2025 CVEs (page 31)
Page 31 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-71186 | Medium | 5.5 | 2026-01-31 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: stm32: dmamux: fix device leak on route allocation Make sure to drop the refer… |
CVE-2025-71185 | Medium | 5.5 | 2026-01-31 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation Make sure to drop… |
CVE-2025-71184 | Medium | 5.5 | 2026-01-31 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix NULL dereference on root when tracing inode eviction When evicting an inode th… |
CVE-2025-71183 | Critical | 9.1 | 2026-01-31 | In the Linux kernel, the following vulnerability has been resolved: btrfs: always detect conflicting inodes when logging inode refs After rename exchanging (… |
CVE-2025-71182 | Medium | 5.5 | 2026-01-31 | In the Linux kernel, the following vulnerability has been resolved: can: j1939: make j1939_session_activate() fail if device is no longer registered syzbot i… |
CVE-2025-71181 | Medium | 5.5 | 2026-01-31 | In the Linux kernel, the following vulnerability has been resolved: rust_binder: remove spin_lock() in rust_shrink_free_page() When forward-porting Rust Bind… |
CVE-2025-71180 | Medium | 5.5 | 2026-01-31 | In the Linux kernel, the following vulnerability has been resolved: counter: interrupt-cnt: Drop IRQF_NO_THREAD flag An IRQ handler can either be IRQF_NO_THR… |
CVE-2025-15525 | Medium | 5.3 | 2026-01-31 | The Ajax Load More – Infinite Scroll, Load More, & Lazy Load plugin for WordPress is vulnerable to unauthorized access of data due to incorrect authorization o… |
CVE-2025-15510 | Medium | 5.3 | 2026-01-31 | The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the NF5_Export_Forms clas… |
CVE-2025-36442 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as the server may cr… |
CVE-2025-36428 | Medium | 5.3 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of se… |
CVE-2025-36427 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to insufficient validation of special ele… |
CVE-2025-36424 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to improper neutralization of special ele… |
CVE-2025-36423 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutral… |
CVE-2025-36407 | Medium | 6.5 | 2026-01-30 | IBM® Db2® is vulnerable to a denial of service with a specially crafted query that uses ALTER TABLE operations. |
CVE-2025-36387 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 could allow an authenticated user to cause a denial of service when given spe… |
CVE-2025-36384 | High | 8.4 | 2026-01-30 | IBM Db2 for Windows 12.1.0 - 12.1.3 could allow a local user with filesystem access to escalate their privileges due to the use of an unquoted search path ele… |
CVE-2025-36366 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service by executing a query that invokes the JSON_Ob… |
CVE-2025-36365 | Medium | 6.8 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage… |
CVE-2025-36353 | Medium | 6.2 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due… |
CVE-2025-36184 | High | 7.2 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 could allow an instance owner to execute malicious code that escalate their p… |
CVE-2025-36123 | Medium | 6.2 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service whe… |
CVE-2025-36098 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of se… |
CVE-2025-36070 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as a trap may occur… |
CVE-2025-36009 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service due to excessive use of a glob… |
CVE-2025-36001 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of se… |
CVE-2025-2668 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 is vulnerable to a denial of service as the server may crash when an authenti… |
CVE-2025-24293 | High | 8.1 | 2026-01-30 | # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation me… |
CVE-2025-11175 | | 2026-01-30 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in The Wikimedia Foundatio… | |
CVE-2025-69662 | High | 8.6 | 2026-01-30 | SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write G… |
CVE-2025-62349 | Medium | 6.2 | 2026-01-30 | Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using… |
CVE-2025-62348 | High | 7.8 | 2026-01-30 | Salt's junos execution module contained an unsafe YAML decode/load usage. A specially crafted YAML payload processed by the junos module could lead to unintend… |
CVE-2025-51958 | Critical | 9.8 | 2026-01-30 | aelsantex runcommand 2014-04-01, a plugin for DokuWiki, allows unauthenticated attackers to execute arbitrary system commands via lib/plugins/runcommand/postac… |
CVE-2025-15497 | | 2026-01-30 | Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resulting in a denial of se… | |
CVE-2025-7964 | | 2026-01-30 | After receiving a malformed 802.15.4 MAC Data Request the Zigbee Coordinator sends a ‘network leave’ request to Zigbee router resulting in the Zigbee Route… | |
CVE-2025-4686 | High | 8.6 | 2026-01-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kodmatic Computer Software Tourism Construction Industry… |
CVE-2025-9226 | Medium | 4.6 | 2026-01-30 | Zohocorp ManageEngine OpManager, NetFlow Analyzer, and OpUtils versions prior to 128582 are affected by a stored cross-site scripting vulnerability in the Subn… |
