2025 CVEs (page 299)
Page 299 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-37096 | Critical | 9.8 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37095 | Critical | 9.8 | 2025-06-02 | A directory traversal information disclosure vulnerability exists in HPE StoreOnce Software. |
CVE-2025-20001 | Medium | 6.5 | 2025-06-02 | An out-of-bounds read vulnerability exists in High-Logic FontCreator 15.0.0.3015. A specially crafted font file can trigger this vulnerability which can lead t… |
CVE-2025-5447 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been dec… |
CVE-2025-37094 | Medium | 5.5 | 2025-06-02 | A directory traversal arbitrary file deletion vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37093 | Critical | 9.8 | 2025-06-02 | An authentication bypass vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37092 | Critical | 9.8 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37091 | High | 7.2 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37090 | Critical | 9.8 | 2025-06-02 | A server-side request forgery vulnerability exists in HPE StoreOnce Software. |
CVE-2025-37089 | Critical | 9.8 | 2025-06-02 | A command injection remote code execution vulnerability exists in HPE StoreOnce Software. |
CVE-2025-5446 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been cla… |
CVE-2025-5445 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001 and classified a… |
CVE-2025-46806 | | 2025-06-02 | A Use of Out-of-range Pointer Offset vulnerability in sslh leads to denial of service on some architectures.This issue affects sslh before 2.2.4. | |
CVE-2025-26396 | High | 7.8 | 2025-06-02 | The SolarWinds Dameware Mini Remote Control was determined to be affected by Incorrect Permissions Local Privilege Escalation Vulnerability. This vulnerability… |
CVE-2025-5444 | Medium | 6.3 | 2025-06-02 | A vulnerability has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001 and classif… |
CVE-2025-5443 | Medium | 6.3 | 2025-06-02 | A vulnerability, which was classified as critical, was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1… |
CVE-2025-48990 | | 2025-06-02 | NeKernal is a free and open-source operating system stack. Version 0.0.2 has a 1-byte heap overflow in `rt_copy_memory`, which unconditionally wrote a null ter… | |
CVE-2025-48958 | Medium | 5.5 | 2025-06-02 | Froxlor is open source server administration software. Prior to version 2.2.6, an HTML Injection vulnerability in the customer account portal allows an attacke… |
CVE-2025-48957 | High | 7.5 | 2025-06-02 | AstrBot is a large language model chatbot and development framework. A path traversal vulnerability present in versions 3.4.4 through 3.5.12 may lead to inform… |
CVE-2025-48955 | Medium | 6.2 | 2025-06-02 | Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 exposes both acces… |
CVE-2025-48495 | Medium | 5.4 | 2025-06-02 | Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. By renaming the friendly name of an API key, an authenticated use… |
CVE-2025-46807 | | 2025-06-02 | A Allocation of Resources Without Limits or Throttling vulnerability in sslh allows attackers to easily exhaust the file descriptors in sslh and deny legitimat… | |
CVE-2025-5442 | Medium | 6.3 | 2025-06-02 | A vulnerability, which was classified as critical, has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.00… |
CVE-2025-5441 | Medium | 6.3 | 2025-06-02 | A vulnerability classified as critical was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2… |
CVE-2025-48494 | Medium | 5.4 | 2025-06-02 | Gokapi is a self-hosted file sharing server with automatic expiration and encryption support. When using end-to-end encryption, a stored cross-site scripting v… |
CVE-2025-47289 | Medium | 6.3 | 2025-06-02 | CE Phoenix is a free, open-source eCommerce platform. A stored cross-site scripting (XSS) vulnerability was discovered in CE Phoenix versions 1.0.9.9 through 1… |
CVE-2025-47272 | Medium | 5.5 | 2025-06-02 | The CE Phoenix eCommerce platform, starting in version 1.0.9.7 and prior to version 1.1.0.3, allowed logged-in users to delete their accounts without requiring… |
CVE-2025-3454 | Medium | 5.0 | 2025-06-02 | This vulnerability in Grafana's datasource proxy API allows authorization checks to be bypassed by adding an extra slash character in the URL path. Users with… |
