2025 CVEs (page 3)
Page 3 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-45422 | High | 8.1 | 2026-07-09 | Incorrect access control in Proximus b-box v8c.725A allows authenticated attackers to bypass normal restrictions and make arbitrary changes to port forwarding… |
CVE-2025-63579 | High | 7.5 | 2026-07-09 | Unauthorized use of Kyocera printers, allows all information stored in the Kyocera address book to be exported. The security measure that encrypts incoming dat… |
CVE-2025-58151 | | 2026-07-09 | varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF inside the VM involving mapping a buffe… | |
CVE-2025-58146 | | 2026-07-09 | There are multiple issues. 1. Updates to the XAPI database sanitise input strings, but try generating the notification using the unsanitised input. This… | |
CVE-2025-27464 | | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose… | |
CVE-2025-27463 | | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose… | |
CVE-2025-27462 | | 2026-07-09 | [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expos… | |
CVE-2025-12506 | Low | 3.5 | 2026-07-08 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.5 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain c… |
CVE-2025-3110 | High | 7.5 | 2026-07-08 | OpenVPN Access Server 2.7.2 through 3.1.0 accepts bare line-feed sequences inside HTTP header values, allowing remote attackers to perform HTTP request smuggli… |
CVE-2025-14785 | Medium | 6.4 | 2026-07-08 | The Website Builder by SeedProd - Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode plugin for WordPress is vulnerable to Stored Cross-Si… |
CVE-2025-12799 | Medium | 6.5 | 2026-07-07 | A flaw was found in Jastow. Jastow is vulnerable to Cross-Site Scripting (XSS) attack. If using a set of combined configuration to allow unescaped characters i… |
CVE-2025-59617 | Medium | 6.6 | 2026-07-06 | Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input. |
CVE-2025-59616 | Medium | 6.6 | 2026-07-06 | Memory Corruption when processing multiple IOCTL calls with the same buffer file descriptor input due to accessing already freed memory. |
CVE-2025-59615 | Medium | 6.6 | 2026-07-06 | Memory Corruption when invoking device input/output control operations for mapping and unmapping persistent memory buffers due to improper synchronization. |
CVE-2025-53831 | High | 8.2 | 2026-07-06 | DrawIO for ownCloud is an application for using DrawIO with the file storage, synchronization, and sharing application ownCloud Classic. In DrawIO for ownCloud… |
CVE-2025-53830 | Critical | 9.1 | 2026-07-06 | Anti-Virus for ownCloud is an anti-virus application for file storage, synchronization, and sharing application ownCloud. Versions of Anti-Virus for ownCloud b… |
CVE-2025-53829 | High | 8.0 | 2026-07-06 | ownCloud is a file storage, synchronization, and sharing application. In ownCloud 10 prior to version 10.15.3, an attacker with administrative privileges can e… |
CVE-2025-53828 | High | 8.5 | 2026-07-06 | SharePoint for ownCloud is an application for using SharePoint with the file storage, synchronization, and sharing application ownCloud Classic. In SharePoint… |
CVE-2025-53827 | Critical | 9.1 | 2026-07-06 | ownCloud Core is the server-side component of the file storage, synchronization, and sharing application ownCloud Classic. In versions prior to 10.15.3, the Up… |
CVE-2025-15668 | Low | 3.3 | 2026-07-06 | A vulnerability was identified in GPAC up to b40ce70f5. This issue affects the function sgpd_del_entry of the file src/isomedia/box_code_base.c of the componen… |
CVE-2025-15667 | Low | 3.3 | 2026-07-06 | A vulnerability was determined in GPAC up to 2.5-DEV. This vulnerability affects the function gf_isom_nalu_sample_rewrite of the file src/isomedia/avc_ext.c of… |
CVE-2025-8591 | Medium | 6.1 | 2026-07-06 | The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition a… |
CVE-2025-13475 | Low | 3.5 | 2026-07-04 | In multi-tenanted deployments, the application consent management mechanism fails to correctly isolate consent scopes between tenants. Consent granted by a use… |
CVE-2025-71380 | High | 8.8 | 2026-07-04 | The Execute Command node in n8n allows authenticated users to execute arbitrary commands on the host system where n8n runs. Attackers with user access or compr… |
CVE-2025-71375 | High | 8.1 | 2026-07-04 | picklescan before 0.0.34 fails to detect the _operator.methodcaller built-in function when scanning pickle files for malicious code. Attackers can craft malici… |
CVE-2025-71373 | High | 8.1 | 2026-07-04 | picklescan before 0.0.33 fails to detect operator.methodcaller function calls in pickle files, allowing attackers to bypass security checks. Remote attackers c… |
CVE-2025-71372 | High | 8.1 | 2026-07-04 | Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran.getlincoef gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attacke… |
CVE-2025-71369 | High | 8.1 | 2026-07-04 | picklescan before 0.0.28 fails to detect malicious pickle files that use torch.utils.data.datapipes.utils.decoder.basichandlers in reduce methods, allowing att… |
CVE-2025-71367 | High | 8.1 | 2026-07-04 | picklescan before 0.0.34 fails to detect _operator.attrgetter function calls in pickle payloads, allowing attackers to bypass security checks. Remote attackers… |
