check of pipe_ctx->plane_state for update_dchubp_dpp Similar to… |
CVE-2025-38020 | Medium | 5.5 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Disable MACsec offload for uplink representor profile MACsec offload is not su… |
CVE-2025-38019 | High | 7.8 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrum_router: Fix use-after-free when deleting GRE net devices The driver only… |
CVE-2025-38018 | High | 7.5 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: net/tls: fix kernel panic when alloc_page failed We cannot set frag_list to NULL pointer… |
CVE-2025-38017 | Medium | 5.5 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: fs/eventpoll: fix endless busy loop after timeout has expired After commit 0a65bc27bd64 (… |
CVE-2025-38016 | High | 8.8 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: HID: bpf: abort dispatch if device destroyed The current HID bpf implementation assumes n… |
CVE-2025-38015 | Medium | 5.5 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc Memory allocated fo… |
CVE-2025-38014 | Medium | 5.5 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Refactor remove call with idxd_cleanup() helper The idxd_cleanup() helpe… |
CVE-2025-38013 | High | 7.8 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request Make sure th… |
CVE-2025-38012 | High | 7.8 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator BPF programs may call… |
CVE-2025-38011 | Medium | 5.5 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: csa unmap use uninterruptible lock After process exit to unmap csa and free G… |
CVE-2025-38010 | Medium | 5.5 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: phy: tegra: xusb: Use a bitmask for UTMI pad power state tracking The current implementat… |
CVE-2025-38009 | Medium | 5.5 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: disable napi on driver removal A warning on driver removal started occurring… |
CVE-2025-38008 | Medium | 4.7 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: fix race condition in unaccepted memory handling The page allocator tracks… |
CVE-2025-38007 | Medium | 5.5 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: HID: uclogic: Add NULL check in uclogic_input_configured() devm_kasprintf() returns NULL… |
CVE-2025-38006 | Medium | 5.5 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: net: mctp: Don't access ifa_index when missing In mctp_dump_addrinfo, ifa_index can be us… |
CVE-2025-38005 | High | 7.8 | 2025-06-18 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma: Add missing locking Recent kernels complain about a missing lock… |
CVE-2025-23999 | Medium | 4.3 | 2025-06-18 | Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breez… |
CVE-2025-1088 | Low | 2.7 | 2025-06-18 | In Grafana, an excessively long dashboard title or panel name will cause Chromium browsers to become unresponsive due to Improper Input Validation vulnerabilit… |
CVE-2025-5981 | Medium | 6.5 | 2025-06-18 | Arbitrary file write as the OSV-SCALIBR user on the host system via a path traversal vulnerability when using OSV-SCALIBR's unpack() function for container ima… |
CVE-2025-1562 | Critical | 9.8 | 2025-06-18 | The Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin for WordPress is vulnerable to unauthorized arb… |
CVE-2025-4955 | Medium | 4.7 | 2025-06-18 | The tarteaucitron.io WordPress plugin before 1.9.5 uses query parameters from YouTube oEmbed URLs without sanitizing these parameters correctly, which could al… |
CVE-2025-51381 | Critical | 9.8 | 2025-06-18 | An authentication bypass vulnerability exists in KCM3100 Ver1.4.2 and earlier. If this vulnerability is exploited, an attacker may bypass the authentication of… |
CVE-2025-50202 | High | 7.5 | 2025-06-18 | Lychee is a free photo-management tool. In versions starting from 6.6.6 to before 6.6.10, an attacker can leak local files including environment variables, ngi… |
CVE-2025-4413 | High | 8.8 | 2025-06-18 | The Pixabay Images plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the pixabay_upload function in all versi… |
CVE-2025-23252 | Medium | 4.5 | 2025-06-18 | The NVIDIA NVDebug tool contains a vulnerability that may allow an actor to gain access to restricted components. A successful exploit of this vulnerability ma… |
CVE-2025-49149 | Medium | 6.1 | 2025-06-17 | Dify is an open-source LLM app development platform. In version 1.2.0, there is insufficient filtering of user input by web applications. Attackers can use web… |
CVE-2025-49825 | Critical | 9.8 | 2025-06-17 | Teleport provides connectivity, authentication, access controls and audit for infrastructure. Community Edition versions before and including 17.5.1 are vulner… |
CVE-2025-49593 | Medium | 6.8 | 2025-06-17 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and… |
CVE-2025-49843 | | 2025-06-17 | conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.4… | |
CVE-2025-49824 | | 2025-06-17 | conda-smithy is a tool for combining a conda recipe with configurations to build using freely hosted CI services into a single repository. Prior to version 3.4… | |
CVE-2025-49385 | High | 7.8 | 2025-06-17 | Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentio… |