CVE-2025-6723 | | 2026-01-30 | Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere w… | |
CVE-2025-13176 | | 2026-01-30 | Planting a custom configuration file in ESET Inspect Connector allow load a malicious DLL. | |
CVE-2025-26385 | | 2026-01-30 | Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Success… | |
CVE-2025-1395 | High | 8.2 | 2026-01-30 | Generation of Error Message Containing Sensitive Information vulnerability in Codriapp Innovation and Software Technologies Inc. HeyGarson allows Fuzzing for a… |
CVE-2025-12899 | Medium | 6.5 | 2026-01-30 | A flaw in Zephyr’s network stack allows an IPv4 packet containing ICMP type 128 to be misclassified as an ICMPv6 Echo Request. This results in an out-of-bounds… |
CVE-2025-15322 | Medium | 4.3 | 2026-01-30 | Tanium addressed an improper access controls vulnerability in Tanium Server. |
CVE-2025-15288 | Low | 3.1 | 2026-01-29 | Tanium addressed an improper access controls vulnerability in Interact. |
CVE-2025-69929 | Critical | 9.8 | 2026-01-29 | An issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the client side using th… |
CVE-2025-69604 | High | 7.8 | 2026-01-29 | An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run… |
CVE-2025-69516 | High | 8.8 | 2026-01-29 | A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or e… |
CVE-2025-63658 | High | 7.5 | 2026-01-29 | A stack overflow in the mk_http_index_lookup function (mk_server/mk_http.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via se… |
CVE-2025-63657 | High | 7.5 | 2026-01-29 | An out-of-bounds read in the mk_mimetype_find function (mk_server/mk_mimetype.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) v… |
CVE-2025-63656 | High | 7.5 | 2026-01-29 | An out-of-bounds read in the header_cmp function (mk_server/mk_http_parser.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via… |
CVE-2025-63655 | High | 7.5 | 2026-01-29 | A NULL pointer dereference in the mk_http_range_parse function (mk_server/mk_http.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (Do… |
CVE-2025-63653 | High | 7.5 | 2026-01-29 | An out-of-bounds read in the mk_vhost_fdt_close function (mk_server/mk_vhost.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) vi… |
CVE-2025-63652 | High | 7.5 | 2026-01-29 | A use-after-free in the mk_http_request_end function (mk_server/mk_http.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via sen… |
CVE-2025-63651 | High | 7.5 | 2026-01-29 | A use-after-free in the mk_string_char_search function (mk_core/mk_string.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via s… |
CVE-2025-63650 | High | 7.5 | 2026-01-29 | An out-of-bounds read in the mk_ptr_to_buf in mk_core function (mk_memory.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via s… |
CVE-2025-63649 | High | 7.5 | 2026-01-29 | An out-of-bounds read in the http_parser_transfer_encoding_chunked function (mk_server/mk_http_parser.c) of monkey commit f37e984 allows attackers to cause a D… |
CVE-2025-15550 | Medium | 5.3 | 2026-01-29 | birkir prime <= 0.4.0.beta.0 contains a cross-site request forgery vulnerability in its GraphQL endpoint that allows attackers to exploit GET-based query reque… |
CVE-2025-15549 | Medium | 4.8 | 2026-01-29 | FluentCMS 2026 contains a stored cross-site scripting vulnerability that allows authenticated administrators to upload SVG files with embedded JavaScript via t… |
CVE-2025-69749 | Medium | 6.1 | 2026-01-29 | Cross Site Scripting vulnerability in tale v.2.0.5 allows an attacker to execute arbitrary code. |
CVE-2025-15548 | Medium | 6.5 | 2026-01-29 | Some VX800v v1.0 web interface endpoints transmit sensitive information over unencrypted HTTP due to missing application layer encryption, allowing a network a… |
CVE-2025-15543 | Medium | 4.6 | 2026-01-29 | Improper link resolution in USB HTTP access path in VX800v v1.0 allows a crafted USB device to expose root filesystem contents, giving an attacker with physica… |
CVE-2025-15542 | Medium | 5.3 | 2026-01-29 | Improper handling of exceptional conditions in VX800v v1.0 in SIP processing allows an attacker to flood the device with crafted INVITE messages, blocking all… |
CVE-2025-15541 | Medium | 6.3 | 2026-01-29 | Improper link resolution in the VX800v v1.0 SFTP service allows authenticated adjacent attackers to use crafted symbolic links to access system files, resultin… |
CVE-2025-13399 | High | 8.8 | 2026-01-29 | A weakness in the web interface’s application layer encryption in VX800v v1.0 allows an adjacent attacker to brute force the weak AES key and decrypt intercept… |
CVE-2025-45160 | Medium | 5.4 | 2026-01-29 | A HTML injection vulnerability exists in the file upload functionality of Cacti <= 1.2.29. When a file with an invalid format is uploaded, the application refl… |
CVE-2025-15545 | Medium | 6.8 | 2026-01-29 | The backup restore function does not properly validate unexpected or unrecognized tags within the backup file. When such a crafted file is restored, the inject… |
CVE-2025-71011 | Medium | 6.2 | 2026-01-29 | An input validation vulnerability in the flow.Tensor.new_empty/flow.Tensor.new_ones/flow.Tensor.new_zeros component of OneFlow v0.9.0 allows attackers to cause… |
