2025 CVEs (page 32)
Page 32 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-61650 | | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability… | |
CVE-2025-61649 | | 2026-02-03 | Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/Services/CheckUserUserInfoCardService.Php. This issue… | |
CVE-2025-61648 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation CheckUser. This vulnerability… |
CVE-2025-61646 | Medium | 5.4 | 2026-02-03 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/RecentChanges/EnhancedChangesList.Php. This issu… |
CVE-2025-61645 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-15556 | High | 7.5 | 2026-02-03 | Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metadata and i… |
CVE-2025-12773 | Medium | 6.5 | 2026-02-03 | A vulnerability in update-reports-purge-settings.sh script logging for Brocade SANnav before 2.4.0a could allow the collection of SANnav database password in t… |
CVE-2025-11261 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-11173 | | 2026-02-03 | Vulnerability in Wikimedia Foundation OATHAuth. This vulnerability is associated with program files src/Special/OATHManage.Php. This issue affects OATHAuth: f… | |
CVE-2025-61647 | | 2026-02-03 | Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/Api/Rest/Handler/UserInfoHandler.Php. This issue affe… | |
CVE-2025-61644 | | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… | |
CVE-2025-61643 | Medium | 6.1 | 2026-02-03 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/recentchanges/RecentChangeRCFeedNotifier.Php. Th… |
CVE-2025-61642 | Medium | 6.1 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-61641 | Medium | 6.1 | 2026-02-03 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiQueryAllPages.Php. This issue affects Med… |
CVE-2025-61640 | Medium | 4.8 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-61639 | Medium | 4.8 | 2026-02-03 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files… |
CVE-2025-61638 | Medium | 4.8 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundati… |
CVE-2025-61637 | Medium | 4.8 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-61636 | Medium | 4.8 | 2026-02-03 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-61635 | | 2026-02-03 | Vulnerability in Wikimedia Foundation ConfirmEdit. This vulnerability is associated with program files includes/FancyCaptcha/ApiFancyCaptchaReload.Php. This i… | |
CVE-2025-61634 | Low | 3.1 | 2026-02-03 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Rest/Handler/PageHTMLHandler.Php. This issue aff… |
CVE-2025-70960 | Medium | 5.4 | 2026-02-02 | A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via in… |
CVE-2025-70959 | Medium | 5.4 | 2026-02-02 | A stored cross-site scripting (XSS) vulnerability in the Jobs module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via inje… |
CVE-2025-70958 | Medium | 6.1 | 2026-02-02 | Multiple reflected cross-site scripting (XSS) vulnerabilities in the installation module of Subrion CMS v4.2.1 allows attackers to execute arbitrary Javascript… |
CVE-2025-6927 | | 2026-02-02 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php, includes/api/… | |
CVE-2025-6597 | | 2026-02-02 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects MediaWi… | |
CVE-2025-6596 | | 2026-02-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is… | |
CVE-2025-6595 | Medium | 4.7 | 2026-02-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MultimediaViewer.This issue a… |
CVE-2025-6594 | Medium | 4.7 | 2026-02-02 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability… |
CVE-2025-6593 | | 2026-02-02 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/user/User.Php. This issue affects MediaWiki: fro… | |
CVE-2025-6592 | | 2026-02-02 | Vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/auth/AuthManager.Php. This issue affects Abuse… | |
CVE-2025-6591 | | 2026-02-02 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/api/ApiFeedContributions.Php. This issue affects… | |
CVE-2025-6590 | | 2026-02-02 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files… | |
CVE-2025-6589 | | 2026-02-02 | Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/specials/pagers/BlockListPager.Php. This issue a… | |
CVE-2025-69207 | Medium | 5.4 | 2026-02-02 | Khoj is a self-hostable artificial intelligence app. Prior to 2.0.0-beta.23, an IDOR in the Notion OAuth callback allows an attacker to hijack any user's Notio… |
CVE-2025-66480 | Critical | 9.8 | 2026-02-02 | Wildfire IM is an instant messaging and real-time audio/video solution. Prior to 1.4.3, a critical vulnerability exists in the im-server component related to t… |
CVE-2025-36436 | Medium | 6.4 | 2026-02-02 | IBM Cloud Pak for Business Automation 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix 007 … |
CVE-2025-36253 | Medium | 5.9 | 2026-02-02 | IBM Concert 1.0.0 through 2.1.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. |
CVE-2025-36238 | Medium | 6.0 | 2026-02-02 | IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 could allow a local user with administration pri… |
