2025 CVEs (page 29)
Page 29 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-68686 | Medium | 5.9 | 2026-02-10 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 thro… |
CVE-2025-64157 | Medium | 6.7 | 2026-02-10 | A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2.0 through 7.2.11… |
CVE-2025-62676 | High | 7.1 | 2026-02-10 | An Improper Link Resolution Before File Access ('Link Following') vulnerability [CWE-59] vulnerability in Fortinet FortiClientWindows 7.4.0 through 7.4.4, Fort… |
CVE-2025-62439 | Medium | 4.2 | 2026-02-10 | An Improper Verification of Source of a Communication Channel vulnerability [CWE-940] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 thro… |
CVE-2025-55018 | Medium | 5.8 | 2026-02-10 | An inconsistent interpretation of http requests ('http request smuggling') vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2 al… |
CVE-2025-52436 | High | 8.8 | 2026-02-10 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 thr… |
CVE-2025-15572 | Low | 3.3 | 2026-02-10 | A vulnerability has been found in wasm3 up to 0.5.0. The affected element is the function NewCodePage. The manipulation leads to memory leak. The attack must b… |
CVE-2025-11004 | | 2026-02-10 | The Simplicity Device Manager Tool has a Reflected XSS (Cross-site-scripting) vulnerability in several API endpoints. The attacker needs to be on the same netw… | |
CVE-2025-7636 | High | 8.8 | 2026-02-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ergosis Security Systems Computer Industry and Trade Inc… |
CVE-2025-7347 | High | 8.8 | 2026-02-10 | Authorization Bypass Through User-Controlled Key vulnerability in Dinibh Puzzle Software Solutions Dinibh Patrol Tracking System allows Exploitation of Trusted… |
CVE-2025-15571 | Low | 3.3 | 2026-02-10 | A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file stream.c. Such manipu… |
CVE-2025-6967 | High | 8.7 | 2026-02-10 | Execution After Redirect (EAR) vulnerability in Sarman Soft Software and Technology Services Industry and Trade Ltd. Co. CMS allows JSON Hijacking (aka JavaScr… |
CVE-2025-15570 | Medium | 5.3 | 2026-02-10 | A vulnerability was found in ckolivas lrzip up to 0.651. This impacts the function lzma_decompress_buf of the file stream.c. Performing a manipulation results… |
CVE-2025-15569 | High | 7.0 | 2026-02-10 | A flaw has been found in Artifex MuPDF up to 1.26.1 on Windows. The impacted element is the function get_system_dpi of the file platform/x11/win_main.c. This m… |
CVE-2025-11537 | Medium | 5.0 | 2026-02-10 | A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' pattern), sensitive hea… |
CVE-2025-40587 | High | 7.6 | 2026-02-10 | A vulnerability has been identified in Polarion V2404 (All versions < V2404.5), Polarion V2410 (All versions < V2410.2). The affected application allows arbitr… |
CVE-2025-14895 | Medium | 5.4 | 2026-02-10 | The PopupKit plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.0. This is due to the plugin not properly ver… |
CVE-2025-11242 | Critical | 9.8 | 2026-02-10 | Server-Side Request Forgery (SSRF) vulnerability in Teknolist Computer Systems Software Publishing Industry and Trade Inc. Okulistik allows Server Side Request… |
CVE-2025-12063 | Medium | 5.7 | 2026-02-10 | An insecure direct object reference allowed a non-admin user to modify or remove certain data objects without having the appropriate permissions. |
CVE-2025-13064 | Medium | 4.5 | 2026-02-10 | A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server. This at… |
CVE-2025-12757 | Medium | 4.6 | 2026-02-10 | An AXIS Camera Station Pro feature can be exploited in a way that allows a non-admin user to view information they are not permitted to. |
CVE-2025-11547 | High | 7.8 | 2026-02-10 | AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user. |
CVE-2025-11142 | High | 7.1 | 2026-02-10 | The VAPIX API mediaclip.cgi that did not have a sufficient input validation allowing for a possible remote code execution. This flaw can only be exploited afte… |
