2025 CVEs (page 319)
Page 319 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-40579 | Medium | 6.7 | 2025-05-13 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices are vulnerable to a stack-based buffer… |
CVE-2025-40578 | Medium | 4.3 | 2025-05-13 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions). Affected devices do not properly handle multiple incoming Profinet… |
CVE-2025-40577 | Medium | 4.3 | 2025-05-13 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly validate incoming Prof… |
CVE-2025-40576 | Medium | 4.3 | 2025-05-13 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly validate incoming Prof… |
CVE-2025-40575 | Medium | 4.3 | 2025-05-13 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly validate incoming Prof… |
CVE-2025-40574 | High | 7.8 | 2025-05-13 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly assign permissions to… |
CVE-2025-40573 | Medium | 4.4 | 2025-05-13 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices are vulnerable to path traversal attac… |
CVE-2025-40572 | Medium | 5.5 | 2025-05-13 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0 HF0). Affected devices do not properly assign permissions to… |
CVE-2025-40571 | Low | 2.2 | 2025-05-13 | A vulnerability has been identified in Mendix OIDC SSO (Mendix 10.12 compatible) (All versions < V4.0.1), Mendix OIDC SSO (Mendix 9 compatible) (All versions <… |
CVE-2025-40566 | High | 8.8 | 2025-05-13 | A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions < V4.1 Update 3), SIMATIC PCS neo V5.0 (All versions < V5.0 Update 1). Affected produ… |
CVE-2025-40556 | Medium | 6.5 | 2025-05-13 | A vulnerability has been identified in BACnet ATEC 550-440 (All versions), BACnet ATEC 550-441 (All versions), BACnet ATEC 550-445 (All versions), BACnet ATEC… |
CVE-2025-40555 | Medium | 4.7 | 2025-05-13 | A vulnerability has been identified in APOGEE PXC+TALON TC Series (BACnet) (All versions). Affected devices start sending unsolicited BACnet broadcast messages… |
CVE-2025-33025 | Critical | 9.9 | 2025-05-13 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (Al… |
CVE-2025-33024 | Critical | 9.9 | 2025-05-13 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (Al… |
CVE-2025-32469 | Critical | 9.9 | 2025-05-13 | A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < V2.16.5), RUGGEDCOM ROX MX5000RE (All versions < V2.16.5), RUGGEDCOM ROX RX1400 (Al… |
CVE-2025-32454 | High | 7.8 | 2025-05-13 | A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.14), Teamcenter Visualization V2312 (All versions < V2312.0010)… |
CVE-2025-31930 | High | 8.8 | 2025-05-13 | A vulnerability has been identified in IEC 1Ph 7.4kW Child socket (8EM1310-2EH04-0GA0) (All versions < V2.135), IEC 1Ph 7.4kW Child socket/ shutter (8EM1310-2E… |
CVE-2025-31929 | Medium | 4.2 | 2025-05-13 | A vulnerability has been identified in IEC 1Ph 7.4kW Child socket (8EM1310-2EH04-0GA0) (All versions), IEC 1Ph 7.4kW Child socket/ shutter (8EM1310-2EN04-0GA0)… |
CVE-2025-30176 | High | 7.5 | 2025-05-13 | A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions < V4.0), SINEMA Remote… |
CVE-2025-30175 | High | 7.5 | 2025-05-13 | A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions < V4.0), SINEMA Remote… |
CVE-2025-30174 | High | 7.5 | 2025-05-13 | A vulnerability has been identified in SIMATIC PCS neo V4.1 (All versions), SIMATIC PCS neo V5.0 (All versions), SINEC NMS (All versions < V4.0), SINEMA Remote… |
CVE-2025-26390 | Critical | 9.8 | 2025-05-13 | A vulnerability has been identified in OZW672 (All versions < V6.0), OZW772 (All versions < V6.0). The web service of affected devices is vulnerable to SQL inj… |
CVE-2025-26389 | Critical | 10.0 | 2025-05-13 | A vulnerability has been identified in OZW672 (All versions < V8.0), OZW772 (All versions < V8.0). The web service in affected devices does not sanitize the in… |
CVE-2025-24510 | Medium | 6.5 | 2025-05-13 | A vulnerability has been identified in MS/TP Point Pickup Module (All versions). Affected devices improperly handle specific incoming BACnet MSTP messages. Thi… |
CVE-2025-24009 | Medium | 5.9 | 2025-05-13 | A vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK2 (All versions). The affected devices d… |
CVE-2025-24008 | Medium | 6.5 | 2025-05-13 | A vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK2 (All versions). The affected devices d… |
CVE-2025-24007 | High | 7.5 | 2025-05-13 | A vulnerability has been identified in SIRIUS 3RK3 Modular Safety System (MSS) (All versions), SIRIUS Safety Relays 3SK2 (All versions). Affected devices only… |
CVE-2025-22248 | High | 7.5 | 2025-05-13 | The bitnami/pgpool Docker image, and the bitnami/postgres-ha k8s chart, under default configurations, comes with an 'repmgr' user that allows unauthenticated a… |
CVE-2025-41645 | High | 8.6 | 2025-05-13 | An unauthenticated remote attacker could use a demo account of the portal to hijack devices that were created in that account by mistake. |
CVE-2025-3916 | | 2025-05-13 | CWE-121: Stack-based Buffer Overflow vulnerability exists that could cause local attackers being able to exploit these issues to potentially execute arbitrary… | |
