2025 CVEs (page 308)
Page 308 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4803 | High | 7.2 | 2025-05-21 | The Glossary by WPPedia – Best Glossary plugin for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1… |
CVE-2025-4611 | Medium | 6.4 | 2025-05-21 | The Slim SEO – Fast & Automated WordPress SEO Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's slim_seo_breadcrumbs sh… |
CVE-2025-4221 | Medium | 6.4 | 2025-05-21 | The Animated Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'auto-downloader' shortcode in all versions up to, and… |
CVE-2025-4219 | Medium | 6.4 | 2025-05-21 | The DPEPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dpe' shortcode in all versions up to, and including, 0.3 due t… |
CVE-2025-4217 | Medium | 6.4 | 2025-05-21 | The WP YouTube Video Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ib_youtube' shortcode in all versions up to… |
CVE-2025-4105 | Medium | 5.4 | 2025-05-21 | The Splitit plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on several functions in the 'splitIt-flexf… |
CVE-2025-48414 | Medium | 6.5 | 2025-05-21 | There are several scripts in the web interface that are accessible via undocumented hard-coded credentials. The scripts provide access to additional administra… |
CVE-2025-48413 | High | 7.7 | 2025-05-21 | The `/etc/passwd` and `/etc/shadow` files reveal hard-coded password hashes for the operating system "root" user. The credentials are shipped with the update f… |
CVE-2025-41232 | Critical | 9.1 | 2025-05-21 | Spring Security Aspects may not correctly locate method security annotations on private methods. This can cause an authorization bypass. Your application may… |
CVE-2025-3781 | Medium | 6.4 | 2025-05-21 | The Raisely Donation Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's raisely_donation_form shortcode in all versions up… |
CVE-2025-3750 | Medium | 6.4 | 2025-05-21 | The Network Posts Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘post_height’ parameter in all versions up to, and includi… |
CVE-2025-27804 | Medium | 6.5 | 2025-05-21 | Several OS command injection vulnerabilities exist in the device firmware in the /var/salia/mqtt.php script. By publishing a specially crafted message to a cer… |
CVE-2025-27803 | Medium | 6.5 | 2025-05-21 | The devices do not implement any authentication for the web interface or the MQTT server. An attacker who has network access to the device immediately gets adm… |
CVE-2025-1415 | | 2025-05-21 | A low-privileged user is able to obtain information about tasks executed on devices controlled by Proget MDM (Mobile Device Management), as well as details of… | |
CVE-2025-1712 | High | 8.8 | 2025-05-21 | Argument injection in special agent configuration in Checkmk <2.4.0p1, <2.3.0p32, <2.2.0p42 and 2.1.0 allows authenticated attackers to write arbitrary files |
CVE-2025-4949 | Medium | 5.3 | 2025-05-21 | In Eclipse JGit versions 7.2.0.202503040940-r and older, the ManifestParser class used by the repo command and the AmazonS3 class used to implement the experim… |
CVE-2025-4524 | Critical | 9.8 | 2025-05-21 | The Madara – Responsive and modern WordPress theme for manga sites theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and includi… |
CVE-2025-5013 | Medium | 4.3 | 2025-05-21 | A vulnerability, which was classified as problematic, was found in HkCms up to 2.3.2.240702. This affects an unknown part of the file /index.php/search/index.h… |
CVE-2025-4969 | Medium | 6.5 | 2025-05-21 | A vulnerability was found in the libsoup package. This flaw stems from its failure to correctly verify the termination of multipart HTTP messages. This can all… |
CVE-2025-4094 | Critical | 9.8 | 2025-05-21 | The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightforward for… |
CVE-2025-5011 | Low | 2.4 | 2025-05-21 | A vulnerability classified as problematic was found in moonlightL hexo-boot 4.3.0. This vulnerability affects unknown code of the file /admin/home/index.html o… |
CVE-2025-5010 | Low | 2.4 | 2025-05-21 | A vulnerability classified as problematic has been found in moonlightL hexo-boot 4.3.0. This affects an unknown part of the file /admin/home/index.html of the… |