CVE-2025-36194 | Low | 2.8 | 2026-02-02 | IBM PowerVM Hypervisor FW1110.00 through FW1110.03, FW1060.00 through FW1060.51, and FW950.00 through FW950.F0 may expose a limited amount of data to a peer pa… |
CVE-2025-13096 | High | 7.1 | 2026-02-02 | IBM Business Automation Workflow containers V25.0.0 through V25.0.0-IF007, V24.0.1 - V24.0.1-IF007, V24.0.0 - V24.0.0-IF007 and IBM Business Automation Workflo… |
CVE-2025-12772 | Medium | 4.9 | 2026-02-02 | Brocade SANnav before 2.4.0b logs the Brocade Fabric OS Switch admin password on the SANnav support save logs. When OOM occurs on a Brocade SANnav server, the… |
CVE-2025-12680 | Medium | 4.9 | 2026-02-02 | Brocade SANnav before Brocade SANnav 2.4.0b logs database passwords in clear text in the standby SANnav server, after disaster recovery failover. The vulnerab… |
CVE-2025-12679 | Medium | 6.5 | 2026-02-02 | A vulnerability in Brocade SANnav before 2.4.0b prints the Password-Based Encryption (PBE) key in plaintext in the system audit log file. The vulnerability c… |
CVE-2025-47402 | Medium | 6.5 | 2026-02-02 | Transient DOS when processing a received frame with an excessively large authentication information element. |
CVE-2025-47399 | High | 7.8 | 2026-02-02 | Memory Corruption while processing IOCTL call to update sensor property settings with invalid input parameters. |
CVE-2025-47398 | High | 7.8 | 2026-02-02 | Memory Corruption while deallocating graphics processing unit memory buffers due to improper handling of memory pointers. |
CVE-2025-47397 | High | 7.8 | 2026-02-02 | Memory Corruption when initiating GPU memory mapping using scatter-gather lists due to unchecked IOMMU mapping errors. |
CVE-2025-47366 | High | 7.1 | 2026-02-02 | Cryptographic issue when a Trusted Zone with outdated code is triggered by a HLOS providing incorrect input. |
CVE-2025-47364 | Medium | 6.8 | 2026-02-02 | Memory corruption while calculating offset from partition start point. |
CVE-2025-47363 | Medium | 6.8 | 2026-02-02 | Memory corruption when calculating oversized partition sizes without proper checks. |
CVE-2025-47359 | High | 7.8 | 2026-02-02 | Memory Corruption when multiple threads simultaneously access a memory free API. |
CVE-2025-47358 | High | 7.8 | 2026-02-02 | Memory Corruption when user space address is modified and passed to mem_free API, causing kernel memory to be freed inadvertently. |
CVE-2025-15395 | Medium | 4.3 | 2026-02-02 | IBM Jazz Foundation 7.0.3 through 7.0.3 iFix019 and 7.1.0 through 7.1.0 iFix005 is vulnerable to access control violations that allows the users to view or acc… |
CVE-2025-14914 | High | 7.6 | 2026-02-02 | IBM WebSphere Application Server Liberty 17.0.0.3 through 26.0.0.1 could allow a privileged user to upload a zip archive containing path traversal sequences re… |
CVE-2025-8587 | High | 8.6 | 2026-02-02 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AKCE Software Technology R&D Industry and Trade Inc. SKSP… |
CVE-2025-7105 | Medium | 5.7 | 2026-02-02 | A vulnerability in danny-avila/librechat allows attackers to exploit the unrestricted Fork Function in `/api/convos/fork` to fork numerous contents rapidly. If… |
CVE-2025-6208 | Medium | 5.3 | 2026-02-02 | The `SimpleDirectoryReader` component in `llama_index.core` version 0.12.23 suffers from uncontrolled memory consumption due to a resource management flaw. The… |
CVE-2025-10279 | High | 7.0 | 2026-02-02 | In mlflow version 2.20.3, the temporary directory used for creating Python virtual environments is assigned insecure world-writable permissions (0o777). This v… |
CVE-2025-9974 | High | 8.0 | 2026-02-02 | The unified WEBUI application of the ONT/Beacon device contains an input handling flaw that allows authenticated users to trigger unintended system-level comma… |
CVE-2025-15396 | High | 7.1 | 2026-02-02 | The Library Viewer WordPress plugin before 3.2.0 does not sanitise and escape some parameters before outputting them back in the page, leading to a Reflected C… |
CVE-2025-15030 | Critical | 9.8 | 2026-02-02 | The User Profile Builder WordPress plugin before 3.15.2 does not have a proper password reset process, allowing a few unauthenticated requests to reset the pa… |
CVE-2025-13881 | Low | 2.7 | 2026-02-02 | A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unm… |
CVE-2025-13348 | | 2026-02-02 | An improper access control vulnerability exists in ASUS Secure Delete Driver of ASUS Business Manager. This vulnerability can be triggered by a local user send… | |
CVE-2025-14554 | High | 7.2 | 2026-01-31 | The Sell BTC - Cryptocurrency Selling Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'orderform_data' AJAX action in all… |
CVE-2025-71191 | Medium | 5.5 | 2026-01-31 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: at_hdmac: fix device leak on of_dma_xlate() Make sure to drop the reference ta… |
CVE-2025-71190 | Medium | 5.5 | 2026-01-31 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: bcm-sba-raid: fix device leak on probe Make sure to drop the reference taken w… |