CVE-2025-49384 | High | 7.8 | 2025-06-17 | Trend Micro Security 17.8 (Consumer) is vulnerable to a link following local privilege escalation vulnerability that could allow a local attacker to unintentio… |
CVE-2025-49218 | High | 7.7 | 2025-06-17 | A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installa… |
CVE-2025-49217 | Critical | 9.8 | 2025-06-17 | An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected… |
CVE-2025-49216 | Critical | 9.8 | 2025-06-17 | An authentication bypass vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to access key methods as an admin user and m… |
CVE-2025-49215 | High | 8.8 | 2025-06-17 | A post-auth SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installa… |
CVE-2025-49214 | High | 8.8 | 2025-06-17 | An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a post-authentication remote code execution on affected… |
CVE-2025-49213 | Critical | 9.8 | 2025-06-17 | An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected… |
CVE-2025-49212 | Critical | 9.8 | 2025-06-17 | An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected… |
CVE-2025-49211 | High | 7.7 | 2025-06-17 | A SQL injection vulnerability in the Trend Micro Endpoint Encryption PolicyServer could allow an attacker to escalate privileges on affected installations. … |
CVE-2025-48443 | Medium | 6.7 | 2025-06-17 | Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Local Privilege Escalation Vulnerability that could allo… |
CVE-2025-41413 | High | 7.8 | 2025-06-17 | Fuji Electric Smart Editor is vulnerable to an out-of-bounds write, which may allow an attacker to execute arbitrary code. |
CVE-2025-41388 | High | 7.8 | 2025-06-17 | Fuji Electric Smart Editor is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code. |
CVE-2025-32412 | High | 7.8 | 2025-06-17 | Fuji Electric Smart Editor is vulnerable to an out-of-bounds read, which may allow an attacker to execute arbitrary code. |
CVE-2025-30642 | Medium | 5.5 | 2025-06-17 | A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to create a denial of service (DoS) situation on affected… |
CVE-2025-30641 | High | 7.8 | 2025-06-17 | A link following vulnerability in the anti-malware solution portion of Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privilege… |
CVE-2025-30640 | High | 7.8 | 2025-06-17 | A link following vulnerability in Trend Micro Deep Security 20.0 agents could allow a local attacker to escalate privileges on affected installations. Pleas… |
CVE-2025-5141 | Medium | 5.5 | 2025-06-17 | A binary in the BoKS Server Agent component of Fortra's Core Privileged Access Manager (BoKS) on versions 7.2.0 (up to 7.2.0.17), 8.1.0 (up to 8.1.0.22), 8.1.1… |
CVE-2025-49847 | High | 8.8 | 2025-06-17 | llama.cpp is an inference of several LLM models in C/C++. Prior to version b5662, an attacker‐supplied GGUF model vocabulary can trigger a buffer overflow in l… |
CVE-2025-45526 | Low | 2.9 | 2025-06-17 | A denial of service (DoS) vulnerability has been identified in the JavaScript library microlight version 0.0.7. This library, used for syntax highlighting, doe… |
CVE-2025-45525 | Low | 2.9 | 2025-06-17 | A NULL pointer dereference vulnerability has been identified in the JavaScript library microlight version 0.0.7, a lightweight syntax highlighting library. Whe… |
CVE-2025-30680 | High | 7.1 | 2025-06-17 | A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (SaaS) could allow an attacker to manipulate certain parameters leading to infor… |
CVE-2025-30679 | Medium | 6.5 | 2025-06-17 | A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modOSCE component could allow an attacker to manipulate certain par… |
CVE-2025-30678 | Medium | 6.5 | 2025-06-17 | A Server-side Request Forgery (SSRF) vulnerability in Trend Micro Apex Central (on-premise) modTMSM component could allow an attacker to manipulate certain par… |
CVE-2025-49850 | | 2025-06-17 | A Heap-based Buffer Overflow vulnerability exists within the parsing of PRJ files. The issues result from the lack of proper validation of user-supplied data… | |
CVE-2025-49849 | | 2025-06-17 | An Out-of-bounds Read vulnerability exists within the parsing of PRJ files. The issues result from the lack of proper validation of user-supplied data, which c… | |
CVE-2025-49848 | High | 7.8 | 2025-06-17 | An out-of-bounds write vulnerability exists within the parsing of PRJ files. The issues result from the lack of proper validation of user-supplied data, which… |
CVE-2025-49487 | Medium | 6.8 | 2025-06-17 | An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services (WFBSS) agent could have allowed an attacker with physical a… |
CVE-2025-49158 | Medium | 6.7 | 2025-06-17 | An uncontrolled search path vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalation privileges on affected installa… |
CVE-2025-49157 | High | 7.8 | 2025-06-17 | A link following vulnerability in the Trend Micro Apex One Damage Cleanup Engine could allow a local attacker to escalation privileges on affected installation… |
CVE-2025-49156 | High | 7.0 | 2025-06-17 | A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalation privileges on affected installations. Plea… |
CVE-2025-49155 | High | 8.8 | 2025-06-17 | An uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject malicious code leading to a… |