CVE-2025-71366 | High | 8.1 | 2026-07-04 | picklescan before 0.0.28 fails to detect malicious torch.utils.bottleneck.__main__.run_cprofile function calls in pickle files, allowing attackers to bypass sa… |
CVE-2025-71364 | High | 8.1 | 2026-07-04 | picklescan before 0.0.30 fails to detect the asyncio.unix_events._UnixSubprocessTransport._start function in pickle reduce methods, allowing remote code execut… |
CVE-2025-71362 | High | 8.1 | 2026-07-04 | picklescan before 0.0.33 fails to detect unsafe deserialization when numpy.f2py.crackfortran functions call eval on arbitrary strings. Attackers can embed mali… |
CVE-2025-71360 | High | 8.1 | 2026-07-04 | picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.calltip.get_entity function in reduce methods. Attackers can embed undetected cod… |
CVE-2025-71359 | High | 8.1 | 2026-07-04 | picklescan before 0.0.29 fails to detect malicious pickle payloads that utilize lib2to3.pgen2.grammar.Grammar.loads in the reduce method, allowing remote code… |
CVE-2025-71356 | High | 8.1 | 2026-07-04 | picklescan before 0.0.28 fails to detect malicious torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression function calls in pickle files. At… |
CVE-2025-71353 | High | 8.1 | 2026-07-04 | picklescan before 0.0.28 fails to detect malicious pickle files that exploit torch._dynamo.guards.GuardBuilder.get function in reduce methods. Attackers can cr… |
CVE-2025-71347 | High | 8.1 | 2026-07-04 | picklescan before 0.0.33 fails to detect malicious pickle files using numpy.f2py.crackfortran.param_eval function in reduce methods, allowing attackers to bypa… |
CVE-2025-71345 | High | 8.1 | 2026-07-04 | picklescan before 0.0.30 fails to detect malicious pickle files that invoke torch.utils.bottleneck.__main__.run_autograd_prof function. Attackers can embed und… |
CVE-2025-71343 | High | 8.1 | 2026-07-04 | picklescan before 0.0.30 fails to detect malicious pickle files that exploit lib2to3.pgen2.pgen.ParserGenerator.make_label function in the reduce method. Attac… |
CVE-2025-71342 | High | 8.1 | 2026-07-04 | picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce methods. Attackers can embed undetected code in p… |
CVE-2025-71385 | Medium | 6.1 | 2026-07-02 | Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the generated SVG doc… |
CVE-2025-69156 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Kids Zone - Children WordPress Theme <= 5.4 versions. |
CVE-2025-69155 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.7 versions. |
CVE-2025-69154 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in SpaLab | Beauty Salon WordPress Theme <= 6.7 versions. |
CVE-2025-69153 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Trendy Travel <= 6.7 versions. |
CVE-2025-69152 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Photography WordPress <= 2.2.2 versions. |
CVE-2025-69134 | High | 7.5 | 2026-07-02 | Unauthenticated Arbitrary Content Deletion in OpenAI Chatbot for WordPress – Helper <= 1.1.4 versions. |
CVE-2025-69133 | High | 7.5 | 2026-07-02 | Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions. |
CVE-2025-69132 | Medium | 6.5 | 2026-07-02 | Subscriber Sensitive Data Exposure in Corpkit <= 1.0.5 versions. |
CVE-2025-69094 | High | 8.5 | 2026-07-02 | Subscriber SQL Injection in Unicamp <= 2.2.2 versions. |
CVE-2025-66076 | Medium | 5.3 | 2026-07-02 | Unauthenticated Broken Access Control in Woostify Sites Library <= 1.6.2 versions. |
CVE-2025-58902 | High | 8.1 | 2026-07-02 | Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions. |
CVE-2025-23351 | Critical | 9.0 | 2026-07-01 | NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bo… |
CVE-2025-23350 | Critical | 9.0 | 2026-07-01 | NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bo… |
CVE-2025-15646 | Critical | 9.8 | 2026-07-01 | HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the <template> element was added to libgumbo 0.10.0 in 2015, bu… |
CVE-2025-15666 | Medium | 5.3 | 2026-07-01 | A security vulnerability has been detected in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function Assimp::SceneCombine… |
CVE-2025-71381 | Medium | 6.5 | 2026-06-30 | Hono before 4.10.2 (fixed in 4.10.3) contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the… |
CVE-2025-71374 | High | 8.1 | 2026-06-30 | picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used in pickle reduce methods, allowing attackers to execute arb… |
CVE-2025-71371 | High | 8.1 | 2026-06-30 | picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payload… |
CVE-2025-71368 | High | 8.1 | 2026-06-30 | picklescan before 0.0.30 fails to detect the doctest.debug_script function when analyzing pickle files, allowing attackers to execute arbitrary code. Remote at… |
CVE-2025-71363 | High | 8.1 | 2026-06-30 | picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers c… |
CVE-2025-71355 | | 2026-06-30 | Picklescan before 0.0.25 fails to detect unsafe global functions in the Numpy library, allowing attackers to bypass static analysis and execute arbitrary code… | |
CVE-2025-71352 | High | 8.1 | 2026-06-30 | picklescan before 0.0.29 fails to detect the built-in Python trace.Trace.runctx function when used in pickle file reduce methods, allowing attackers to execute… |