CVE-2025-5008 | High | 7.3 | 2025-05-20 | A vulnerability was found in projectworlds Online Time Table Generator 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2025-5007 | Low | 3.5 | 2025-05-20 | A vulnerability was found in Part-DB up to 1.17.0. It has been declared as problematic. Affected by this vulnerability is the function handleUpload of the file… |
CVE-2025-5006 | High | 7.3 | 2025-05-20 | A vulnerability was found in Campcodes Online Shopping Portal 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/categ… |
CVE-2025-5004 | High | 7.3 | 2025-05-20 | A vulnerability was found in projectworlds Online Time Table Generator 1.0 and classified as critical. This issue affects some unknown processing of the file /… |
CVE-2025-5003 | High | 7.3 | 2025-05-20 | A vulnerability has been found in projectworlds Online Time Table Generator 1.0 and classified as critical. This vulnerability affects unknown code of the file… |
CVE-2025-5002 | High | 7.3 | 2025-05-20 | A vulnerability, which was classified as critical, was found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file… |
CVE-2025-5001 | Low | 3.3 | 2025-05-20 | A vulnerability was found in GNU PSPP 82fb509fb2fedd33e7ac0c46ca99e108bb3bdffb. It has been declared as problematic. This vulnerability affects the function ca… |
CVE-2025-5000 | Medium | 6.3 | 2025-05-20 | A vulnerability was found in Linksys FGW3000-AH and FGW3000-HK up to 1.0.17.000000. It has been classified as critical. This affects the function control_panel… |
CVE-2025-4999 | Medium | 6.3 | 2025-05-20 | A vulnerability was found in Linksys FGW3000-AH and FGW3000-HK up to 1.0.17.000000 and classified as critical. Affected by this issue is the function sub_4153F… |
CVE-2025-4998 | Medium | 6.5 | 2025-05-20 | A vulnerability has been found in H3C Magic R200G up to 100R002 and classified as problematic. Affected by this vulnerability is the function Edit_BasicSSID/Ed… |
CVE-2025-44898 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the theauthName parameter in the web_aaa_loginAuthlistEdit function. |
CVE-2025-44897 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the bytftp_srvip parameter in the web_tool_upgradeManager_post function. |
CVE-2025-44896 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the bindEditMACName parameter in the web_acl_bindEdit_post function. |
CVE-2025-44894 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the radDftParamKey parameter in the web_radiusSrv_dftParam_post function. |
CVE-2025-44891 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the host_ip parameter in the web_snmp_v3host_add_post function. |
CVE-2025-44883 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the tacIp parameter in the web_tacplus_serverEdit_post function. |
CVE-2025-44882 | Critical | 9.8 | 2025-05-20 | A command injection vulnerability in the component /cgi-bin/firewall.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafte… |
CVE-2025-44880 | Critical | 9.8 | 2025-05-20 | A command injection vulnerability in the component /cgi-bin/adm.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted inp… |
CVE-2025-4997 | Medium | 6.5 | 2025-05-20 | A vulnerability, which was classified as problematic, was found in H3C R2+ProG up to 200R004. Affected is the function UpdateWanParams/AddMacList/EditMacList/A… |
CVE-2025-48056 | Medium | 5.3 | 2025-05-20 | Hubble is a fully distributed networking and security observability platform for cloud native workloads. Prior to version 1.17.2, a network attacker could inje… |
CVE-2025-44893 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the ruleNamekey parameter in the web_acl_mgmt_Rules_Apply_post function. |
CVE-2025-44890 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the host_ip parameter in the web_snmp_notifyv3_add_post function. |
CVE-2025-44888 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the stp_conf_name parameter in the web_stp_globalSetting_post function. |
CVE-2025-44887 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the radIpkey parameter in the web_radiusSrv_post function. |
CVE-2025-44886 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the byruleEditName parameter in the web_acl_mgmt_Rules_Edit_postcontains function. |
CVE-2025-44885 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the remote_ip parameter in the web_snmpv3_remote_engineId_add_post function. |
