2025 CVEs (page 290)
Page 290 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-43590 | High | 7.8 | 2025-06-10 | InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in th… |
CVE-2025-43589 | High | 7.8 | 2025-06-10 | InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-43558 | High | 7.8 | 2025-06-10 | InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in th… |
CVE-2025-33112 | High | 8.4 | 2025-06-10 | IBM AIX 7.3 and IBM VIOS 4.1.1 Perl implementation could allow a non-privileged local user to exploit a vulnerability to execute arbitrary code due to improper… |
CVE-2025-33075 | High | 7.8 | 2025-06-10 | Improper link resolution before file access ('link following') in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2025-33073 | High | 8.8 | 2025-06-10 | Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network. |
CVE-2025-33071 | High | 8.1 | 2025-06-10 | Use after free in Windows KDC Proxy Service (KPSSVC) allows an unauthorized attacker to execute code over a network. |
CVE-2025-33070 | High | 8.1 | 2025-06-10 | Use of uninitialized resource in Windows Netlogon allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-33069 | Medium | 5.1 | 2025-06-10 | Improper verification of cryptographic signature in App Control for Business (WDAC) allows an unauthorized attacker to bypass a security feature locally. |
CVE-2025-33068 | High | 7.5 | 2025-06-10 | Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-33067 | High | 8.4 | 2025-06-10 | Improper privilege management in Windows Kernel allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-33066 | High | 8.8 | 2025-06-10 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
CVE-2025-33065 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-33064 | High | 8.8 | 2025-06-10 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network. |
CVE-2025-33063 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-33062 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-33061 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-33060 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-33059 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-33058 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-33057 | Medium | 6.5 | 2025-06-10 | Null pointer dereference in Windows Local Security Authority (LSA) allows an authorized attacker to deny service over a network. |
CVE-2025-33056 | High | 7.5 | 2025-06-10 | Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an unauthorized attacker to deny service over a network. |
CVE-2025-33055 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-33053 | High | 8.8 | 2025-06-10 | External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network. |
CVE-2025-33052 | Medium | 5.5 | 2025-06-10 | Use of uninitialized resource in Windows DWM Core Library allows an authorized attacker to disclose information locally. |
CVE-2025-33050 | High | 7.5 | 2025-06-10 | Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
CVE-2025-32725 | High | 7.5 | 2025-06-10 | Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network. |
CVE-2025-32724 | High | 7.5 | 2025-06-10 | Uncontrolled resource consumption in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network. |
CVE-2025-32722 | Medium | 5.5 | 2025-06-10 | Improper access control in Windows Storage Port Driver allows an authorized attacker to disclose information locally. |
CVE-2025-32721 | High | 7.3 | 2025-06-10 | Improper link resolution before file access ('link following') in Windows Recovery Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-32720 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-32719 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-32718 | High | 7.8 | 2025-06-10 | Integer overflow or wraparound in Windows SMB allows an authorized attacker to elevate privileges locally. |
CVE-2025-32716 | High | 7.8 | 2025-06-10 | Out-of-bounds read in Windows Media allows an authorized attacker to elevate privileges locally. |
CVE-2025-32715 | Medium | 6.5 | 2025-06-10 | Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network. |
CVE-2025-32714 | High | 7.8 | 2025-06-10 | Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2025-32713 | High | 7.8 | 2025-06-10 | Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-32712 | High | 7.8 | 2025-06-10 | Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. |
CVE-2025-32710 | High | 8.1 | 2025-06-10 | Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network. |
CVE-2025-31104 | High | 7.2 | 2025-06-10 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiADC 7.6.0 through 7.6.1, FortiADC 7… |
CVE-2025-30321 | Medium | 5.5 | 2025-06-10 | InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by a NULL Pointer Dereference vulnerability that could lead to application denial-of-servic… |
CVE-2025-30317 | High | 7.8 | 2025-06-10 | InDesign Desktop versions ID20.2, ID19.5.3 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution… |