CVE-2025-71189 | Medium | 5.5 | 2026-01-31 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw: dmamux: fix OF node leak on route allocation failure Make sure to drop the… |
CVE-2025-71188 | Medium | 5.5 | 2026-01-31 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: lpc18xx-dmamux: fix device leak on route allocation Make sure to drop the refe… |
CVE-2025-71187 | Medium | 5.5 | 2026-01-31 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: sh: rz-dmac: fix device leak on probe failure Make sure to drop the reference… |
CVE-2025-71186 | Medium | 5.5 | 2026-01-31 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: stm32: dmamux: fix device leak on route allocation Make sure to drop the refer… |
CVE-2025-71185 | Medium | 5.5 | 2026-01-31 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation Make sure to drop… |
CVE-2025-71184 | Medium | 5.5 | 2026-01-31 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix NULL dereference on root when tracing inode eviction When evicting an inode th… |
CVE-2025-71183 | Critical | 9.1 | 2026-01-31 | In the Linux kernel, the following vulnerability has been resolved: btrfs: always detect conflicting inodes when logging inode refs After rename exchanging (… |
CVE-2025-71182 | Medium | 5.5 | 2026-01-31 | In the Linux kernel, the following vulnerability has been resolved: can: j1939: make j1939_session_activate() fail if device is no longer registered syzbot i… |
CVE-2025-71181 | Medium | 5.5 | 2026-01-31 | In the Linux kernel, the following vulnerability has been resolved: rust_binder: remove spin_lock() in rust_shrink_free_page() When forward-porting Rust Bind… |
CVE-2025-71180 | Medium | 5.5 | 2026-01-31 | In the Linux kernel, the following vulnerability has been resolved: counter: interrupt-cnt: Drop IRQF_NO_THREAD flag An IRQ handler can either be IRQF_NO_THR… |
CVE-2025-15525 | Medium | 5.3 | 2026-01-31 | The Ajax Load More – Infinite Scroll, Load More, & Lazy Load plugin for WordPress is vulnerable to unauthorized access of data due to incorrect authorization o… |
CVE-2025-15510 | Medium | 5.3 | 2026-01-31 | The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the NF5_Export_Forms clas… |
CVE-2025-36442 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as the server may cr… |
CVE-2025-36428 | Medium | 5.3 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of se… |
CVE-2025-36427 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to insufficient validation of special ele… |
CVE-2025-36424 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service due to improper neutralization of special ele… |
CVE-2025-36423 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due to improper neutral… |
CVE-2025-36407 | Medium | 6.5 | 2026-01-30 | IBM® Db2® is vulnerable to a denial of service with a specially crafted query that uses ALTER TABLE operations. |
CVE-2025-36387 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 could allow an authenticated user to cause a denial of service when given spe… |
CVE-2025-36384 | High | 8.4 | 2026-01-30 | IBM Db2 for Windows 12.1.0 - 12.1.3 could allow a local user with filesystem access to escalate their privileges due to the use of an unquoted search path ele… |
CVE-2025-36366 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could allow a user to cause a denial of service by executing a query that invokes the JSON_Ob… |
CVE-2025-36365 | Medium | 6.8 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 under specific configuration of cataloged remote storage… |
CVE-2025-36353 | Medium | 6.2 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service due… |
CVE-2025-36184 | High | 7.2 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 could allow an instance owner to execute malicious code that escalate their p… |
CVE-2025-36123 | Medium | 6.2 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow a local user to cause a denial of service whe… |
CVE-2025-36098 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of se… |
CVE-2025-36070 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 is vulnerable to a denial of service as a trap may occur… |
CVE-2025-36009 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow an authenticated user to cause a denial of service due to excessive use of a glob… |
CVE-2025-36001 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 and 12.1.0 - 12.1.3 could allow an authenticated user to cause a denial of se… |
CVE-2025-2668 | Medium | 6.5 | 2026-01-30 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.5.0 - 11.5.9 is vulnerable to a denial of service as the server may crash when an authenti… |
CVE-2025-24293 | High | 8.1 | 2026-01-30 | # Active Storage allowed transformation methods potentially unsafe Active Storage attempts to prevent the use of potentially unsafe image transformation me… |
CVE-2025-11175 | | 2026-01-30 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') vulnerability in The Wikimedia Foundatio… | |
CVE-2025-69662 | High | 8.6 | 2026-01-30 | SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write G… |