CVE-2025-15314 | Medium | 5.5 | 2026-02-10 | Tanium addressed an arbitrary file deletion vulnerability in end-user-cx. |
CVE-2025-15313 | Medium | 5.5 | 2026-02-10 | Tanium addressed an arbitrary file deletion vulnerability in Tanium EUSS. |
CVE-2025-15310 | High | 7.8 | 2026-02-10 | Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools. |
CVE-2025-15147 | Medium | 4.3 | 2026-02-10 | The WCFM Membership – WooCommerce Memberships for Multivendor Marketplace plugin for WordPress is vulnerable to Insecure Direct Object Reference in all version… |
CVE-2025-15319 | High | 7.8 | 2026-02-09 | Tanium addressed a local privilege escalation vulnerability in Patch Endpoint Tools. |
CVE-2025-15318 | Medium | 5.5 | 2026-02-09 | Tanium addressed an arbitrary file deletion vulnerability in End-User Notifications Endpoint Tools. |
CVE-2025-15317 | Medium | 6.5 | 2026-02-09 | Tanium addressed an uncontrolled resource consumption vulnerability in Tanium Server. |
CVE-2025-15316 | Medium | 6.7 | 2026-02-09 | Tanium addressed a local privilege escalation vulnerability in Tanium Server. |
CVE-2025-15315 | Medium | 6.7 | 2026-02-09 | Tanium addressed a local privilege escalation vulnerability in Tanium Module Server. |
CVE-2025-14778 | Medium | 5.4 | 2026-02-09 | A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService (UMA Protection API). When updating… |
CVE-2025-7432 | | 2026-02-09 | DPA countermeasures in Silicon Labs' Series 2 devices are not reseeded under certain conditions. This may allow an attacker to eventually extract secret keys… | |
CVE-2025-66630 | Critical | 9.4 | 2026-02-09 | Fiber is an Express inspired web framework written in Go. Before 2.52.11, on Go versions prior to 1.24, the underlying crypto/rand implementation can return an… |
CVE-2025-63354 | Medium | 4.8 | 2026-02-09 | Hitron HI3120 v7.2.4.5.2b1 allows stored XSS via the Parental Control option when creating a new filter. The device fails to properly handle inputs, allowing a… |
CVE-2025-59024 | Medium | 6.5 | 2026-02-09 | Crafted delegations or IP fragments can poison cached delegations in Recursor. |
CVE-2025-59023 | High | 8.2 | 2026-02-09 | Crafted delegations or IP fragments can poison cached delegations in Recursor. |
CVE-2025-14831 | Medium | 5.3 | 2026-02-09 | A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially… |
CVE-2025-10465 | High | 8.8 | 2026-02-09 | Unrestricted Upload of File with Dangerous Type vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Sensaway allows Upload a Web Shel… |
CVE-2025-10464 | Medium | 6.5 | 2026-02-09 | Insecure Storage of Sensitive Information vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Retrieve Embedded Sensi… |
CVE-2025-7708 | Medium | 6.8 | 2026-02-09 | Insertion of Sensitive Information Into Sent Data vulnerability in Atlas Educational Software Industry Ltd. Co. K12net allows Communication Channel Manipulatio… |
CVE-2025-6830 | Critical | 9.8 | 2026-02-09 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Xpoda Türkiye Information Technology Inc. Password Module… |
CVE-2025-10463 | High | 7.3 | 2026-02-09 | Improper Authentication vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Authentication Abuse. This issue affects… |
CVE-2025-7799 | High | 8.6 | 2026-02-09 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Zirve Information Technologies Inc. E-Taxpayer Acc… |
CVE-2025-66598 | High | 7.5 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product supports old SSL/TLS versions, potentially allowing an… |
CVE-2025-66597 | High | 7.5 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product supports weak cryptographic algorithms, potentially all… |
CVE-2025-66596 | Medium | 6.1 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly validate request headers. When an att… |
CVE-2025-66595 | Medium | 5.4 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product is vulnerable to Cross-Site Request Forgery (CSRF). Whe… |
