2025 CVEs (page 30)

Page 30 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.

All CVEs published in 2025 — newest first (page 30 of 436)
CVESeverityScorePublishedSummary
CVE-2025-15330High8.82026-02-05Tanium addressed an improper input validation vulnerability in Deploy.
CVE-2025-15329Medium4.92026-02-05Tanium addressed an information disclosure vulnerability in Threat Response.
CVE-2025-15328Medium5.02026-02-05Tanium addressed an improper link resolution before file access vulnerability in Enforce.
CVE-2025-15327Medium4.32026-02-05Tanium addressed an improper access controls vulnerability in Deploy.
CVE-2025-15326Medium4.32026-02-05Tanium addressed an improper access controls vulnerability in Patch.
CVE-2025-15325Medium6.32026-02-05Tanium addressed an improper input validation vulnerability in Discover.
CVE-2025-15324Medium6.62026-02-05Tanium addressed a documentation issue in Engage.
CVE-2025-15323Low3.72026-02-05Tanium addressed an improper certificate validation vulnerability in Tanium Appliance.
CVE-2025-15321Low2.72026-02-05Tanium addressed an improper input validation vulnerability in Tanium Appliance.
CVE-2025-15312Medium6.62026-02-05Tanium addressed an improper output sanitization vulnerability in Tanium Appliance.
CVE-2025-15311High7.82026-02-05Tanium addressed an unauthorized code execution vulnerability in Tanium Appliance.
CVE-2025-15289Low3.12026-02-05Tanium addressed an improper access controls vulnerability in Interact.
CVE-2025-70073High7.22026-02-05An issue in ChestnutCMS v.1.5.8 and before allows a remote attacker to execute arbitrary code via the template creation function
CVE-2025-68121Critical10.02026-02-05During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed han…
CVE-2025-58190Medium5.32026-02-05The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an a…
CVE-2025-47911Medium5.32026-02-05The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if…
CVE-2025-15557High8.82026-02-05An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept a…
CVE-2025-15551Medium5.62026-02-05The response coming from TP-Link Archer MR200 v5.2, C20 v5 and v6, TL-WR850N v3, and TL-WR845N v4 for any request is getting executed by the JavaScript functio…
CVE-2025-70792Medium6.12026-02-05Cross Site Scripting vulnerability in the "/admin/category/create" endpoint of Microweber 2.0.19. An attacker can manipulate the "rel_id" parameter in a crafte…
CVE-2025-70791Medium6.12026-02-05Cross Site Scripting vulnerability in the "/admin/order/abandoned" endpoint of Microweber 2.0.19. An attacker can manipulate the "orderDirection" parameter in…
CVE-2025-69906High8.82026-02-05Monstra CMS v3.0.4 contains an arbitrary file upload vulnerability in the Files Manager plugin. The application relies on blacklist-based file extension valida…
CVE-2025-69619Medium5.52026-02-05A path traversal in My Text Editor v1.6.2 allows attackers to cause a Denial of Service (DoS) via writing files to the internal storage.
CVE-2025-68723Critical9.02026-02-05Axigen Mail Server before 10.5.57 contains multiple stored Cross-Site Scripting (XSS) vulnerabilities in the WebAdmin interface. Three instances exist: (1) the…
CVE-2025-68643Medium5.42026-02-05Axigen Mail Server before 10.5.57 allows stored Cross-Site Scripting (XSS) in the handling of the timeFormat account preference parameter. Attackers can exploi…
CVE-2025-68722High8.82026-02-05Axigen Mail Server before 10.5.57 and 10.6.x before 10.6.26 contains a Cross-Site Request Forgery (CSRF) vulnerability in the WebAdmin interface through improp…
CVE-2025-68721High8.12026-02-05Axigen Mail Server before 10.5.57 contains an improper access control vulnerability in the WebAdmin interface. A delegated admin account with zero permissions…
CVE-2025-14150Medium6.52026-02-05IBM webMethods Integration (on prem) - Integration Server 10.15 through IS_10.15_Core_Fix2411.1 to IS_11.1_Core_Fix8 IBM webMethods Integration could disclose…
CVE-2025-13491Medium5.12026-02-05IBM App Connect Enterprise Certified Container CD: 11.2.0 through 11.6.0, 12.1.0 through 12.19.0 and 12.0 LTS: 12.0.0 through 12.0.19 could allow an attacker t…
CVE-2025-13379High8.62026-02-05IBM Aspera Console 3.4.0 through 3.4.8 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the att…
CVE-2025-14079Medium5.32026-02-05The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.3.5…
CVE-2025-13416Medium4.32026-02-05The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to unauthorized user suspension due to a missing capability check on…
CVE-2025-10258Medium6.32026-02-05Infinera DNA is vulnerable to a time-based SQL injection vulnerability due to insufficient input validation, which may result in leaking of sensitive informati…
CVE-2025-150802026-02-05Improper Validation of Specified Quantity in Input vulnerability in Mitsubishi Electric MELSEC iQ-R Series R08PCPU, R16PCPU, R32PCPU, and R120PCPU allows an un…
CVE-2025-61732High8.62026-02-05A discrepancy between how Go and C/C++ comments were parsed allowed for code smuggling into the resulting cgo binary.
