2025 CVEs (page 304)
Page 304 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-47294 | Medium | 5.3 | 2025-05-28 | A integer overflow or wraparound in Fortinet FortiOS versions 7.2.0 through 7.2.7, versions 7.0.0 through 7.0.14 may allow a remote unauthenticated attacker to… |
CVE-2025-46777 | Low | 2.3 | 2025-05-28 | A insertion of sensitive information into log file in Fortinet FortiPortal versions 7.4.0, versions 7.2.0 through 7.2.5, and versions 7.0.0 through 7.0.9 may a… |
CVE-2025-27528 | Critical | 9.1 | 2025-05-28 | Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability allows att… |
CVE-2025-27526 | Medium | 6.5 | 2025-05-28 | Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability which can le… |
CVE-2025-27522 | Medium | 6.5 | 2025-05-28 | Deserialization of Untrusted Data vulnerability in Apache InLong. This issue affects Apache InLong: from 1.13.0 through 2.1.0. This vulnerability is a seconda… |
CVE-2025-25251 | High | 7.8 | 2025-05-28 | An Incorrect Authorization vulnerability [CWE-863] in FortiClient Mac 7.4.0 through 7.4.2, 7.2.0 through 7.2.8, 7.0.0 through 7.0.14 may allow a local attacker… |
CVE-2025-24473 | Low | 3.7 | 2025-05-28 | A exposure of sensitive system information to an unauthorized control sphere vulnerability in Fortinet FortiClientWindows 7.2.0 through 7.2.1, FortiClientWindo… |
CVE-2025-22252 | Critical | 9.8 | 2025-05-28 | A missing authentication for critical function in Fortinet FortiProxy versions 7.6.0 through 7.6.1, FortiSwitchManager version 7.2.5, and FortiOS versions 7.4… |
CVE-2025-5025 | Medium | 4.8 | 2025-05-28 | libcurl supports *pinning* of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC… |
CVE-2025-4947 | Medium | 6.5 | 2025-05-28 | libcurl accidentally skips the certificate verification for QUIC connections when connecting to a host specified as an IP address in the URL. Therefore, it doe… |
CVE-2025-4009 | | 2025-05-28 | The Evertz SDVN 3080ipx-10G is a High Bandwidth Ethernet Switching Fabric for Video Application. This device exposes a web management interface on port 80. Thi… | |
CVE-2025-4800 | High | 8.8 | 2025-05-28 | The MasterStudy LMS Pro plugin for WordPress is vulnerable to arbitrary file uploads due to a missing file type validation in the stm_lms_add_assignment_attach… |
CVE-2025-25029 | Medium | 4.9 | 2025-05-28 | IBM Security Guardium 12.0 could allow a privileged user to download any file on the system due to improper escaping of input. |
CVE-2025-25026 | Medium | 4.3 | 2025-05-28 | IBM Security Guardium 12.0 could allow an authenticated user to obtain sensitive information due to an incorrect authentication check. |
CVE-2025-25025 | Medium | 4.3 | 2025-05-28 | IBM Security Guardium 12.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. T… |
CVE-2025-2826 | Low | 2.6 | 2025-05-27 | n affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or mo… |
CVE-2025-2796 | Medium | 5.3 | 2025-05-27 | On affected platforms with hardware IPSec support running Arista EOS with IPsec enabled and anti-replay protection configured, EOS may exhibit unexpected behav… |
CVE-2025-40911 | Medium | 6.5 | 2025-05-27 | Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly handle leading zero characters in IP CIDR address strings, which could allow attackers to… |
CVE-2025-32440 | Critical | 10.0 | 2025-05-27 | NetAlertX is a network, presence scanner and alert framework. Prior to version 25.4.14, it is possible to bypass the authentication mechanism of NetAlertX to u… |
CVE-2025-5283 | Medium | 5.4 | 2025-05-27 | Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2025-5281 | Medium | 5.4 | 2025-05-27 | Inappropriate implementation in BFCache in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially obtain user information via a crafted… |
CVE-2025-5280 | High | 8.8 | 2025-05-27 | Out of bounds write in V8 in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
CVE-2025-5279 | | 2025-05-27 | When the Amazon Redshift Python Connector is configured with the BrowserAzureOAuth2CredentialsProvider plugin, the driver skips the SSL certificate validation… | |
CVE-2025-5278 | Medium | 4.4 | 2025-05-27 | A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the… |
CVE-2025-5222 | High | 7.0 | 2025-05-27 | A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot… |