CVE-2025-62514 | High | 8.3 | 2026-01-29 | Parsec is a cloud-based application for cryptographically secure file sharing. In versions on the 3.x branch prior to 3.6.0, `libparsec_crypto`, a component of… |
CVE-2025-13905 | | 2026-01-29 | CWE-276: Incorrect Default Permissions vulnerability exists that could cause privilege escalation through the reverse shell when one or more executable servi… | |
CVE-2025-7714 | High | 7.5 | 2026-01-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Global Interactive Design Media Software Inc. Content Man… |
CVE-2025-7713 | High | 7.5 | 2026-01-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Global Interactive Design Media Software Inc. Cont… |
CVE-2025-71009 | Medium | 6.2 | 2026-01-29 | An input validation vulnerability in the flow.scatter/flow.scatter_add component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a cr… |
CVE-2025-71008 | Medium | 6.2 | 2026-01-29 | A segmentation violation in the oneflow._oneflow_internal.autograd.Function.FunctionCtx.mark_non_differentiable component of OneFlow v0.9.0 allows attackers to… |
CVE-2025-7014 | Medium | 5.7 | 2026-01-29 | Session Fixation vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Session Hijacking. This issue affects Menu Panel: through 29012026. NOTE… |
CVE-2025-7013 | Medium | 5.7 | 2026-01-29 | Authorization Bypass Through User-Controlled Key vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Exploitation of Trusted Identifiers. This i… |
CVE-2025-7016 | High | 8.0 | 2026-01-29 | Improper Access Control vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Authentication Abuse. This issue affects… |
CVE-2025-7015 | Medium | 5.7 | 2026-01-29 | Session Fixation vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Session Fixation. This issue affects QR Menu: be… |
CVE-2025-14975 | High | 8.1 | 2026-01-29 | The Custom Login Page Customizer WordPress plugin before 2.5.4 does not have a proper password reset process, allowing a few unauthenticated requests to reset… |
CVE-2025-55704 | Medium | 5.3 | 2026-01-29 | Hidden functionality issue exists in multiple MFPs provided by Brother Industries, Ltd., which may allow an attacker to obtain the logs of the affected product… |
CVE-2025-53869 | Low | 3.7 | 2026-01-29 | Multiple MFPs provided by Brother Industries, Ltd. does not properly validate server certificates, which may allow a man-in-the-middle attacker to replace the… |
CVE-2025-15344 | Medium | 6.3 | 2026-01-29 | Tanium addressed a SQL injection vulnerability in Asset. |
CVE-2025-71007 | High | 7.5 | 2026-01-28 | An input validation vulnerability in the oneflow.index_add component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-71006 | Medium | 6.5 | 2026-01-28 | A floating point exception (FPE) in the oneflow.reshape component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-71005 | Medium | 6.5 | 2026-01-28 | A floating point exception (FPE) in the oneflow.view component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-71004 | Medium | 6.5 | 2026-01-28 | A segmentation violation in the oneflow.logical_or component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-71003 | High | 7.5 | 2026-01-28 | An input validation vulnerability in the flow.arange() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-71002 | Medium | 6.5 | 2026-01-28 | A floating-point exception (FPE) in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-69289 | Medium | 5.4 | 2026-01-28 | Discourse is an open source discussion platform. A privilege escalation vulnerability in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 allows a n… |
CVE-2025-69218 | Medium | 6.5 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, moderators can access the `top_uploads` admin… |
CVE-2025-68934 | Medium | 6.5 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, authenticated users can submit crafted payload… |
CVE-2025-68933 | Medium | 6.9 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators with the `moderators_chan… |
CVE-2025-68666 | Medium | 6.5 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, users archives are viewable by users with mode… |
CVE-2025-68662 | High | 7.6 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, a hostname validation issue in FinalDestinatio… |
CVE-2025-68119 | High | 7.0 | 2026-01-28 | Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules f… |
CVE-2025-61731 | High | 7.8 | 2026-01-28 | Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config… |
CVE-2025-61730 | Medium | 5.3 | 2026-01-28 | During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extens… |
CVE-2025-61728 | Medium | 6.5 | 2026-01-28 | archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of servic… |
CVE-2025-61726 | High | 7.5 | 2026-01-28 | The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited… |
CVE-2025-46691 | High | 7.8 | 2026-01-28 | Dell PremierColor Panel Driver, versions prior to 1.0.0.1 A01, contains an Improper Access Control vulnerability. A low privileged attacker with local access c… |
CVE-2025-14840 | High | 7.5 | 2026-01-28 | Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal HTTP Client Manager allows Forceful Browsing.This issue affects HTTP Client Manage… |