CVE-2025-29785 | High | 7.5 | 2025-06-02 | quic-go is an implementation of the QUIC protocol in Go. The loss recovery logic for path probe packets that was added in the v0.50.0 release can be used to tr… |
CVE-2025-1246 | High | 7.8 | 2025-06-02 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Dr… |
CVE-2025-0819 | High | 7.8 | 2025-06-02 | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows… |
CVE-2025-0073 | High | 7.8 | 2025-06-02 | Use After Free vulnerability in Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture Kernel Driver allows a local non-privileged user proces… |
CVE-2025-5440 | Medium | 6.3 | 2025-06-02 | A vulnerability classified as critical has been found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003… |
CVE-2025-5439 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been rat… |
CVE-2025-3260 | High | 8.3 | 2025-06-02 | A security vulnerability in the /apis/dashboard.grafana.app/* endpoints allows authenticated users to bypass dashboard and folder permissions. The vulnerabilit… |
CVE-2025-1750 | Critical | 9.8 | 2025-06-02 | An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llama_index version v0.12.19. This vulnerability allows an attac… |
CVE-2025-5455 | | 2025-06-02 | An issue was found in the private API function qDecodeDataUrl() in QtCore, which is used in QTextDocument and QNetworkReply, and, potentially, in user code. … | |
CVE-2025-5438 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. It has been dec… |
CVE-2025-5437 | Medium | 5.3 | 2025-06-02 | A vulnerability classified as critical has been found in Multilaser Sirius RE016 MLT1.0. Affected is an unknown function of the file /cgi-bin/cstecgi.cgi of th… |
CVE-2025-5436 | Medium | 5.3 | 2025-06-02 | A vulnerability was found in Multilaser Sirius RE016 MLT1.0. It has been rated as problematic. This issue affects some unknown processing of the file /cgi-bin/… |
CVE-2025-5435 | High | 7.3 | 2025-06-02 | A vulnerability was found in Marwal Infotech CMS 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /page.php. The mani… |
CVE-2025-5113 | | 2025-06-02 | The Diviotec professional series exposes a web interface. One endpoint is vulnerable to arbitrary command injection and hardcoded passwords are used. | |
CVE-2025-0358 | High | 8.8 | 2025-06-02 | During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that allowed… |
CVE-2025-0325 | Medium | 4.3 | 2025-06-02 | A Guard Tour VAPIX API parameter allowed the use of arbitrary values and can be incorrectly called, allowing an attacker to block access to the guard tour conf… |
CVE-2025-0324 | Critical | 9.4 | 2025-06-02 | The VAPIX Device Configuration framework allowed a privilege escalation, enabling a lower-privileged user to gain administrator privileges. |
CVE-2025-5434 | High | 7.3 | 2025-06-02 | A vulnerability was found in Aem Solutions CMS up to 1.0. It has been classified as critical. This affects an unknown part of the file /page.php. The manipulat… |
CVE-2025-5433 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in Fengoffice Feng Office 3.5.1.5 and classified as critical. Affected by this issue is some unknown functionality of the file /index… |
CVE-2025-4010 | | 2025-06-02 | The Netcom NTC 6200 and NWL 222 series expose a web interface to be configured and set up by operators. Multiple endpoints of the web interface are vulnerable… | |
CVE-2025-1235 | Medium | 4.3 | 2025-06-02 | A low privileged attacker can set the date of the devices to the 19th of January 2038 an therefore exceed the 32-Bit time limit. This causes the date of the sw… |
CVE-2025-5432 | Medium | 6.3 | 2025-06-02 | A vulnerability has been found in AssamLook CMS 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /view_te… |
CVE-2025-5431 | Medium | 6.3 | 2025-06-02 | A vulnerability, which was classified as critical, was found in AssamLook CMS 1.0. Affected is an unknown function of the file /department-profile.php. The man… |
CVE-2025-3951 | Medium | 4.1 | 2025-06-02 | The WP-Optimize WordPress plugin before 4.2.0 does not properly escape user input when checking image compression statuses, which could allow users with the a… |
CVE-2025-1485 | Medium | 4.8 | 2025-06-02 | The Real Cookie Banner: GDPR & ePrivacy Cookie Consent WordPress plugin before 5.1.6, real-cookie-banner-pro WordPress plugin before 5.1.6 does not sanitise an… |