CVE-2025-5198 | Medium | 5.0 | 2025-05-27 | A flaw was found in Stackrox, where it is vulnerable to Cross-site scripting (XSS) if the script code is included in a small subset of table cells. The only kn… |
CVE-2025-5067 | Medium | 5.4 | 2025-05-27 | Inappropriate implementation in Tab Strip in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2025-5066 | Medium | 6.5 | 2025-05-27 | Inappropriate implementation in Messages in Google Chrome on Android prior to 137.0.7151.55 allowed a remote attacker who convinced a user to engage in specifi… |
CVE-2025-5065 | Medium | 6.5 | 2025-05-27 | Inappropriate implementation in FileSystemAccess API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTM… |
CVE-2025-5064 | Medium | 5.4 | 2025-05-27 | Inappropriate implementation in Background Fetch API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2025-5063 | High | 8.8 | 2025-05-27 | Use after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2025-46173 | Medium | 6.1 | 2025-05-27 | code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) via the name field in the feedback form. |
CVE-2025-45529 | High | 7.1 | 2025-05-27 | An arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to read arbitrary files via sending a crafted GET re… |
CVE-2025-5252 | High | 7.3 | 2025-05-27 | A vulnerability was found in PHPGurukul News Portal Project 4.1. It has been declared as critical. This vulnerability affects unknown code of the file /admin/e… |
CVE-2025-45475 | Medium | 5.4 | 2025-05-27 | maccms10 v2025.1000.4047 is vulnerable to Server-Side request forgery (SSRF) in Friend Link Management. |
CVE-2025-5251 | High | 7.3 | 2025-05-27 | A vulnerability was found in PHPGurukul News Portal Project 4.1. It has been classified as critical. This affects an unknown part of the file /admin/edit-subca… |
CVE-2025-5250 | High | 7.3 | 2025-05-27 | A vulnerability was found in PHPGurukul News Portal Project 4.1 and classified as critical. Affected by this issue is some unknown functionality of the file /a… |
CVE-2025-5249 | High | 7.3 | 2025-05-27 | A vulnerability has been found in PHPGurukul News Portal Project 4.1 and classified as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-48057 | Critical | 9.8 | 2025-05-27 | Icinga 2 is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for reporting. Pr… |
CVE-2025-23247 | Medium | 4.4 | 2025-05-27 | NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a failure to check the length of a buffer could allow a user to c… |
CVE-2025-22377 | Medium | 6.5 | 2025-05-27 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110… |
CVE-2025-5248 | High | 7.3 | 2025-05-27 | A vulnerability, which was classified as critical, was found in PHPGurukul Company Visitor Management System 1.0. Affected is an unknown function of the file /… |
CVE-2025-48370 | | 2025-05-27 | auth-js is an isomorphic Javascript library for Supabase Auth. Prior to version 2.70.0, the library functions getUserById, deleteUser, updateUserById, listFact… | |
CVE-2025-27701 | Medium | 5.5 | 2025-05-27 | In the function process_crypto_cmd, the values of ptrs[i] can be potentially equal to NULL which is valid value after calling slice_map_array(). Later this val… |
CVE-2025-27700 | High | 8.4 | 2025-05-27 | There is a possible bypass of carrier restrictions due to an unusual root cause. This could lead to local escalation of privilege with no additional execution… |
CVE-2025-5247 | High | 7.3 | 2025-05-27 | A vulnerability, which was classified as critical, has been found in Gowabby HFish 0.1. This issue affects the function LoadUrl of the file \view\url.go. The m… |
CVE-2025-5246 | High | 7.3 | 2025-05-27 | A vulnerability classified as critical was found in Campcodes Online Hospital Management System 1.0. This vulnerability affects unknown code of the file /hms/a… |
CVE-2025-5245 | Medium | 5.3 | 2025-05-27 | A vulnerability classified as critical has been found in GNU Binutils up to 2.44. This affects the function debug_type_samep of the file /binutils/debug.c of t… |
CVE-2025-48383 | High | 8.2 | 2025-05-27 | Django-Select2 is a Django integration for Select2. Prior to version 8.4.1, instances of HeavySelect2Mixin subclasses like the ModelSelect2MultipleWidget and M… |
CVE-2025-3704 | Medium | 5.9 | 2025-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DBAR Productions Volunteer Sign Up Sheets pta-volunteer-s… |
CVE-2025-2236 | | 2025-05-27 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in OpenText Advanced Authentication allows Information Elicitation. Th… | |