CVE-2025-10314High8.82026-02-05Incorrect Default Permissions vulnerability in Mitsubishi Electric Corporation FREQSHIP-mini for Windows versions 8.0.0 to 8.0.2 allows a local attacker to exe…
CVE-2025-11730High7.22026-02-05A post‑authentication command injection vulnerability in the Dynamic DNS (DDNS) configuration CLI command in Zyxel ATP series firmware versions from V5.35 thro…
CVE-2025-13192High8.22026-02-05The Popup builder with Gamification, Multi-Step Popups, Page-Level Targeting, and WooCommerce Triggers plugin for WordPress is vulnerable to generic SQL Inject…
CVE-2025-62616Critical9.82026-02-04AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autog…
CVE-2025-62615Critical9.82026-02-04AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autog…
CVE-2025-22873Low3.82026-02-04It was possible to improperly access the parent directory of an os.Root by opening a filename ending in "../". For example, Root.Open("../") would open the par…
CVE-2025-2134Low3.52026-02-04IBM Jazz Reporting Service could allow an authenticated user on the network to affect the system's performance using complicated queries due to insufficient re…
CVE-2025-27550Low3.52026-02-04IBM Jazz Reporting Service could allow an authenticated user on the host network to obtain sensitive information about other projects that reside on the server.
CVE-2025-1823Low3.52026-02-04IBM Jazz Reporting Service could allow an authenticated user on the host network to cause a denial of service using specially crafted SQL query that consumes e…
CVE-2025-15555High7.32026-02-04A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function hss_ogs_diam_cx_mar_cb of the file src/hss/hss-cx-pa…
CVE-2025-13375Critical9.82026-02-04IBM Common Cryptographic Architecture (CCA) 7.5.52 and 8.4.82 could allow an unauthenticated user to execute arbitrary commands with elevated privileges on the…
CVE-2025-71031High7.52026-02-04Water-Melon Melon commit 9df9292 and below is vulnerable to Denial of Service. The HTTP component doesn't have any maximum length. As a result, an excessive re…
CVE-2025-68699Medium6.52026-02-04NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging Platform. In version 0.24.6, NanoMQ has a protocol parsing / forwarding inconsistency when handling…
CVE-2025-69215High8.82026-02-04OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior, there is a SQL Injection vulnerability…
CVE-2025-69213High8.82026-02-04OpenSTAManager is an open source management software for technical assistance and invoicing. In version 2.9.8 and prior, a SQL Injection vulnerability exists i…
CVE-2025-64712Critical9.82026-02-04The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many mo…
CVE-2025-711992026-02-04In the Linux kernel, the following vulnerability has been resolved: iio: adc: at91-sama5d2_adc: Fix potential use-after-free in sama5d2_adc driver at91_adc_i…
CVE-2025-711982026-02-04In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix iio_chan_spec for sensors without event detection The st_lsm6ds…
CVE-2025-711972026-02-04In the Linux kernel, the following vulnerability has been resolved: w1: therm: Fix off-by-one buffer overflow in alarms_store The sysfs buffer passed to alar…
CVE-2025-711962026-02-04In the Linux kernel, the following vulnerability has been resolved: phy: stm32-usphyc: Fix off by one in probe() The "index" variable is used as an index int…
CVE-2025-711952026-02-04In the Linux kernel, the following vulnerability has been resolved: dmaengine: xilinx: xdma: Fix regmap max_register The max_register field is assigned the s…
CVE-2025-711942026-02-04In the Linux kernel, the following vulnerability has been resolved: btrfs: fix deadlock in wait_current_trans() due to ignored transaction type When wait_cur…
CVE-2025-711932026-02-04In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qusb2: Fix NULL pointer dereference on early suspend Enabling runtime PM before…
CVE-2025-61917High7.72026-02-04n8n is an open source workflow automation platform. From version 1.65.0 to before 1.114.3, the use of Buffer.allocUnsafe() and Buffer.allocUnsafeSlow() in the…
CVE-2025-71192High7.02026-02-04In the Linux kernel, the following vulnerability has been resolved: ALSA: ac97: fix a double free in snd_ac97_controller_register() If ac97_add_adapter() fai…
CVE-2025-70545Medium6.12026-02-04A stored cross-site scripting (XSS) vulnerability exists in the web management interface of the PPC (Belden) ONT 2K05X router running firmware v1.1.9_206L. The…
CVE-2025-70997Medium6.52026-02-04A vulnerability has been discovered in eladmin v2.7 and before. This vulnerability allows for an arbitrary user password reset under any user permission level.