CVE-2025-66594 | Medium | 5.3 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. Detailed messages are displayed on the error page. This information co… |
CVE-2025-66608 | High | 7.5 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly validate URLs. An attacker could send… |
CVE-2025-66607 | Medium | 5.3 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The response header contains an insecure setting. Users could be red… |
CVE-2025-66606 | Critical | 9.6 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not properly encode URLs. An attacker could tamper… |
CVE-2025-66605 | Medium | 5.3 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. Since there are input fields on this webpage with the autocomplete a… |
CVE-2025-66604 | Medium | 5.3 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The library version could be displayed on the web page. This informa… |
CVE-2025-66603 | Critical | 9.8 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The web server accepts the OPTIONS method. An attacker could potenti… |
CVE-2025-66602 | Critical | 9.8 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. The web server accepts access by IP address. When a worm that random… |
CVE-2025-66601 | Medium | 6.1 | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product does not specify MIME types. When an attacker performs… |
CVE-2025-66600 | | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. This product lacks HSTS (HTTP Strict Transport Security) configurati… | |
CVE-2025-66599 | | 2026-02-09 | A vulnerability has been found in FAST/TOOLS provided by Yokogawa Electric Corporation. Physical paths could be displayed on web pages. This information cou… | |
CVE-2025-15100 | High | 8.8 | 2026-02-08 | The JAY Login & Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.6.03. This is due to the plugin all… |
CVE-2025-15027 | Critical | 9.8 | 2026-02-08 | The JAY Login & Register plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.6.03. This is due to the plugin all… |
CVE-2025-15564 | Low | 3.3 | 2026-02-07 | A vulnerability has been found in Mapnik up to 4.2.0. This vulnerability affects the function mapnik::detail::mod<...>::operator of the file src/value.cpp. The… |
CVE-2025-15477 | Medium | 6.5 | 2026-02-07 | The Bucketlister plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode `category` and `id` attributes in all versions up to, and inclu… |
CVE-2025-15476 | Medium | 4.3 | 2026-02-07 | The The Bucketlister plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bucketlister_do_admin_aja… |
CVE-2025-15491 | Medium | 5.5 | 2026-02-07 | The Post Slides WordPress plugin through 1.0.1 does not validate some shortcode attributes before using them to generate paths passed to include function/s, al… |
CVE-2025-15267 | Medium | 6.4 | 2026-02-07 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_accordion_item shortcode in all versions up to… |
CVE-2025-13463 | Medium | 6.4 | 2026-02-07 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Grid component in all versions up to, and including, 5.5.3… |
CVE-2025-12803 | Medium | 6.4 | 2026-02-07 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin 'bt_bb_tabs' shortcode in all versions up to, and includ… |
CVE-2025-12159 | Medium | 6.4 | 2026-02-07 | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_raw_content shortcode in all versions up to, and… |
CVE-2025-31990 | Medium | 6.8 | 2026-02-07 | Rate limiting for certain API calls is not being enforced, making HCL Velocity vulnerable to Denial of Service (DoS) attacks. An attacker could flood the syst… |
CVE-2025-68621 | High | 7.4 | 2026-02-06 | Trilium Notes is an open-source, cross-platform hierarchical note taking application with focus on building large personal knowledge bases. Prior to 0.101.0… |
CVE-2025-15320 | Low | 3.3 | 2026-02-06 | Tanium addressed a denial of service vulnerability in Tanium Client. |