CVE-2025-44884 | Critical | 9.8 | 2025-05-20 | FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the web_sys_infoContact_post function. |
CVE-2025-44881 | Critical | 9.8 | 2025-05-20 | A command injection vulnerability in the component /cgi-bin/qos.cgi of Wavlink WL-WN579A3 v1.0 allows attackers to execute arbitrary commands via a crafted inp… |
CVE-2025-4996 | Low | 2.4 | 2025-05-20 | A vulnerability, which was classified as problematic, has been found in Intelbras RF 301K 1.1.5. This issue affects some unknown processing of the component Ad… |
CVE-2025-47290 | Medium | 5.9 | 2025-05-20 | containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an ima… |
CVE-2025-4364 | | 2025-05-20 | The affected products could allow an unauthenticated attacker to access system information that could enable further access to sensitive files and obtain admin… | |
CVE-2025-48391 | High | 7.7 | 2025-05-20 | In JetBrains YouTrack before 2025.1.76253 deletion of issues was possible due to missing permission checks in API |
CVE-2025-47854 | Medium | 4.3 | 2025-05-20 | In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page |
CVE-2025-47853 | Medium | 4.8 | 2025-05-20 | In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible |
CVE-2025-47852 | Medium | 4.8 | 2025-05-20 | In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible |
CVE-2025-47851 | Medium | 4.8 | 2025-05-20 | In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible |
CVE-2025-47850 | Medium | 4.3 | 2025-05-20 | In JetBrains YouTrack before 2025.1.74704 restricted attachments could become visible after issue cloning |
CVE-2025-47277 | Critical | 9.8 | 2025-05-20 | vLLM, an inference and serving engine for large language models (LLMs), has an issue in versions 0.6.5 through 0.8.4 that ONLY impacts environments using the `… |
CVE-2025-46725 | Critical | 9.8 | 2025-05-20 | Langroid is a Python framework to build large language model (LLM)-powered applications. Prior to version 0.53.15, `LanceDocChatAgent` uses pandas eval() throu… |
CVE-2025-46724 | Critical | 9.8 | 2025-05-20 | Langroid is a Python framework to build large language model (LLM)-powered applications. Prior to version 0.53.15, `TableChatAgent` uses `pandas eval()`. If fe… |
CVE-2025-37991 | High | 7.8 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: parisc: Fix double SIGFPE crash Camm noticed that on parisc a SIGFPE exception will crash… |
CVE-2025-37990 | Medium | 5.5 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() The function brcm… |
CVE-2025-37989 | Medium | 5.5 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: net: phy: leds: fix memory leak A network restart test on a router led to an out-of-memor… |
CVE-2025-37988 | High | 7.8 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: fix a couple of races in MNT_TREE_BENEATH handling by do_move_mount() Normally do_lock_mo… |
CVE-2025-37987 | Medium | 5.5 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: pds_core: Prevent possible adminq overflow/stuck condition The pds_core's adminq is prote… |
CVE-2025-37986 | Medium | 5.5 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: class: Invalidate USB device pointers on partner unregistration To avoid usin… |
CVE-2025-37985 | Medium | 4.7 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: USB: wdm: close race between wdm_open and wdm_wwan_port_stop Clearing WDM_WWAN_IN_USE mus… |
CVE-2025-37984 | High | 7.0 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: crypto: ecdsa - Harden against integer overflows in DIV_ROUND_UP() Herbert notes that DIV… |
CVE-2025-37983 | Medium | 5.5 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: qibfs: fix _another_ leak failure to allocate inode => leaked dentry... this one had bee… |
CVE-2025-22157 | High | 8.8 | 2025-05-20 | This High severity PrivEsc (Privilege Escalation) vulnerability was introduced in versions: 9.12.0, 10.3.0, 10.4.0, and 10.5.0 of Jira Core Data Center and Se… |
CVE-2025-44084 | Critical | 9.8 | 2025-05-20 | D-link DI-8100 16.07.26A1 is vulnerable to Command Injection. An attacker can exploit this vulnerability by crafting specific HTTP requests, triggering the com… |