CVE-2025-69618Medium6.52026-02-04An arbitrary file overwrite vulnerability in the file import process of Tarot, Astro & Healing v11.4.0 allows attackers to overwrite critical internal files, p…
CVE-2025-5329Critical9.82026-02-04Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Martcode Software Inc. Delta Course Automation allows SQL…
CVE-2025-15368High8.82026-02-04The SportsPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.7.26 via shortcodes 'template_name' attribut…
CVE-2025-14740Medium6.72026-02-04Docker Desktop for Windows contains multiple incorrect permission assignment vulnerabilities in the installer's handling of the C:\ProgramData\DockerDesktop di…
CVE-2025-59818Critical10.02026-02-04This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file name of an uploaded file.
CVE-2025-410852026-02-04Stored Cross-Site Scripting (XSS) vulnerability type in Apidog in the version 2.7.15, where SVG image uploads are not properly sanitized. This allows attacker…
CVE-2025-15508Medium5.32026-02-04The Magic Import Document Extractor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.4 via the ge…
CVE-2025-15507Medium5.32026-02-04The Magic Import Document Extractor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_sync_…
CVE-2025-15487Medium4.92026-02-04The Code Explorer plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.4.6 via the 'file' parameter. This makes it poss…
CVE-2025-15482Medium5.32026-02-04The Chapa Payment Gateway Plugin for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0…
CVE-2025-15285High7.52026-02-04The SEO Flow by LupsOnline plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the checkBlogAuthentica…
CVE-2025-15268High7.52026-02-04The Infility Global plugin for WordPress is vulnerable to unauthenticated SQL Injection via the 'infility_get_data' API action in all versions up to, and inclu…
CVE-2025-15260Medium6.52026-02-04The MyRewards – Loyalty Points and Rewards for WooCommerce plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 5…
CVE-2025-14461Medium5.32026-02-04The Xendit Payment plugin for WordPress is vulnerable to unauthorized order status manipulation in all versions up to, and including, 6.0.2. This is due to the…
CVE-2025-298672026-02-04Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Hancom Inc. Hancom Office 2018, Hancom Inc. Hancom Office 2020, Hancom Inc. Hanc…
CVE-2025-69621High8.12026-02-04An arbitrary file overwrite vulnerability in the file import process of Comic Book Reader v1.0.95 allows attackers to overwrite critical internal files, potent…
CVE-2025-69620Medium5.02026-02-04A path traversal in Moo Chan Song v4.5.7 allows attackers to cause a Denial of Service (DoS) via writing files to the internal storage.
CVE-2025-36094Medium5.42026-02-03IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 007 c…
CVE-2025-36033Medium5.42026-02-03IBM Engineering Lifecycle Management - Global Configuration Management 7.0.3 through 7.0.3 Interim Fix 017, and 7.1.0 through 7.1.0 Interim Fix 004 IBM Global…
CVE-2025-33081Low3.32026-02-03IBM Concert 1.0.0 through 2.1.0 stores potentially sensitive information in log files that could be read by a local user.
CVE-2025-650812026-02-03An out-of-bounds read vulnerability has been identified in the Postscript interpreter in various Lexmark devices. This vulnerability can be leveraged by an att…
CVE-2025-650802026-02-03A type confusion vulnerability has been identified in the Postscript interpreter in various Lexmark devices. This vulnerability can be leveraged by an attacker…
CVE-2025-650792026-02-03A heap-based buffer overflow vulnerability has been identified in the Postscript interpreter in various Lexmark devices. This vulnerability can be leveraged by…
CVE-2025-650782026-02-03An untrusted search path vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerability can be leveraged…
CVE-2025-650772026-02-03A relative path traversal vulnerability has been identified in the Embedded Solutions Framework in various Lexmark devices. This vulnerability can be leveraged…
CVE-2025-64438High7.52026-02-03Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6…
CVE-2025-64098Medium5.92026-02-03Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6…
CVE-2025-62799Critical9.82026-02-03Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6…
CVE-2025-62603High7.52026-02-03Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). ParticipantGenericMessage is the DDS Se…
CVE-2025-62602High7.52026-02-03Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6…
CVE-2025-62601High7.52026-02-03Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group ). Prior to versions 3.4.1, 3.3.1, and 2.6…
CVE-2025-10878Critical10.02026-02-03A SQL injection vulnerability exists in the login functionality of Fikir Odalari AdminPando 1.0.1 before 2026-01-26. The username and password parameters are v…
CVE-2025-62673High8.02026-02-03Heap-based Buffer Overflow vulnerability in Archer AX53 v1.0 and AX12 v1.0 (tdpserver modules) allows adjacent attackers to cause a segmentation fault or poten…
CVE-2025-62600High8.62026-02-03eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to 2.6.11, 2.14.6, 3.2.4…
CVE-2025-62501High8.12026-02-03SSH Hostkey misconfiguration vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows attackers to obtain device credentials through a specially cr…
CVE-2025-62405High8.02026-02-03Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault…
CVE-2025-62404High8.02026-02-03Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault…
CVE-2025-61983High8.02026-02-03Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault…
CVE-2025-61944High8.02026-02-03Heap-based Buffer Overflow vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows authenticated adjacent attackers to cause a segmentation fault…