CVE-2025-71350 | High | 8.1 | 2026-06-30 | picklescan before 0.0.28 fails to detect malicious pickle files using torch.utils.collect_env.run function in reduce methods. Attackers can embed undetected co… |
CVE-2025-71349 | High | 8.1 | 2026-06-30 | picklescan before 0.0.29 fails to detect the built-in trace.Trace.run function when analyzing pickle files, allowing attackers to embed undetected malicious co… |
CVE-2025-36359 | High | 8.1 | 2026-06-30 | IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could allow an authenticated user to impersonate a… |
CVE-2025-36336 | Medium | 5.9 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 transmits data in clear text that could allow an attacker to obtain sensitive information using man in… |
CVE-2025-36333 | Medium | 4.3 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to perform unauthorized actions due to the improper enforcement of b… |
CVE-2025-36328 | Medium | 4.3 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message… |
CVE-2025-36327 | Medium | 6.5 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to bypass security controls and perform unauthorized actions due to… |
CVE-2025-36324 | Medium | 4.3 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 s vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send u… |
CVE-2025-36323 | Medium | 5.4 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitr… |
CVE-2025-36321 | Medium | 5.7 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed… |
CVE-2025-36320 | Medium | 6.4 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed… |
CVE-2025-36319 | Medium | 4.3 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to cause a temporary denial using a specially crafted HTTP request d… |
CVE-2025-12530 | Medium | 5.9 | 2026-06-30 | IBM watsonx.data intelligence 5.2.2, 5.3.0, 5.3.1, 5.3.1 through Patch 1 transmits data in clear text that could allow an attacker to obtain sensitive informat… |
CVE-2025-36372 | Medium | 5.5 | 2026-06-30 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information to an a… |
CVE-2025-53648 | Medium | 5.4 | 2026-06-30 | SQL misconfiguration in the Gravitino UI, in versions 1.0.0 and below, can allow a malicious user to read or truncate files. Users are recommended to upgrade t… |
CVE-2025-7406 | High | 7.8 | 2026-06-30 | Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerability where a local attacker possessing administrative (local admin) privileges can esca… |
CVE-2025-24816 | Medium | 6.5 | 2026-06-30 | Nokia MantaRay is subject to an Improper Access Control vulnerability due to insufficient authorization within the API. Successful exploitation could allow an… |
CVE-2025-24815 | High | 7.8 | 2026-06-30 | Nokia MantaRay NM is subject to an unrestricted file upload vulnerability due to insufficient file type validation. Successful exploitation could allow an auth… |
CVE-2025-7386 | Medium | 6.8 | 2026-06-29 | Information exposure vulnerability in Hitachi Storage Navigator. This issue affects Hitachi Virtual Storage Platform 5100, 5200, 5500, 5600, 5100H, 5200H, 550… |
CVE-2025-2902 | High | 8.3 | 2026-06-29 | Improper Authorization Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual Storage Platform E390, E59… |
CVE-2025-0824 | Low | 3.7 | 2026-06-29 | Lack of validation for firmware update in Hitachi Hitachi Virtual Storage Platform One Block 23, 24, 26, 28. This issue affects Hitachi Virtual Storage Platfo… |
CVE-2025-59868 | Medium | 5.5 | 2026-06-27 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a sensitive data exposure vulnerability which could allow an attacker to exploit application inform… |
CVE-2025-32423 | | 2026-06-26 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.32, there is a DoS vuln… | |
CVE-2025-32394 | | 2026-06-26 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.32, there is a DoS vuln… | |
CVE-2025-11919 | Critical | 9.6 | 2026-06-26 | The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of other users on the same cloud instance (`/tmp/UserTempora… |
CVE-2025-68075 | Medium | 6.5 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in BNE Testimonials <= 2.0.8 versions. |
CVE-2025-68074 | Medium | 6.5 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in Image Carousel <= 1.0.0.41 versions. |
CVE-2025-68064 | High | 7.5 | 2026-06-26 | Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions. |
CVE-2025-68063 | High | 7.5 | 2026-06-26 | Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions. |
CVE-2025-68052 | High | 8.8 | 2026-06-26 | Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 versions. |
CVE-2025-66123 | Medium | 5.3 | 2026-06-26 | Unauthenticated Insecure Direct Object References (IDOR) in BookPro <= 1.1.0 versions. |
CVE-2025-64637 | Medium | 5.3 | 2026-06-26 | Unauthenticated Content Injection in Auros Core <= 5.3.1 versions. |
CVE-2025-64636 | Medium | 5.3 | 2026-06-26 | Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions. |
CVE-2025-63079 | Medium | 4.3 | 2026-06-26 | Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions. |
CVE-2025-63078 | Medium | 4.3 | 2026-06-26 | Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions. |
CVE-2025-63041 | Medium | 5.4 | 2026-06-26 | Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions. |
CVE-2025-64152 | Critical | 9.1 | 2026-06-26 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 befo… |