CVE-2025-69216 | Medium | 6.5 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an authenticated SQL injection vulnerability… |
CVE-2025-69214 | High | 8.8 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, an SQL Injection vulnerability exists in the… |
CVE-2025-69212 | High | 8.8 | 2026-02-06 | OpenSTAManager is an open source management software for technical assistance and invoicing. In 2.9.8 and earlier, a critical OS Command Injection vulnerabilit… |
CVE-2025-70963 | High | 7.6 | 2026-02-06 | Gophish <=0.12.1 is vulnerable to Incorrect Access Control. The administrative dashboard exposes each user’s long-lived API key directly inside the rendered HT… |
CVE-2025-64175 | High | 8.8 | 2026-02-06 | Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, Gogs’ 2FA recovery code validation does not scope codes by user, enabling cross-ac… |
CVE-2025-64111 | Critical | 9.8 | 2026-02-06 | Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, due to the insufficient patch for CVE-2024-56731, it's still possible to update fi… |
CVE-2025-13523 | High | 7.7 | 2026-02-06 | Mattermost Confluence plugin version <1.7.0 fails to properly escape user-controlled display names in HTML template rendering which allows authenticated Conflu… |
CVE-2025-13818 | Medium | 6.7 | 2026-02-06 | Local privilege escalation vulnerability via insecure temporary batch file execution in ESET Management Agent |
CVE-2025-10753 | Medium | 5.3 | 2026-02-06 | The OAuth Single Sign On – SSO (OAuth Client) plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 6.26.14. This is… |
CVE-2025-15566 | High | 8.8 | 2026-02-06 | A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-proxy-set-headers` Ingress annotation can be used to inject config… |
CVE-2025-68458 | Low | 3.7 | 2026-02-05 | Webpack is a module bundler. From version 5.49.0 to before 5.104.1, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) can be by… |
CVE-2025-68157 | Low | 3.7 | 2026-02-05 | Webpack is a module bundler. From version 5.49.0 to before 5.104.0, when experiments.buildHttp is enabled, webpack’s HTTP(S) resolver (HttpUriPlugin) enforces… |
CVE-2025-32393 | Medium | 6.5 | 2026-02-05 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autog… |
CVE-2025-12131 | Medium | 6.5 | 2026-02-05 | A truncated 802.15.4 packet can lead to an assert, resulting in a denial of service. |
CVE-2025-15343 | Medium | 6.5 | 2026-02-05 | Tanium addressed an incorrect default permissions vulnerability in Enforce. |
CVE-2025-15342 | Medium | 4.3 | 2026-02-05 | Tanium addressed an improper access controls vulnerability in Reputation. |
CVE-2025-15341 | Medium | 6.5 | 2026-02-05 | Tanium addressed an incorrect default permissions vulnerability in Benchmark. |
CVE-2025-15340 | Medium | 6.5 | 2026-02-05 | Tanium addressed an incorrect default permissions vulnerability in Comply. |
CVE-2025-15339 | Medium | 6.5 | 2026-02-05 | Tanium addressed an incorrect default permissions vulnerability in Discover. |
CVE-2025-15338 | Medium | 6.5 | 2026-02-05 | Tanium addressed an incorrect default permissions vulnerability in Partner Integration. |
CVE-2025-15337 | Medium | 6.5 | 2026-02-05 | Tanium addressed an incorrect default permissions vulnerability in Patch. |
CVE-2025-15336 | Medium | 6.5 | 2026-02-05 | Tanium addressed an incorrect default permissions vulnerability in Performance. |
CVE-2025-15335 | Medium | 4.3 | 2026-02-05 | Tanium addressed an information disclosure vulnerability in Threat Response. |
CVE-2025-15334 | Medium | 4.3 | 2026-02-05 | Tanium addressed an information disclosure vulnerability in Threat Response. |
CVE-2025-15333 | Medium | 4.3 | 2026-02-05 | Tanium addressed an information disclosure vulnerability in Threat Response. |
CVE-2025-15332 | Medium | 4.9 | 2026-02-05 | Tanium addressed an information disclosure vulnerability in Threat Response. |
CVE-2025-15331 | Medium | 4.3 | 2026-02-05 | Tanium addressed an uncontrolled resource consumption vulnerability in Connect. |