CVE-2025-48798 | High | 7.3 | 2025-05-27 | A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be… |
CVE-2025-48797 | High | 7.3 | 2025-05-27 | A flaw was found in GIMP when processing certain TGA image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP… |
CVE-2025-48796 | High | 7.3 | 2025-05-27 | A flaw was found in GIMP. The GIMP ani_load_image() function is vulnerable to a stack-based overflow. If a user opens.ANI files, GIMP may be used to store more… |
CVE-2025-5272 | High | 7.3 | 2025-05-27 | Memory safety bugs present in Firefox 138 and Thunderbird 138. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2025-5271 | Medium | 6.5 | 2025-05-27 | Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. This vulnerability was fixed in Firefox 139 and Thun… |
CVE-2025-5270 | High | 7.5 | 2025-05-27 | In certain cases, SNI could have been sent unencrypted even when encrypted DNS was enabled. This vulnerability was fixed in Firefox 139 and Thunderbird 139. |
CVE-2025-5269 | High | 8.1 | 2025-05-27 | Memory safety bug present in Firefox ESR 128.10, and Thunderbird 128.10. This bug showed evidence of memory corruption and we presume that with enough effort t… |
CVE-2025-5268 | High | 8.1 | 2025-05-27 | Memory safety bugs present in Firefox 138, Thunderbird 138, Firefox ESR 128.10, and Thunderbird 128.10. Some of these bugs showed evidence of memory corruption… |
CVE-2025-5267 | Medium | 5.4 | 2025-05-27 | A clickjacking vulnerability could have been used to trick a user into leaking saved payment card details to a malicious page. This vulnerability was fixed in… |
CVE-2025-5266 | Medium | 4.3 | 2025-05-27 | Script elements loading cross-origin resources generated load and error events which leaked information enabling XS-Leaks attacks. This vulnerability was fixed… |
CVE-2025-5265 | Medium | 4.8 | 2025-05-27 | Due to insufficient escaping of the ampersand character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially lead… |
CVE-2025-5264 | Medium | 4.8 | 2025-05-27 | Due to insufficient escaping of the newline character in the “Copy as cURL” feature, an attacker could trick a user into using this command, potentially leadin… |
CVE-2025-5263 | Medium | 4.3 | 2025-05-27 | Error handling for script execution was incorrectly isolated from web content, which could have allowed cross-origin leak attacks. This vulnerability was fixed… |
CVE-2025-5262 | High | 7.5 | 2025-05-27 | A double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC. This could have caused memo… |
CVE-2025-5244 | Medium | 5.3 | 2025-05-27 | A vulnerability was found in GNU Binutils up to 2.44. It has been rated as critical. Affected by this issue is the function elf_gc_sweep of the file bfd/elflin… |
CVE-2025-5117 | High | 8.8 | 2025-05-27 | The Property plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the use of the property_package_user_role metadata… |
CVE-2025-4412 | | 2025-05-27 | On macOS systems, by utilizing a Launch Agent and loading the viscosity_openvpn process from the application bundle, it is possible to load a dynamic library w… | |
CVE-2025-41653 | High | 7.5 | 2025-05-27 | An unauthenticated remote attacker can exploit a denial-of-service vulnerability in the device's web server functionality by sending a specially crafted HTTP r… |
CVE-2025-41652 | Critical | 9.8 | 2025-05-27 | The devices are vulnerable to an authentication bypass due to flaws in the authorization mechanism. An unauthenticated remote attacker could exploit this weakn… |
CVE-2025-41651 | Critical | 9.8 | 2025-05-27 | Due to missing authentication on a critical function of the devices an unauthenticated remote attacker can execute arbitrary commands, potentially enabling una… |
CVE-2025-41650 | High | 7.5 | 2025-05-27 | An unauthenticated remote attacker can exploit input validation in cmd services of the devices, allowing them to disrupt system operations and potentially caus… |
CVE-2025-41649 | High | 7.5 | 2025-05-27 | An unauthenticated remote attacker can exploit insufficient input validation to write data beyond the bounds of a buffer, potentially leading to a denial-of-se… |
CVE-2025-2407 | | 2025-05-27 | Missing Authentication & Authorization in Web-API in Mobatime AMX MTAPI v6 on IIS allows adversaries to unrestricted access via the network. The vulnerability… | |
