2025 CVEs (page 285)
Page 285 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-49596 | | 2025-06-13 | The MCP inspector is a developer tool for testing and debugging MCP servers. Versions of MCP Inspector below 0.14.1 are vulnerable to remote code execution due… | |
CVE-2025-49587 | High | 8.0 | 2025-06-13 | XWiki is an open-source wiki software platform. When a user without script right creates a document with an XWiki.Notifications.Code.NotificationDisplayerClass… |
CVE-2025-49586 | High | 8.8 | 2025-06-13 | XWiki is an open-source wiki software platform. Any XWiki user with edit right on at least one App Within Minutes application (the default for all users XWiki)… |
CVE-2025-49585 | High | 8.0 | 2025-06-13 | XWiki is a generic wiki platform. In versions before 15.10.16, 16.0.0-rc-1 through 16.4.6, and 16.5.0-rc-1 through 16.10.1, when an attacker without script or… |
CVE-2025-49584 | High | 7.5 | 2025-06-13 | XWiki is a generic wiki platform. In XWiki Platform versions 10.9 through 16.4.6, 16.5.0-rc-1 through 16.10.2, and 17.0.0-rc-1, the title of every single page… |
CVE-2025-49583 | Low | 3.5 | 2025-06-13 | XWiki is a generic wiki platform. When a user without script right creates a document with an `XWiki.Notifications.Code.NotificationEmailRendererClass` object… |
CVE-2025-49582 | High | 8.0 | 2025-06-13 | XWiki is a generic wiki platform. When editing content that contains "dangerous" macros like malicious script macros that were authored by a user with fewer ri… |
CVE-2025-6052 | Low | 3.7 | 2025-06-13 | A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a… |
CVE-2025-6035 | Medium | 6.1 | 2025-06-13 | A flaw was found in GIMP. An integer overflow vulnerability exists in the GIMP "Despeckle" plug-in. The issue occurs due to unchecked multiplication of image… |
CVE-2025-49581 | High | 8.8 | 2025-06-13 | XWiki is a generic wiki platform. Any user with edit right on a page (could be the user's profile) can execute code (Groovy, Python, Velocity) with programming… |
CVE-2025-49580 | High | 8.0 | 2025-06-13 | XWiki is a generic wiki platform. From 8.2 and 7.4.5 until 17.1.0-rc-1, 16.10.4, and 16.4.7, pages can gain script or programming rights when they contain a li… |
CVE-2025-48920 | High | 7.3 | 2025-06-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal etracker allows Cross-Site Scripting (XSS).This is… |
CVE-2025-48919 | Medium | 5.0 | 2025-06-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).Thi… |
CVE-2025-48918 | High | 8.8 | 2025-06-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Simple Klaro allows Cross-Site Scripting (XSS).Thi… |
CVE-2025-48917 | Medium | 5.0 | 2025-06-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal EU Cookie Compliance (GDPR Compliance) allows Cros… |
CVE-2025-48916 | Medium | 6.5 | 2025-06-13 | Missing Authorization vulnerability in Drupal Bookable Calendar allows Forceful Browsing.This issue affects Bookable Calendar: from 0.0.0 before 2.2.13. |
CVE-2025-48915 | High | 8.6 | 2025-06-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scrip… |
CVE-2025-48914 | High | 8.6 | 2025-06-13 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal COOKiES Consent Management allows Cross-Site Scrip… |
CVE-2025-6030 | | 2025-06-13 | Use of fixed learning codes, one code to lock the car and the other code to unlock it, in the Key Fob Transmitter in Cyclone Matrix TRF Smart Keyless Entry Sy… | |
CVE-2025-6029 | | 2025-06-13 | Use of fixed learning codes, one code to lock the car and the other code to unlock it, the Key Fob Transmitter in KIA-branded Aftermarket Generic Smart Keyles… | |
CVE-2025-36633 | High | 8.8 | 2025-06-13 | In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could arbitrarily delete local system files with SYSTE… |
CVE-2025-36631 | High | 8.4 | 2025-06-13 | In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log… |
CVE-2025-28389 | Critical | 9.8 | 2025-06-13 | Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack. |
CVE-2025-28388 | Critical | 9.8 | 2025-06-13 | OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account. |
CVE-2025-28386 | Critical | 9.8 | 2025-06-13 | A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading… |