CVE-2025-29828 | High | 8.1 | 2025-06-10 | Missing release of memory after effective lifetime in Windows Cryptographic Services allows an unauthorized attacker to execute code over a network. |
CVE-2025-25250 | Medium | 4.3 | 2025-06-10 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0, FortiOS 7.4.0 through 7.4.7, For… |
CVE-2025-24471 | Medium | 6.5 | 2025-06-10 | An Improper Certificate Validation vulnerability [CWE-295] in FortiOS version 7.6.1 and below, version 7.4.7 and below may allow an EAP verified remote user to… |
CVE-2025-24069 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-24068 | Medium | 5.5 | 2025-06-10 | Buffer over-read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-24065 | Medium | 5.5 | 2025-06-10 | Out-of-bounds read in Windows Storage Management Provider allows an authorized attacker to disclose information locally. |
CVE-2025-22256 | Medium | 6.3 | 2025-06-10 | A improper handling of insufficient permissions or privileges in Fortinet FortiPAM 1.4.0 through 1.4.1, 1.3.0, 1.2.0, 1.1.0 through 1.1.2, 1.0.0 through 1.0.3… |
CVE-2025-22254 | Medium | 6.6 | 2025-06-10 | An Improper Privilege Management vulnerability [CWE-269] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7.4.0 through 7.4.6, FortiOS 7.2.0 thro… |
CVE-2025-22251 | Low | 3.1 | 2025-06-10 | An improper restriction of communication channel to intended endpoints vulnerability [CWE-923] in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2 all versions, 7.0 all… |
CVE-2025-4678 | | 2025-06-10 | Improper Neutralization of Special Elements in the chromium_path variable may allow OS command injection. This issue affects Pandora ITSM 5.0.105. | |
CVE-2025-4653 | | 2025-06-10 | Improper Neutralization of Special Elements in the backup name field may allow OS command injection. This issue affects Pandora ITSM 5.0.105. | |
CVE-2025-49143 | Medium | 5.9 | 2025-06-10 | Nautobot is a Network Source of Truth and Network Automation Platform. Prior to v2.4.10 and v1.6.32 , files uploaded by users to Nautobot's MEDIA_ROOT director… |
CVE-2025-49142 | High | 7.1 | 2025-06-10 | Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affect… |
CVE-2025-48937 | Medium | 4.9 | 2025-06-10 | matrix-rust-sdk is an implementation of a Matrix client-server library in Rust. matrix-sdk-crypto since version 0.8.0 and up to 0.11.0 does not correctly valid… |
CVE-2025-48879 | Medium | 6.5 | 2025-06-10 | OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows any unauthenticated attacker to send a manipulated broken multipart/form-d… |
CVE-2025-48067 | Medium | 5.4 | 2025-06-10 | OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows a… |
CVE-2025-47110 | High | 8.4 | 2025-06-10 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that cou… |
CVE-2025-44044 | High | 7.5 | 2025-06-10 | Keyoti SearchUnit prior to 9.0.0. is vulnerable to XML External Entity (XXE). An attacker who can force a vulnerable SearchUnit host into parsing maliciously c… |
CVE-2025-44043 | Medium | 5.4 | 2025-06-10 | Keyoti SearchUnit prior to 9.0.0. is vulnerable to Server-Side Request Forgery (SSRF) in /Keyoti_SearchEngine_Web_Common/SearchService.svc/GetResults and /Keyo… |
CVE-2025-43586 | High | 8.1 | 2025-06-10 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result… |
CVE-2025-43585 | High | 8.2 | 2025-06-10 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Authorization vulnerability that could result… |
CVE-2025-40591 | High | 7.7 | 2025-06-10 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (Al… |
CVE-2025-40585 | Critical | 9.9 | 2025-06-10 | A vulnerability has been identified in Energy Services (All versions with G5DFR). Affected solutions using G5DFR contain default credentials. This could allow… |
CVE-2025-40569 | Medium | 4.8 | 2025-06-10 | A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XCH328 (6GK5328-4TS01-2EC2) (All versions < V3.2), SC… |
CVE-2025-40568 | Medium | 4.3 | 2025-06-10 | A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XCH328 (6GK5328-4TS01-2EC2) (All versions < V3.2), SC… |
CVE-2025-40567 | Medium | 6.5 | 2025-06-10 | A vulnerability has been identified in RUGGEDCOM RST2428P (6GK6242-6PA00) (All versions < V3.2), SCALANCE XCH328 (6GK5328-4TS01-2EC2) (All versions < V3.2), SC… |
CVE-2025-30220 | Critical | 9.9 | 2025-06-10 | GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema da… |
CVE-2025-27207 | Medium | 6.5 | 2025-06-10 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result… |
CVE-2025-27206 | Medium | 5.3 | 2025-06-10 | Adobe Commerce versions 2.4.8, 2.4.7-p5, 2.4.6-p10, 2.4.5-p12, 2.4.4-p13 and earlier are affected by an Improper Access Control vulnerability that could result… |
CVE-2025-5353 | High | 8.8 | 2025-06-10 | A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt stored SQL credentials. |
CVE-2025-5335 | High | 7.8 | 2025-06-10 | A maliciously crafted binary file when downloaded could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to an untrusted search path being utilized… |