CVE-2025-5430 | Medium | 6.3 | 2025-06-02 | A vulnerability, which was classified as critical, has been found in AssamLook CMS 1.0. This issue affects some unknown processing of the file /product.php. Th… |
CVE-2025-5429 | Medium | 6.3 | 2025-06-02 | A vulnerability classified as critical was found in juzaweb CMS up to 3.4.2. This vulnerability affects unknown code of the file /admin-cp/plugin/install of th… |
CVE-2025-49113 | Critical | 9.9 | 2025-06-02 | Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validat… |
CVE-2025-49112 | Low | 3.1 | 2025-06-02 | setDeferredReply in networking.c in Valkey through 8.1.1 has an integer underflow for prev->size - prev->used. |
CVE-2025-25179 | High | 7.8 | 2025-06-02 | Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. |
CVE-2025-5428 | Medium | 6.3 | 2025-06-02 | A vulnerability classified as critical has been found in juzaweb CMS up to 3.4.2. This affects an unknown part of the file /admin-cp/log-viewer of the componen… |
CVE-2025-5427 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in juzaweb CMS up to 3.4.2. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin-cp… |
CVE-2025-5426 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in juzaweb CMS up to 3.4.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2025-5425 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in juzaweb CMS up to 3.4.2. It has been classified as critical. Affected is an unknown function of the file /admin-cp/theme/editor/de… |
CVE-2025-5424 | Medium | 6.3 | 2025-06-02 | A vulnerability was found in juzaweb CMS up to 3.4.2 and classified as critical. This issue affects some unknown processing of the file /admin-cp/media of the… |
CVE-2025-20678 | Medium | 6.5 | 2025-06-02 | In ims service, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue… |
CVE-2025-20677 | Medium | 5.5 | 2025-06-02 | In Bluetooth driver, there is a possible system crash due to an uncaught exception. This could lead to local denial of service with User execution privileges n… |
CVE-2025-20676 | Medium | 5.5 | 2025-06-02 | In wlan STA driver, there is a possible system crash due to an uncaught exception. This could lead to local denial of service with User execution privileges ne… |
CVE-2025-20675 | Medium | 5.5 | 2025-06-02 | In wlan STA driver, there is a possible system crash due to an uncaught exception. This could lead to local denial of service with User execution privileges ne… |
CVE-2025-20674 | Critical | 9.8 | 2025-06-02 | In wlan AP driver, there is a possible way to inject arbitrary packet due to a missing permission check. This could lead to remote escalation of privilege with… |
CVE-2025-20673 | Medium | 5.5 | 2025-06-02 | In wlan STA driver, there is a possible system crash due to an uncaught exception. This could lead to local denial of service with User execution privileges ne… |
CVE-2025-20672 | Critical | 9.8 | 2025-06-02 | In Bluetooth driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execu… |
CVE-2025-5423 | Medium | 6.3 | 2025-06-02 | A vulnerability has been found in juzaweb CMS up to 3.4.2 and classified as critical. This vulnerability affects unknown code of the file /admin-cp/setting/sys… |
CVE-2025-5422 | Medium | 4.3 | 2025-06-02 | A vulnerability, which was classified as problematic, was found in juzaweb CMS up to 3.4.2. This affects an unknown part of the file /admin-cp/logs/email of th… |
CVE-2025-5421 | Medium | 6.3 | 2025-06-02 | A vulnerability, which was classified as critical, has been found in juzaweb CMS up to 3.4.2. Affected by this issue is some unknown functionality of the file… |
CVE-2025-5420 | Low | 3.5 | 2025-06-02 | A vulnerability classified as problematic was found in juzaweb CMS up to 3.4.2. Affected by this vulnerability is an unknown functionality of the file /admin-c… |
CVE-2025-5412 | Low | 3.5 | 2025-06-02 | A vulnerability classified as problematic has been found in Mist Community Edition up to 4.7.1. Affected is the function Login of the file src/mist/api/views.p… |
CVE-2025-5411 | Low | 3.5 | 2025-06-01 | A vulnerability was found in Mist Community Edition up to 4.7.1. It has been rated as problematic. This issue affects the function tag_resources of the file sr… |
CVE-2025-5410 | Medium | 4.3 | 2025-06-01 | A vulnerability was found in Mist Community Edition up to 4.7.1. It has been declared as problematic. This vulnerability affects the function session_start_res… |
