2025 CVEs (page 292)
Page 292 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-24493 | Medium | 5.5 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause information leak through race condition. |
CVE-2025-23235 | Low | 3.3 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through out-of-bounds read. |
CVE-2025-21082 | Low | 3.3 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause apps crash through type confusion. |
CVE-2025-20063 | Low | 3.3 | 2025-06-08 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause apps crash through type confusion. |
CVE-2025-38004 | High | 7.3 | 2025-06-08 | In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking for bcm_op runtime updates The CAN broadcast manager (CAN BCM) can… |
CVE-2025-38003 | High | 7.8 | 2025-06-08 | In the Linux kernel, the following vulnerability has been resolved: can: bcm: add missing rcu read protection for procfs content When the procfs content is g… |
CVE-2025-5840 | High | 7.3 | 2025-06-07 | A vulnerability, which was classified as critical, was found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file… |
CVE-2025-5839 | High | 8.8 | 2025-06-07 | A vulnerability, which was classified as critical, has been found in Tenda AC9 15.03.02.13. Affected by this issue is the function fromadvsetlanip of the file… |
CVE-2025-5838 | Medium | 6.3 | 2025-06-07 | A vulnerability classified as critical was found in PHPGurukul Employee Record Management System 1.3. Affected by this vulnerability is an unknown functionalit… |
CVE-2025-5837 | Medium | 6.3 | 2025-06-07 | A vulnerability classified as critical has been found in PHPGurukul Employee Record Management System 1.3. Affected is an unknown function of the file /admin/a… |
CVE-2025-5836 | Medium | 6.3 | 2025-06-07 | A vulnerability was found in Tenda AC9 15.03.02.13. It has been rated as critical. This issue affects the function formSetIptv of the file /goform/SetIPTVCfg o… |
CVE-2025-49619 | High | 8.5 | 2025-06-07 | Skyvern through 0.1.85 is vulnerable to server-side template injection (SSTI) in the Prompt field of workflow blocks such as the Navigation v2 Block. Improper… |
CVE-2025-5568 | Medium | 6.4 | 2025-06-07 | The WpEvently plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and including, 4.4.2 due to insu… |
CVE-2025-5528 | Medium | 6.1 | 2025-06-07 | The Social Sharing Plugin – Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the heateor_mastodon_share parameter in… |
CVE-2025-5303 | High | 7.2 | 2025-06-07 | The LTL Freight Quotes – Freightview Edition, LTL Freight Quotes – Daylight Edition and LTL Freight Quotes – Day & Ross Edition plugins for WordPress are vulne… |
CVE-2025-5399 | High | 7.5 | 2025-06-07 | Due to a mistake in libcurl's WebSocket code, a malicious server can send a particularly crafted packet which makes libcurl get trapped in an endless busy-loop… |
CVE-2025-5814 | Medium | 5.3 | 2025-06-07 | The Profiler – What Slowing Down Your WP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpsd_… |
CVE-2025-47601 | High | 8.8 | 2025-06-07 | Missing Authorization vulnerability in Christiaan Pieterse MaxiBlocks maxi-blocks allows Privilege Escalation.This issue affects MaxiBlocks: from n/a through <… |
CVE-2025-49128 | Medium | 4.0 | 2025-06-06 | Jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. Starting in version 2.0.0 and… |
CVE-2025-49127 | | 2025-06-06 | Kafbat UI is a web user interface for managing Apache Kafka clusters. An unsafe deserialization vulnerability in version 1.0.0 allows any unauthenticated user… | |
CVE-2025-5799 | High | 8.8 | 2025-06-06 | A vulnerability was found in Tenda AC8 16.03.34.09. It has been declared as critical. Affected by this vulnerability is the function fromSetWirelessRepeat of t… |
CVE-2025-5798 | High | 8.8 | 2025-06-06 | A vulnerability was found in Tenda AC8 16.03.34.09. It has been classified as critical. Affected is the function fromSetSysTime of the file /goform/SetSysTimeC… |
CVE-2025-5797 | Low | 3.5 | 2025-06-06 | A vulnerability was found in code-projects Laundry System 1.0 and classified as problematic. This issue affects some unknown processing of the file /data/inser… |