CVE-2025-49154 | High | 8.7 | 2025-06-17 | An insecure access control vulnerability in Trend Micro Apex One and Trend Micro Worry-Free Business Security could allow a local attacker to overwrite key mem… |
CVE-2025-34511 | High | 8.8 | 2025-06-17 | Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricte… |
CVE-2025-34510 | High | 8.8 | 2025-06-17 | Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip S… |
CVE-2025-34509 | High | 7.5 | 2025-06-17 | Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. 011974 PRE, all versions of 10.2, 10.3 to 10.3.3 rev. 011967 PRE, an… |
CVE-2025-49220 | Critical | 9.8 | 2025-06-17 | An insecure deserialization operation in Trend Micro Apex Central below version 8.0.7007 could lead to a pre-authentication remote code execution on affected i… |
CVE-2025-49219 | Critical | 9.8 | 2025-06-17 | An insecure deserialization operation in Trend Micro Apex Central below versions 8.0.7007 could lead to a pre-authentication remote code execution on affected… |
CVE-2025-47867 | High | 7.5 | 2025-06-17 | A Local File Inclusion vulnerability in a Trend Micro Apex Central widget in versions below 8.0.6955 could allow an attacker to include arbitrary files to exec… |
CVE-2025-47866 | Medium | 4.3 | 2025-06-17 | An unrestricted file upload vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to upload arbitrary files on affe… |
CVE-2025-47865 | High | 7.5 | 2025-06-17 | A Local File Inclusion vulnerability in a Trend Micro Apex Central widget below version 8.0.6955 could allow an attacker to gain remote code execution on affec… |
CVE-2025-33122 | High | 7.5 | 2025-06-17 | IBM i 7.2, 7.3, 7.4, 7.5, and 7.6 could allow a user to gain elevated privileges due to an unqualified library call in IBM Advanced Job Scheduler for i. A mali… |
CVE-2025-45880 | Medium | 6.1 | 2025-06-17 | A cross-site scripting (XSS) vulnerability in the data resource management function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in t… |
CVE-2025-45878 | Medium | 6.1 | 2025-06-17 | A cross-site scripting (XSS) vulnerability in the report manager function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in the context… |
CVE-2025-45879 | Medium | 6.1 | 2025-06-17 | A cross-site scripting (XSS) vulnerability in the e-mail manager function of Miliaris Amigdala v2.2.6 allows attackers to execute arbitrary HTML in the context… |
CVE-2025-6199 | Low | 3.3 | 2025-06-17 | A flaw was found in the GIF parser of GdkPixbuf’s LZW decoder. When an invalid symbol is encountered during decompression, the decoder sets the reported output… |
CVE-2025-6196 | Medium | 5.5 | 2025-06-17 | A flaw was found in libgepub, a library used to read EPUB files. The software mishandles file size calculations when opening specially crafted EPUB files, lead… |
CVE-2025-4754 | | 2025-06-17 | Insufficient Session Expiration vulnerability in ash-project ash_authentication_phoenix allows Session Hijacking. This vulnerability is associated with program… | |
CVE-2025-49882 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Imran Tauqeer CubeWP cubewp-framework allows DOM-Based XS… |
CVE-2025-49881 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks responsive-block-editor-add… |
CVE-2025-49880 | Medium | 4.3 | 2025-06-17 | Missing Authorization vulnerability in Imran Tauqeer CubeWP Forms cubewp-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2025-49879 | High | 8.6 | 2025-06-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in themezaa Litho litho allows Path Traversal.This issue affects L… |
CVE-2025-49878 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Greg Winiarski WPAdverts wpadverts allows DOM-Based XSS.T… |
CVE-2025-49877 | Medium | 4.9 | 2025-06-17 | Server-Side Request Forgery (SSRF) vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities allows Server Side Request Forgery… |
CVE-2025-49875 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic Content If-So Dynamic Content Personalizati… |
CVE-2025-49874 | Medium | 4.3 | 2025-06-17 | Missing Authorization vulnerability in tychesoftwares Arconix FAQ arconix-faq allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-49872 | Medium | 5.3 | 2025-06-17 | Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects myCred: from… |
CVE-2025-49871 | Medium | 5.9 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noptin Newsletter Team Noptin newsletter-optin-box allows… |
CVE-2025-49868 | Medium | 4.7 | 2025-06-17 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Aman FunnelKit Automations wp-marketing-automations allows Phishing.This issue affects Fun… |
CVE-2025-49865 | Medium | 4.3 | 2025-06-17 | Cross-Site Request Forgery (CSRF) vulnerability in Helmut Wandl Advanced Settings advanced-settings allows Cross Site Request Forgery.This issue affects Advanc… |
CVE-2025-49864 | Medium | 5.3 | 2025-06-17 | Missing Authorization vulnerability in AFS Analytics AFS Analytics addfreestats allows Accessing Functionality Not Properly Constrained by ACLs.This issue affe… |
CVE-2025-49863 | Medium | 6.5 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CodeUs Advanced Sermons advanced-sermons allows Stored… |