CVE-2025-5409 | High | 7.3 | 2025-06-01 | A vulnerability was found in Mist Community Edition up to 4.7.1. It has been classified as critical. This affects the function create_token of the file src/mis… |
CVE-2025-5408 | Critical | 9.8 | 2025-06-01 | A vulnerability was found in WAVLINK QUANTUM D2G, QUANTUM D3G, WL-WN530G3A, WL-WN530HG3, WL-WN532A3 and WL-WN576K1 up to V1410_240222 and classified as critica… |
CVE-2025-5407 | Low | 2.4 | 2025-06-01 | A vulnerability has been found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513 and classified as problematic. Affected by this vulnera… |
CVE-2025-5406 | Medium | 6.3 | 2025-06-01 | A vulnerability, which was classified as critical, was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. Affected is an unknown f… |
CVE-2025-5405 | Low | 3.5 | 2025-06-01 | A vulnerability, which was classified as problematic, has been found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. This issue affec… |
CVE-2025-5404 | Medium | 4.3 | 2025-06-01 | A vulnerability classified as problematic was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. This vulnerability affects unknow… |
CVE-2025-5403 | Medium | 6.3 | 2025-06-01 | A vulnerability classified as critical has been found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. This affects an unknown part of… |
CVE-2025-5402 | High | 7.3 | 2025-06-01 | A vulnerability was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. It has been rated as critical. Affected by this issue is so… |
CVE-2025-40908 | Critical | 9.1 | 2025-06-01 | YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified |
CVE-2025-5401 | High | 7.3 | 2025-06-01 | A vulnerability was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. It has been declared as critical. Affected by this vulnerab… |
CVE-2025-33005 | Medium | 6.3 | 2025-06-01 | IBM Planning Analytics Local 2.0 and 2.1 does not invalidate session after a logout which could allow an authenticated user to impersonate another user on the… |
CVE-2025-33004 | Medium | 6.5 | 2025-06-01 | IBM Planning Analytics Local 2.0 and 2.1 could allow a privileged user to delete files from directories due to improper pathname restriction. |
CVE-2025-2896 | Medium | 4.8 | 2025-06-01 | IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript c… |
CVE-2025-25044 | Medium | 5.4 | 2025-06-01 | IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript c… |
CVE-2025-1499 | Medium | 6.5 | 2025-06-01 | IBM InfoSphere Information Server 11.7 stores credential information for database authentication in a cleartext parameter file that could be viewed by an authe… |
CVE-2025-5400 | High | 7.3 | 2025-06-01 | A vulnerability was found in chaitak-gorai Blogbook up to 92f5cf90f8a7e6566b576fe0952e14e1c6736513. It has been classified as critical. Affected is an unknown… |
CVE-2025-5390 | Medium | 6.3 | 2025-05-31 | A vulnerability, which was classified as critical, was found in JeeWMS up to 20250504. This affects the function filedeal of the file /systemController/filedea… |
CVE-2025-5389 | Medium | 6.3 | 2025-05-31 | A vulnerability, which was classified as critical, has been found in JeeWMS up to 20250504. Affected by this issue is the function dogenerateOne2Many of the fi… |
CVE-2025-5388 | Medium | 6.3 | 2025-05-31 | A vulnerability classified as critical was found in JeeWMS up to 20250504. Affected by this vulnerability is the function dogenerate of the file /generateContr… |
CVE-2025-5387 | Medium | 6.3 | 2025-05-31 | A vulnerability classified as critical has been found in JeeWMS up to 20250504. Affected is the function dogenerate of the file /generateController.do?dogenera… |
CVE-2025-5386 | Medium | 6.3 | 2025-05-31 | A vulnerability was found in JeeWMS up to 20250504. It has been rated as critical. This issue affects the function transEditor of the file /cgformTransControll… |
CVE-2025-5385 | Medium | 6.3 | 2025-05-31 | A vulnerability was found in JeeWMS up to 20250504. It has been declared as critical. This vulnerability affects the function doAdd of the file /cgformTemplate… |
CVE-2025-5384 | Medium | 6.3 | 2025-05-31 | A vulnerability was found in JeeWMS up to 20250504. It has been classified as critical. This affects the function CgAutoListController of the file /cgAutoListC… |