CVE-2025-5796 | Low | 3.5 | 2025-06-06 | A vulnerability has been found in code-projects Laundry System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /data/edi… |
CVE-2025-5795 | High | 8.8 | 2025-06-06 | A vulnerability, which was classified as critical, was found in Tenda AC5 1.0/15.03.06.47. This affects the function fromadvsetlanip of the file /goform/AdvSet… |
CVE-2025-5794 | High | 8.8 | 2025-06-06 | A vulnerability, which was classified as critical, has been found in Tenda AC5 15.03.06.47. Affected by this issue is the function formSetPPTPUserList of the f… |
CVE-2025-5481 | High | 7.8 | 2025-06-06 | Sante DICOM Viewer Pro DCM File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar… |
CVE-2025-5480 | High | 7.8 | 2025-06-06 | Action1 Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected… |
CVE-2025-5474 | High | 7.3 | 2025-06-06 | 2BrightSparks SyncBackFree Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affecte… |
CVE-2025-5473 | High | 8.8 | 2025-06-06 | GIMP ICO File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected in… |
CVE-2025-3485 | High | 8.8 | 2025-06-06 | Allegra extractFileFromZip Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on aff… |
CVE-2025-2766 | High | 8.8 | 2025-06-06 | 70mai A510 Use of Default Password Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affect… |
CVE-2025-5793 | High | 8.8 | 2025-06-06 | A vulnerability, which was classified as critical, was found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. Affected is an unknown function of the file /boafrm/fo… |
CVE-2025-5792 | High | 8.8 | 2025-06-06 | A vulnerability, which was classified as critical, has been found in TOTOLINK EX1200T 4.1.2cu.5232_B20210713. This issue affects some unknown processing of the… |
CVE-2025-5790 | High | 8.8 | 2025-06-06 | A vulnerability classified as critical was found in TOTOLINK X15 1.0.0-B20230714.1105. This vulnerability affects unknown code of the file /boafrm/formIpQoS of… |
CVE-2025-5789 | High | 8.8 | 2025-06-06 | A vulnerability classified as critical has been found in TOTOLINK X15 1.0.0-B20230714.1105. This affects an unknown part of the file /boafrm/formPortFw of the… |
CVE-2025-49011 | Low | 3.7 | 2025-06-06 | SpiceDB is an open source database for storing and querying fine-grained authorization data. Prior to version 1.44.2, on schemas involving arrows with caveats… |
CVE-2025-47950 | High | 7.5 | 2025-06-06 | CoreDNS is a DNS server that chains plugins. In versions prior to 1.12.2, a Denial of Service (DoS) vulnerability exists in the CoreDNS DNS-over-QUIC (DoQ) ser… |
CVE-2025-5788 | High | 8.8 | 2025-06-06 | A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been rated as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2025-5787 | High | 8.8 | 2025-06-06 | A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-5786 | High | 8.8 | 2025-06-06 | A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105. It has been classified as critical. Affected is an unknown function of the file /boafrm/formDMZ… |
CVE-2025-49599 | Medium | 4.1 | 2025-06-06 | Huawei EG8141A5 devices through V5R019C00S100, EG8145V5 devices through V5R019C00S100, and EG8145V5-V2 devices through V5R021C00S184 allow the Epuser account t… |
CVE-2025-5785 | High | 8.8 | 2025-06-06 | A vulnerability was found in TOTOLINK X15 1.0.0-B20230714.1105 and classified as critical. This issue affects some unknown processing of the file /boafrm/formW… |
CVE-2025-5784 | Medium | 6.3 | 2025-06-06 | A vulnerability has been found in PHPGurukul Employee Record Management System 1.3 and classified as critical. This vulnerability affects unknown code of the f… |
CVE-2025-5783 | Medium | 6.3 | 2025-06-06 | A vulnerability, which was classified as critical, was found in PHPGurukul Employee Record Management System 1.3. This affects an unknown part of the file /edi… |
CVE-2025-5751 | Medium | 6.8 | 2025-06-06 | WOLFBOX Level 2 EV Charger Management Card Hard-coded Credentials Authentication Bypass Vulnerability. This vulnerability allows physically present attackers t… |
CVE-2025-5750 | High | 8.8 | 2025-06-06 | WOLFBOX Level 2 EV Charger tuya_svc_devos_activate_result_parse Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows netwo… |