CVE-2025-37982 | Medium | 5.5 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: wifi: wl1251: fix memory leak in wl1251_tx_work The skb dequeued from tx_queue is lost wh… |
CVE-2025-37981 | High | 7.8 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Use is_kdump_kernel() to check for kdump The smartpqi driver checks the r… |
CVE-2025-37980 | Medium | 5.5 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: block: fix resource leak in blk_register_queue() error path When registering a queue fail… |
CVE-2025-37979 | High | 7.8 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: Fix sc7280 lpass potential buffer overflow Case values introduced in commit 5… |
CVE-2025-37978 | Medium | 5.5 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: block: integrity: Do not call set_page_dirty_lock() Placing multiple protection informati… |
CVE-2025-37977 | High | 7.8 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: exynos: Disable iocc if dma-coherent property isn't set If dma-coherent proper… |
CVE-2025-37975 | High | 7.1 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: riscv: module: Fix out-of-bounds relocation access The current code allows rel[j] to acce… |
CVE-2025-37974 | Medium | 5.5 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix missing check for zpci_create_device() error return The zpci_create_device(… |
CVE-2025-37973 | High | 8.1 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: fix out-of-bounds access during multi-link element defragmentation Curren… |
CVE-2025-37972 | Medium | 5.5 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: Input: mtk-pmic-keys - fix possible null pointer dereference In mtk_pmic_keys_probe, the… |
CVE-2025-37971 | Medium | 5.5 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: staging: bcm2835-camera: Initialise dev in v4l2_dev Commit 42a2f6664e18 ("staging: vc04_s… |
CVE-2025-37970 | Medium | 5.5 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_fifo Prevent st_lsm6dsx_read… |
CVE-2025-37969 | Medium | 5.5 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: iio: imu: st_lsm6dsx: fix possible lockup in st_lsm6dsx_read_tagged_fifo Prevent st_lsm6d… |
CVE-2025-37968 | Medium | 5.5 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: iio: light: opt3001: fix deadlock due to concurrent flag access The threaded IRQ function… |
CVE-2025-37967 | Medium | 5.5 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: displayport: Fix deadlock This patch introduces the ucsi_con_mutex_lock… |
CVE-2025-37966 | Medium | 5.5 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: riscv: Fix kernel crash due to PR_SET_TAGGED_ADDR_CTRL When userspace does PR_SET_TAGGED_… |
CVE-2025-37965 | Medium | 5.5 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix invalid context error in dml helper [Why] "BUG: sleeping function ca… |
CVE-2025-48018 | High | 7.5 | 2025-05-20 | An authenticated user can modify application state data. |
CVE-2025-48017 | Critical | 9.0 | 2025-05-20 | Improper limitation of pathname in Circuit Provisioning and File Import applications allows modification and uploading of files |
CVE-2025-48016 | Medium | 4.3 | 2025-05-20 | OpenFlow discovery protocol can exhaust resources because it is not rate limited |
CVE-2025-48015 | Low | 3.7 | 2025-05-20 | Failed login response could be different depending on whether the username was local or central. |
CVE-2025-48014 | High | 7.5 | 2025-05-20 | Password guessing limits could be bypassed when using LDAP authentication. |
CVE-2025-37964 | High | 7.8 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: x86/mm: Eliminate window where TLB flushes may be inadvertently skipped tl;dr: There is a… |
CVE-2025-37963 | Medium | 5.5 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users Support for eBPF pro… |
CVE-2025-37962 | Medium | 5.5 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix memory leak in parse_lease_state() The previous patch that added bounds check… |
CVE-2025-37961 | Medium | 5.5 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: ipvs: fix uninit-value for saddr in do_output_route4 syzbot reports for uninit-value for… |
CVE-2025-37960 | Medium | 5.5 | 2025-05-20 | In the Linux kernel, the following vulnerability has been resolved: memblock: Accept allocated memory before use in memblock_double_array() When increasing t… |