CVE-2025-27696 | High | 8.8 | 2025-05-13 | Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissio… |
CVE-2025-4474 | High | 8.8 | 2025-05-13 | The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the fed_admin_setting_form_function() fu… |
CVE-2025-4473 | High | 8.8 | 2025-05-13 | The Frontend Dashboard plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ajax_request() function in versions… |
CVE-2025-4339 | Medium | 4.3 | 2025-05-13 | The TheGem theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxApi() function in all versions u… |
CVE-2025-4317 | High | 8.8 | 2025-05-13 | The TheGem theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the thegem_get_logo_url() function in all version… |
CVE-2025-3107 | Medium | 6.5 | 2025-05-13 | The Newsletters plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby' parameter in all versions up to, and including, 4.9.9.8 due to… |
CVE-2025-4632 | Critical | 9.8 | 2025-05-13 | Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to write arbitr… |
CVE-2025-22249 | High | 8.2 | 2025-05-13 | VMware Aria automation contains a DOM based Cross-Site Scripting (XSS) vulnerability. A malicious actor may exploit this issue to steal the access token of a l… |
CVE-2025-22246 | Low | 3.0 | 2025-05-13 | Cloud Foundry UAA release versions from v77.21.0 to v7.31.0 are vulnerable to a private key exposure in logs. |
CVE-2025-4396 | High | 7.5 | 2025-05-13 | The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, a… |
CVE-2025-35471 | High | 7.3 | 2025-05-13 | conda-forge openssl-feedstock before 066e83c (2024-05-20), on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can be written to by no… |
CVE-2025-43011 | High | 7.7 | 2025-05-13 | Under certain conditions, SAP Landscape Transformation's PCL Basis module does not perform the necessary authorization checks, allowing authenticated users to… |
CVE-2025-43010 | High | 8.3 | 2025-05-13 | SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) allows an authenticated attacker with SAP standard authorization to execute a cer… |
CVE-2025-43009 | Medium | 6.3 | 2025-05-13 | SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This… |
CVE-2025-43008 | Medium | 5.8 | 2025-05-13 | Due to missing authorization check, an unauthorized user can view the files of other company. This might lead to disclosure of personal data of employees. Ther… |
CVE-2025-43007 | Medium | 6.3 | 2025-05-13 | SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This… |
CVE-2025-43006 | Medium | 6.1 | 2025-05-13 | SAP Supplier Relationship Management (Master Data Management Catalogue) allows an unauthenticated attacker to execute malicious scripts in the application, pot… |
CVE-2025-43005 | Medium | 4.3 | 2025-05-13 | SAP GUI for Windows allows an unauthenticated attacker to exploit insecure obfuscation algorithms used by the GuiXT application to store user credentials. Whil… |
CVE-2025-43004 | Medium | 5.3 | 2025-05-13 | Due to a security misconfiguration vulnerability, customers can develop Production Operator Dashboards (PODs) that enable outside users to access customer data… |
CVE-2025-43003 | Medium | 6.4 | 2025-05-13 | SAP S/4 HANA allows an authenticated attacker with user privileges to configure a field not intended for their access and create a custom UI layout displaying… |
CVE-2025-43002 | Medium | 4.3 | 2025-05-13 | SAP S4CORE OData meta-data property allows an authenticated attacker to access restricted information due to missing authorization check. This could cause a lo… |
CVE-2025-43000 | High | 7.9 | 2025-05-13 | Under certain conditions Promotion Management Wizard (PMW) allows an attacker to access information which would otherwise be restricted.This has High impact on… |
CVE-2025-42999 | Critical | 9.1 | 2025-05-13 | SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could… |
CVE-2025-42997 | Medium | 6.6 | 2025-05-13 | Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the pos… |
CVE-2025-31329 | Medium | 6.2 | 2025-05-13 | SAP NetWeaver is vulnerable to an Information Disclosure vulnerability caused by the injection of malicious instructions into user configuration settings. An a… |
CVE-2025-30018 | High | 8.6 | 2025-05-13 | The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) allows an unauthenticated attacker to submit an application servlet request with a craft… |
CVE-2025-30012 | Critical | 10.0 | 2025-05-13 | The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component, which allows an unauthenticated attacker to sen… |
CVE-2025-30011 | Medium | 5.3 | 2025-05-13 | The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an… |
CVE-2025-30010 | Medium | 6.1 | 2025-05-13 | The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an… |
CVE-2025-30009 | Medium | 6.1 | 2025-05-13 | he Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an… |
CVE-2025-26662 | Medium | 4.4 | 2025-05-13 | The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. When a targeted vict… |