CVE-2025-5749 | High | 8.8 | 2025-06-06 | WOLFBOX Level 2 EV Charger BLE Encryption Keys Uninitialized Variable Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers… |
CVE-2025-5748 | High | 8.0 | 2025-06-06 | WOLFBOX Level 2 EV Charger LAN OTA Exposed Dangerous Method Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execut… |
CVE-2025-5747 | High | 8.0 | 2025-06-06 | WOLFBOX Level 2 EV Charger MCU Command Parsing Misinterpretation of Input Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attac… |
CVE-2025-33035 | Medium | 6.5 | 2025-06-06 | A path traversal vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vulnerability… |
CVE-2025-33031 | High | 8.8 | 2025-06-06 | An improper certificate validation vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit t… |
CVE-2025-30279 | High | 8.8 | 2025-06-06 | An improper certificate validation vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit… |
CVE-2025-29892 | High | 8.8 | 2025-06-06 | An SQL injection vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attackers who have gained user acc… |
CVE-2025-29885 | High | 8.8 | 2025-06-06 | An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who h… |
CVE-2025-29884 | High | 8.8 | 2025-06-06 | An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who h… |
CVE-2025-29883 | High | 8.8 | 2025-06-06 | An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who h… |
CVE-2025-29877 | High | 7.5 | 2025-06-06 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vuln… |
CVE-2025-29876 | High | 7.5 | 2025-06-06 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vuln… |
CVE-2025-29873 | High | 7.5 | 2025-06-06 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vuln… |
CVE-2025-29872 | High | 7.5 | 2025-06-06 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, t… |
CVE-2025-29871 | Medium | 5.5 | 2025-06-06 | An out-of-bounds read vulnerability has been reported to affect File Station 5. If a local attacker gains an administrator account, they can then exploit the… |
CVE-2025-22490 | High | 7.5 | 2025-06-06 | A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can then exploit the vuln… |
CVE-2025-22486 | High | 8.8 | 2025-06-06 | An improper certificate validation vulnerability has been reported to affect File Station 5. If exploited, the vulnerability could allow remote attackers who h… |
CVE-2025-22484 | | 2025-06-06 | An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, t… | |
CVE-2025-22482 | High | 8.1 | 2025-06-06 | A use of externally-controlled format string vulnerability has been reported to affect Qsync Central. If exploited, the vulnerability could allow remote attack… |
CVE-2025-22481 | High | 8.8 | 2025-06-06 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attack… |
CVE-2025-5782 | Medium | 6.3 | 2025-06-06 | A vulnerability, which was classified as critical, has been found in PHPGurukul Employee Record Management System 1.3. Affected by this issue is some unknown f… |
CVE-2025-5780 | Medium | 6.3 | 2025-06-06 | A vulnerability was found in code-projects Patient Record Management System 1.0 and classified as critical. Affected by this issue is some unknown functionalit… |
CVE-2025-5779 | Medium | 6.3 | 2025-06-06 | A vulnerability has been found in code-projects Patient Record Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown f… |
CVE-2025-41646 | Critical | 9.8 | 2025-06-06 | An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. This leads to full com… |
CVE-2025-27531 | Critical | 9.8 | 2025-06-06 | Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 before 2.1.0, this issue would allow an aut… |
CVE-2025-5806 | High | 8.0 | 2025-06-06 | Jenkins Gatling Plugin 136.vb_9009b_3d33a_e serves Gatling reports in a manner that bypasses the Content-Security-Policy protection introduced in Jenkins 1.641… |
CVE-2025-5791 | High | 7.1 | 2025-06-06 | A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than… |
CVE-2025-5778 | High | 7.3 | 2025-06-06 | A vulnerability, which was classified as critical, was found in 1000 Projects ABC Courier Management System 1.0. Affected is an unknown function of the file /a… |