CVE-2025-28384 | Critical | 9.1 | 2025-06-13 | An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal. |
CVE-2025-28382 | High | 7.5 | 2025-06-13 | An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal. |
CVE-2025-28381 | High | 7.5 | 2025-06-13 | A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers. |
CVE-2025-28380 | Medium | 6.1 | 2025-06-13 | A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted pay… |
CVE-2025-46096 | Medium | 6.1 | 2025-06-13 | Directory Traversal vulnerability in solon v.3.1.2 allows a remote attacker to conduct XSS attacks via the solon-faas-luffy component |
CVE-2025-46060 | Critical | 9.8 | 2025-06-13 | Buffer Overflow vulnerability in TOTOLINK N600R v4.3.0cu.7866_B2022506 allows a remote attacker to execute arbitrary code via the UPLOAD_FILENAME component |
CVE-2025-45988 | Critical | 9.8 | 2025-06-13 | Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL… |
CVE-2025-45987 | Critical | 9.8 | 2025-06-13 | Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL… |
CVE-2025-45986 | Critical | 9.8 | 2025-06-13 | Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL… |
CVE-2025-45985 | Critical | 9.8 | 2025-06-13 | Blink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450M_AE4 v4.0.0 and BL… |
CVE-2025-45984 | Critical | 9.8 | 2025-06-13 | Blink routers BL-WR9000 V2.4.9, BL-AC1900 V1.0.2, BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 V1.0.5, BL-LTE300 V1.2.3, BL-F1200_AT1 V1.0.0, BL-X26_AC8 V1.2.8, BLAC450M_A… |
CVE-2025-49468 | | 2025-06-13 | A SQL injection vulnerability in No Boss Calendar component before 5.0.7 for Joomla was discovered. The vulnerability allows remote authenticated users to exec… | |
CVE-2025-29902 | Critical | 10.0 | 2025-06-13 | Remote code execution that allows unauthorized users to execute arbitrary code on the server machine. |
CVE-2025-48825 | Low | 2.5 | 2025-06-13 | RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.7.0 contains an issue with use of less trusted source, which may allow an attacker who can conduct a man-i… |
CVE-2025-46783 | Critical | 9.8 | 2025-06-13 | Path traversal vulnerability exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0. If this vulnerability is exploited, arbitrary code may be ex… |
CVE-2025-36506 | Medium | 6.5 | 2025-06-13 | External control of file name or path issue exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0. If an attacker sends a specially crafted requ… |
CVE-2025-6012 | Medium | 5.5 | 2025-06-13 | The Auto Attachments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.8.5 due to in… |
CVE-2025-39240 | High | 7.2 | 2025-06-13 | Some Hikvision Wireless Access Point are vulnerable to authenticated remote command execution due to insufficient input validation. Attackers with valid creden… |
CVE-2025-5923 | Medium | 6.4 | 2025-06-13 | The Game Review Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘className’ parameter in all versions up to, and including, 4.8… |
CVE-2025-22242 | Medium | 5.6 | 2025-06-13 | Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pub_ret” method which is exposed to all minions. The un-… |
CVE-2025-22241 | Medium | 5.6 | 2025-06-13 | File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory… |
CVE-2025-22240 | Medium | 6.3 | 2025-06-13 | Arbitrary directory creation or file deletion. In the find_file method of the GitFS class, a path is created using os.path.join using unvalidated input from th… |
CVE-2025-22239 | High | 8.1 | 2025-06-13 | Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's e… |
CVE-2025-22238 | Medium | 4.2 | 2025-06-13 | Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to… |
CVE-2025-22237 | Medium | 6.7 | 2025-06-13 | An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary comma… |
CVE-2025-22236 | High | 8.1 | 2025-06-13 | Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007… |
CVE-2025-4229 | | 2025-06-13 | An information disclosure vulnerability in the SD-WAN feature of Palo Alto Networks PAN-OS® software enables an unauthorized user to view unencrypted data sent… | |
CVE-2025-4227 | Low | 3.5 | 2025-06-13 | An improper access control vulnerability in the Endpoint Traffic Policy Enforcement https://docs.paloaltonetworks.com/globalprotect/6-0/globalprotect-app-new-… |