CVE-2025-46825 | Medium | 5.4 | 2025-05-12 | Kanboard is project management software that focuses on the Kanban methodology. Versions 1.2.26 through 1.2.44 have a Stored Cross-Site Scripting (XSS) Vulnera… |
CVE-2025-31260 | Medium | 5.5 | 2025-05-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive user data. |
CVE-2025-31259 | High | 7.8 | 2025-05-12 | A privacy issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app ma… |
CVE-2025-31258 | Medium | 6.5 | 2025-05-12 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5. An app may be able to break out of its sandbox. |
CVE-2025-31257 | Medium | 4.7 | 2025-05-12 | This issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2… |
CVE-2025-31256 | Medium | 5.5 | 2025-05-12 | The issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.5. Hot corner may unexpectedly reveal a user’s deleted notes. |
CVE-2025-31253 | High | 7.1 | 2025-05-12 | This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5. Muting the microphone during a FaceTime call may n… |
CVE-2025-31251 | Medium | 5.5 | 2025-05-12 | The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7… |
CVE-2025-31250 | Medium | 5.5 | 2025-05-12 | An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive… |
CVE-2025-31249 | High | 7.1 | 2025-05-12 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive user data. |
CVE-2025-31247 | High | 7.5 | 2025-05-12 | A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An attacker m… |
CVE-2025-31246 | High | 8.8 | 2025-05-12 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6. Connecting to a malicious AFP server may… |
CVE-2025-31245 | Medium | 5.5 | 2025-05-12 | The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ve… |
CVE-2025-31244 | High | 8.8 | 2025-05-12 | A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.5. An app may be able to break out of its sandbox. |
CVE-2025-31242 | Medium | 5.5 | 2025-05-12 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequo… |
CVE-2025-31241 | Medium | 5.3 | 2025-05-12 | A double free issue was addressed with improved memory management. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS So… |
CVE-2025-31240 | High | 7.5 | 2025-05-12 | This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. Mounting a maliciously cra… |
CVE-2025-31239 | Medium | 4.3 | 2025-05-12 | A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS… |
CVE-2025-31238 | High | 7.3 | 2025-05-12 | The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchO… |
CVE-2025-31237 | High | 7.5 | 2025-05-12 | This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. Mounting a maliciously cra… |
CVE-2025-31236 | Medium | 5.5 | 2025-05-12 | An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive… |
CVE-2025-31235 | Medium | 6.5 | 2025-05-12 | A double free issue was addressed with improved memory management. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura… |
CVE-2025-31234 | High | 8.2 | 2025-05-12 | The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5. An atta… |
CVE-2025-31233 | Medium | 6.3 | 2025-05-12 | The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7… |
CVE-2025-31232 | High | 7.1 | 2025-05-12 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. A sandboxed app may be… |
CVE-2025-31228 | Medium | 6.8 | 2025-05-12 | The issue was addressed with improved authentication. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. An attacker with physical access to a dev… |
CVE-2025-31227 | Medium | 4.6 | 2025-05-12 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5. An attacker with physical access to a device may be able to… |
CVE-2025-31226 | Medium | 5.5 | 2025-05-12 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5… |
CVE-2025-31225 | High | 7.1 | 2025-05-12 | A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 18.5 and iPadOS 18.5. Call history from deleted apps may still appear in s… |
CVE-2025-31224 | High | 7.8 | 2025-05-12 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able to b… |
CVE-2025-31223 | High | 8.0 | 2025-05-12 | The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchO… |
CVE-2025-31222 | High | 7.8 | 2025-05-12 | A correctness issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura… |
CVE-2025-31221 | High | 7.5 | 2025-05-12 | An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Son… |
CVE-2025-31220 | Medium | 5.5 | 2025-05-12 | A privacy issue was addressed by removing sensitive data. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6… |
CVE-2025-31219 | High | 7.1 | 2025-05-12 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6… |
CVE-2025-31218 | Medium | 6.2 | 2025-05-12 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5. An app may be able to observe the hostnames of new network… |
CVE-2025-31217 | Medium | 6.5 | 2025-05-12 | The issue was addressed with improved input validation. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 1… |
CVE-2025-31215 | Medium | 6.5 | 2025-05-12 | The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visio… |
CVE-2025-31214 | High | 8.1 | 2025-05-12 | This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5. An attacker in a privileged network position may b… |