CVE-2025-38002 | High | 7.8 | 2025-06-06 | In the Linux kernel, the following vulnerability has been resolved: io_uring/fdinfo: grab ctx->uring_lock around io_uring_show_fdinfo() Not everything requir… |
CVE-2025-38001 | High | 7.8 | 2025-06-06 | In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice Savino says: … |
CVE-2025-0620 | Medium | 4.9 | 2025-06-06 | A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expo… |
CVE-2025-5766 | Medium | 4.3 | 2025-06-06 | A vulnerability was found in code-projects Laundry System 1.0. It has been declared as problematic. This vulnerability affects unknown code. The manipulation l… |
CVE-2025-5765 | Low | 3.5 | 2025-06-06 | A vulnerability was found in code-projects Laundry System 1.0. It has been classified as problematic. This affects an unknown part of the file /data/edit_laund… |
CVE-2025-5764 | Low | 3.5 | 2025-06-06 | A vulnerability was found in code-projects Laundry System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /… |
CVE-2025-49453 | High | 7.1 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Jatinder Pal Singh BP Profile as Homepage bp-profile-as-homepage allows Stored XSS.This issue affects BP Pro… |
CVE-2025-49450 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mhallmann SEPA Girocode sepa-girocode allows Stored XSS.T… |
CVE-2025-49449 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Interactive Regional Map of Africa interactive-map-of-africa allows Cross Site Request Forger… |
CVE-2025-49446 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in minhlaobao Admin Notes admin-note allows Cross Site Request Forgery.This issue affects Admin Notes: from n/a… |
CVE-2025-49445 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in WP Map Plugins Interactive UK Regional Map interactive-uk-regional-map allows Cross Site Request Forgery.Thi… |
CVE-2025-49443 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris McCoy Bacon Ipsum bacon-ipsum allows Stored XSS.Thi… |
CVE-2025-49442 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mostafa Shahiri Simple Nested Menu simple-nested-menu all… |
CVE-2025-49441 | Medium | 5.3 | 2025-06-06 | Missing Authorization vulnerability in WP Map Plugins Interactive Regional Map of Florida interactive-map-of-florida allows Exploiting Incorrectly Configured A… |
CVE-2025-49440 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Vuong Nguyen WP Security Master wp-security-master allows Cross Site Request Forgery.This issue affects WP S… |
CVE-2025-49439 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in mariusz88atelierweb Atelier Create CV atelier-create-cv allows Cross Site Request Forgery.This issue affects… |
CVE-2025-49435 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Hasina77 Wp Easy Allopass wordpress-easy-allopass allows Cross Site Request Forgery.This issue affects Wp Ea… |
CVE-2025-49429 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Burnette Video Embeds video-embeds allows Stored XSS… |
CVE-2025-49427 | Medium | 6.5 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Burnette Abbie Expander abbie-expander allows Stored… |
CVE-2025-49425 | High | 7.1 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in Adrian Hanft Konami Easter Egg konami-easter-egg allows Stored XSS.This issue affects Konami Easter Egg: fro… |
CVE-2025-49421 | High | 7.6 | 2025-06-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Andrei Filonov WP Text Expander wp-text-expander allows S… |
CVE-2025-49419 | Medium | 5.5 | 2025-06-06 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in esigngenie Foxit eSign for WordPress esign-genie-for-wp allows Retr… |
CVE-2025-49333 | Medium | 5.9 | 2025-06-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wp.insider Simple Membership simple-membership allows Sto… |
CVE-2025-49332 | Medium | 4.3 | 2025-06-06 | Cross-Site Request Forgery (CSRF) vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Cross Site Request Forgery.This issu… |
CVE-2025-49329 | Medium | 6.6 | 2025-06-06 | Unrestricted Upload of File with Dangerous Type vulnerability in Agile Logix Store Locator WordPress agile-store-locator allows Upload a Web Shell to a Web Ser… |