CVE-2025-5815 | Medium | 5.3 | 2025-06-13 | The Traffic Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tfcm_maybe_set_bot_flags()… |
CVE-2025-5282 | High | 7.5 | 2025-06-13 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability… |
CVE-2025-5950 | Medium | 6.4 | 2025-06-13 | The IndieBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘kind’ parameter in all versions up to, and including, 0.13.2 due to… |
CVE-2025-5939 | Medium | 4.4 | 2025-06-13 | The Telegram for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.6.1 due to ins… |
CVE-2025-5938 | Medium | 5.3 | 2025-06-13 | The Digital Marketing and Agency Templates Addons for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and inc… |
CVE-2025-5930 | Medium | 4.3 | 2025-06-13 | The WP2HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.2. This is due to missing or incorrect n… |
CVE-2025-5928 | Medium | 4.3 | 2025-06-13 | The WP Sliding Login/Dashboard Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due… |
CVE-2025-5926 | Medium | 6.1 | 2025-06-13 | The Link Shield plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.4. This is due to missing or incorre… |
CVE-2025-5841 | Medium | 6.4 | 2025-06-13 | The ACF Onyx Poll plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘class’ parameter in all versions up to, and including, 1.1.9 due t… |
CVE-2025-5491 | High | 8.8 | 2025-06-13 | Acer ControlCenter contains Remote Code Execution vulnerability. The program exposes a Windows Named Pipe that uses a custom protocol to invoke internal functi… |
CVE-2025-5288 | Critical | 9.8 | 2025-06-13 | The REST API | Custom API Generator For Cross Platform And Import Export In WP plugin for WordPress is vulnerable to Privilege Escalation due to a missing capa… |
CVE-2025-5233 | Medium | 6.4 | 2025-06-13 | The Color Palette plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘hex’ parameter in all versions up to, and including, 4.3.2 due to… |
CVE-2025-5123 | Medium | 6.4 | 2025-06-13 | The Contact Us Page – Contact People plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘style’ parameter in all versions up to, and inc… |
CVE-2025-4586 | Medium | 6.4 | 2025-06-13 | The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmcalendarview' shortcode in all versions up to, and incl… |
CVE-2025-4585 | Medium | 6.4 | 2025-06-13 | The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmflat' shortcode in all versions up to, and including, 1… |
CVE-2025-4584 | Medium | 6.4 | 2025-06-13 | The IRM Newsroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'irmeventlist' shortcode in all versions up to, and includi… |
CVE-2025-47959 | High | 7.1 | 2025-06-13 | Improper neutralization of special elements used in a command ('command injection') in Visual Studio allows an authorized attacker to execute code over a netwo… |
CVE-2025-30399 | High | 7.5 | 2025-06-13 | Untrusted search path in .NET and Visual Studio allows an unauthorized attacker to execute code over a network. |
CVE-2025-4232 | High | 8.8 | 2025-06-13 | An improper neutralization of wildcards vulnerability in the log collection feature of Palo Alto Networks GlobalProtect™ app on macOS allows a non administrati… |
CVE-2025-4231 | High | 7.2 | 2025-06-13 | A command injection vulnerability in Palo Alto Networks PAN-OS® enables an authenticated administrative user to perform actions as the root user. The attacker… |
CVE-2025-4230 | | 2025-06-13 | A command injection vulnerability in Palo Alto Networks PAN-OS® software enables an authenticated administrator to bypass system restrictions and run arbitrary… | |
CVE-2025-4228 | | 2025-06-13 | An incorrect privilege assignment vulnerability in Palo Alto Networks Cortex® XDR Broker VM allows an authenticated administrative user to execute certain file… | |
CVE-2025-4233 | | 2025-06-12 | An insufficient implementation of cache vulnerability in Palo Alto Networks Prisma® Access Browser enables users to bypass certain data control policies. | |
CVE-2025-41234 | Medium | 6.5 | 2025-06-12 | Description In Spring Framework, versions 6.0.x as of 6.0.5, versions 6.1.x and 6.2.x, an application is vulnerable to a reflected file download (RFD) attack… |