CVE-2025-23393 | Medium | 5.2 | 2025-05-27 | A Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in spacewalk-java allows execution of arbitrary Javascript code… |
CVE-2025-5232 | Medium | 4.7 | 2025-05-27 | A vulnerability, which was classified as critical, has been found in PHPGurukul Student Study Center Management System 1.0. This issue affects some unknown pro… |
CVE-2025-5231 | High | 7.3 | 2025-05-27 | A vulnerability classified as critical was found in PHPGurukul Company Visitor Management System 1.0. This vulnerability affects unknown code of the file /forg… |
CVE-2025-48382 | Medium | 5.5 | 2025-05-27 | Fess is a deployable Enterprise Search Server. Prior to version 14.19.2, the createTempFile() method in org.codelibs.fess.helper.SystemHelper creates temporary… |
CVE-2025-48054 | | 2025-05-27 | Radashi is a TypeScript utility toolkit. Prior to version 12.5.1, the set function within the Radashi library is vulnerable to prototype pollution. If an attac… | |
CVE-2025-5230 | High | 7.3 | 2025-05-27 | A vulnerability classified as critical has been found in PHPGurukul Online Nurse Hiring System 1.0. This affects an unknown part of the file /admin/bwdates-rep… |
CVE-2025-5229 | High | 7.3 | 2025-05-27 | A vulnerability was found in Campcodes Online Hospital Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionali… |
CVE-2025-5228 | High | 8.8 | 2025-05-27 | A vulnerability was found in D-Link DI-8100 up to 20250523. It has been classified as critical. Affected is the function httpd_get_parm of the file /login.cgi… |
CVE-2025-5227 | High | 7.3 | 2025-05-27 | A vulnerability was found in PHPGurukul Small CRM 3.0 and classified as critical. This issue affects some unknown processing of the file /admin/manage-tickets… |
CVE-2025-48828 | Critical | 9.0 | 2025-05-27 | Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. By crafting template co… |
CVE-2025-48827 | Critical | 10.0 | 2025-05-27 | vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or late… |
CVE-2025-48742 | Medium | 5.4 | 2025-05-27 | The installer in SIGB PMB before and fixed in v.8.0.1.2 allows remote code execution. |
CVE-2025-26211 | Low | 3.7 | 2025-05-27 | Gibbon before 29.0.00 allows CSRF. |
CVE-2025-5226 | High | 7.3 | 2025-05-27 | A vulnerability has been found in PHPGurukul Small CRM 3.0 and classified as critical. This vulnerability affects unknown code of the file /admin/change-passwo… |
CVE-2025-5225 | High | 7.3 | 2025-05-27 | A vulnerability, which was classified as critical, was found in Campcodes Advanced Online Voting System 1.0. This affects an unknown part of the file /index.ph… |
CVE-2025-5224 | High | 7.3 | 2025-05-27 | A vulnerability classified as critical has been found in Campcodes Online Hospital Management System 1.0. Affected is an unknown function of the file /admin/ad… |
CVE-2025-5221 | High | 7.3 | 2025-05-27 | A vulnerability was found in FreeFloat FTP Server 1.0.0. It has been classified as critical. This affects an unknown part of the component QUOTE Command Handle… |
CVE-2025-4683 | Medium | 4.3 | 2025-05-27 | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabil… |
CVE-2025-4682 | Medium | 6.4 | 2025-05-27 | The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTML attribute… |
CVE-2025-48744 | Medium | 6.4 | 2025-05-27 | In SIGB PMB before 8.0.1.2, attackers can achieve Local File Inclusion and remote code execution. |
CVE-2025-48743 | Medium | 5.3 | 2025-05-27 | SIGB PMB before 8.0.1.2 allows SQL injection. |
CVE-2025-5220 | High | 7.3 | 2025-05-27 | A vulnerability was found in FreeFloat FTP Server 1.0.0 and classified as critical. Affected by this issue is some unknown functionality of the component GET C… |
CVE-2025-33079 | Medium | 6.5 | 2025-05-27 | IBM Controller 11.0.0, 11.0.1, and 11.1.0 application could allow an authenticated user to obtain sensitive credentials that may be inadvertently included with… |
CVE-2025-5219 | High | 7.3 | 2025-05-27 | A vulnerability has been found in FreeFloat FTP Server 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the comp… |
CVE-2025-5218 | High | 7.3 | 2025-05-27 | A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0.0. Affected is an unknown function of the component LITERAL Command Ha… |
CVE-2025-5217 | High | 7.3 | 2025-05-27 | A vulnerability, which was classified as critical, has been found in FreeFloat FTP Server 1.0.0. This issue affects some unknown processing of the component RM… |