CVE-2025-46612 | High | 7.2 | 2025-06-10 | The Panel Designer dashboard in Airleader Master and Easy before 6.36 allows remote attackers to execute arbitrary commands via a wizard/workspace.jsp unrestri… |
CVE-2025-37100 | High | 7.7 | 2025-06-10 | A vulnerability in the APIs of HPE Aruba Networking Private 5G Core could potentially expose sensitive information to unauthorized users. A successful exploit… |
CVE-2025-30145 | High | 7.5 | 2025-06-10 | GeoServer is an open source server that allows users to share and edit geospatial data. Malicious Jiffle scripts can be executed by GeoServer, either as a rend… |
CVE-2025-27505 | Medium | 5.3 | 2025-06-10 | GeoServer is an open source server that allows users to share and edit geospatial data. It is possible to bypass the default REST API security and access the i… |
CVE-2025-26395 | High | 7.1 | 2025-06-10 | SolarWinds Observability Self-Hosted was susceptible to a cross-site scripting (XSS) vulnerability due to an unsanitized field in the URL. The attack require… |
CVE-2025-26394 | Medium | 4.8 | 2025-06-10 | SolarWinds Observability Self-Hosted is susceptible to an open redirection vulnerability. The URL is not properly sanitized, and an attacker could manipulate… |
CVE-2025-22463 | High | 7.3 | 2025-06-10 | A hardcoded key in Ivanti Workspace Control before version 10.19.10.0 allows a local authenticated attacker to decrypt the stored environment password. |
CVE-2025-22455 | High | 8.8 | 2025-06-10 | A hardcoded key in Ivanti Workspace Control before version 10.19.0.0 allows a local authenticated attacker to decrypt stored SQL credentials. |
CVE-2025-49511 | High | 7.1 | 2025-06-10 | Cross-Site Request Forgery (CSRF) vulnerability in uxper Civi Framework civi-framework allows Cross Site Request Forgery.This issue affects Civi Framework: fro… |
CVE-2025-49510 | Medium | 4.3 | 2025-06-10 | Cross-Site Request Forgery (CSRF) vulnerability in WPFactory Min Max Step Quantity Limits Manager for WooCommerce product-quantity-for-woocommerce allows Cross… |
CVE-2025-49509 | Medium | 5.3 | 2025-06-10 | Missing Authorization vulnerability in Roland Beaussant Audio Editor & Recorder audio-editor-recorder allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-49507 | Critical | 9.8 | 2025-06-10 | Deserialization of Untrusted Data vulnerability in LoftOcean CozyStay cozystay allows Object Injection.This issue affects CozyStay: from n/a through < 1.7.1. |
CVE-2025-49455 | Critical | 9.3 | 2025-06-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ClickandPledge WordPress-WPJobBoard click-pledge-wpjobboa… |
CVE-2025-49454 | High | 8.1 | 2025-06-10 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LoftOcean TinySalt tinysalt allows PHP… |
CVE-2025-4774 | Medium | 6.4 | 2025-06-10 | The Premium Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-countdown attribute of Countdown widget in all… |
CVE-2025-4577 | Medium | 6.4 | 2025-06-10 | The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-color att… |
CVE-2025-43701 | High | 7.5 | 2025-06-10 | Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of Custom Settings data. This impacts OmniStudio: bef… |
CVE-2025-43700 | High | 7.5 | 2025-06-10 | Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows exposure of encrypted data. This impacts OmniStudio: before Sp… |
CVE-2025-43699 | Medium | 5.3 | 2025-06-10 | Client-Side Enforcement of Server-Side Security vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of required permission check. This impacts O… |
CVE-2025-43698 | Critical | 9.1 | 2025-06-10 | Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (FlexCards) allows bypass of field level security controls for Salesforce objects… |
CVE-2025-43697 | High | 7.5 | 2025-06-10 | Improper Preservation of Permissions vulnerability in Salesforce OmniStudio (DataMapper) allows exposure of encrypted data. This impacts OmniStudio: before Spr… |
CVE-2025-2918 | Medium | 6.4 | 2025-06-10 | The Ultimate Blocks – WordPress Blocks Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets in all versions up to, and… |
CVE-2025-41657 | Medium | 4.3 | 2025-06-10 | Due to an undocumented active bluetooth stack on products delivered within the period 01.01.2024 to 09.05.2025 fingerprinting is possible by an unauthenticated… |
CVE-2025-40662 | High | 7.5 | 2025-06-10 | Absolute path disclosure vulnerability in DM Corporative CMS. This vulnerability allows an attacker to view the contents of webroot/file, if navigating to a no… |
CVE-2025-40661 | High | 7.5 | 2025-06-10 | An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area… |
CVE-2025-40660 | High | 7.5 | 2025-06-10 | An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area… |
CVE-2025-40659 | High | 7.5 | 2025-06-10 | An Insecure Direct Object Reference (IDOR) vulnerability has been found in DM Corporative CMS. This vulnerability allows an attacker to access the private area… |