CVE-2025-41233 | Medium | 6.8 | 2025-06-12 | Description: VMware AVI Load Balancer contains an authenticated blind SQL Injection vulnerability. VMware has evaluated the severity of the issue to be in the… |
CVE-2025-49589 | | 2025-06-12 | PCSX2 is a free and open-source PlayStation 2 (PS2) emulator. A stack-based buffer overflow exists in the Kprintf_HLE function of PCSX2 versions up to 2.3.414… | |
CVE-2025-44091 | Medium | 5.4 | 2025-06-12 | yangyouwang crud v1.0.0 is vulnerable to Cross Site Scripting (XSS) via the role management function. |
CVE-2025-27689 | High | 7.8 | 2025-06-12 | Dell iDRAC Tools, version(s) prior to 11.3.0.0, contain(s) an Improper Access Control vulnerability. A low privileged attacker with local access could potentia… |
CVE-2025-6031 | High | 7.5 | 2025-06-12 | Amazon Cloud Cam is a home security camera that was deprecated on December 2, 2022, is end of life, and is no longer actively supported. When a user powers o… |
CVE-2025-5485 | High | 8.6 | 2025-06-12 | User names used to access the web management interface are limited to the device identifier, which is a numerical identifier no more than 10 digits. A malici… |
CVE-2025-5484 | High | 8.3 | 2025-06-12 | A username and password are required to authenticate to the central SinoTrack device management interface. The username for all devices is an identifier prin… |
CVE-2025-4418 | Medium | 4.4 | 2025-06-12 | An improper validation of integrity check value vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could al… |
CVE-2025-4417 | Medium | 5.5 | 2025-06-12 | A cross-site scripting vulnerability exists in AVEVA PI Connector for CygNet Versions 1.6.14 and prior that, if exploited, could allow an administrator misc… |
CVE-2025-44019 | High | 7.1 | 2025-06-12 | AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down certain necessary P… |
CVE-2025-36539 | Medium | 6.5 | 2025-06-12 | AVEVA PI Data Archive products are vulnerable to an uncaught exception that, if exploited, could allow an authenticated user to shut down certain necessary P… |
CVE-2025-2745 | Medium | 6.5 | 2025-06-12 | A cross-site scripting vulnerability exists in AVEVA PI Web API version 2023 SP1 and prior that, if exploited, could allow an authenticated attacker (with pr… |
CVE-2025-49579 | Medium | 6.5 | 2025-06-12 | Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. All system messages in menu headings using the Menu.mustache template are in… |
CVE-2025-49578 | Medium | 6.5 | 2025-06-12 | Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various date messages returned by `Language::userDate` are inserted into raw… |
CVE-2025-49577 | Medium | 6.5 | 2025-06-12 | Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Various preferences messages are inserted into raw HTML, allowing anybody wh… |
CVE-2025-49576 | Medium | 6.5 | 2025-06-12 | Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The citizen-search-noresults-title and citizen-search-noresults-desc system… |
CVE-2025-49575 | Medium | 6.5 | 2025-06-12 | Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. Multiple system messages are inserted into the CommandPaletteFooter as raw H… |
CVE-2025-49081 | Medium | 4.9 | 2025-06-12 | There is an insufficient input validation vulnerability in the warehouse component of Absolute Secure Access prior to server version 13.55. Attackers with syst… |
CVE-2025-43866 | High | 7.5 | 2025-06-12 | vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the us… |
CVE-2025-43863 | Critical | 9.8 | 2025-06-12 | vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. If… |
CVE-2025-5982 | Low | 3.7 | 2025-06-12 | An issue has been discovered in GitLab EE affecting all versions from 12.0 before 17.10.8, 17.11 before 17.11.4, and 18.0 before 18.0.2. Under certain conditio… |
CVE-2025-49080 | High | 7.5 | 2025-06-12 | There is a memory management vulnerability in Absolute Secure Access server versions 9.0 to 13.54. Attackers with network access to the server can cause a Deni… |
CVE-2025-49467 | | 2025-06-12 | A SQL injection vulnerability in JEvents component before 3.6.88 and 3.6.82.1 for Joomla was discovered. The extension is vulnerable to SQL injection via publi… |