2025 CVEs (page 32)
Page 32 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-14472 | High | 8.1 | 2026-01-28 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia Content Hub allows Cross Site Request Forgery.This issue affects Acquia Content Hub: from 0.0… |
CVE-2025-13986 | Medium | 4.2 | 2026-01-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Logi… |
CVE-2025-13985 | Medium | 5.3 | 2026-01-28 | Incorrect Authorization vulnerability in Drupal Entity Share allows Forceful Browsing.This issue affects Entity Share: from 0.0.0 before 3.13.0. |
CVE-2025-13984 | Medium | 6.1 | 2026-01-28 | Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: fr… |
CVE-2025-13983 | Medium | 5.4 | 2026-01-28 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issu… |
CVE-2025-13982 | High | 8.1 | 2026-01-28 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Login Time Restriction allows Cross Site Request Forgery.This issue affects Login Time Restriction: f… |
CVE-2025-13981 | Medium | 4.4 | 2026-01-28 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scr… |
CVE-2025-13980 | Medium | 5.3 | 2026-01-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CKEditor 5 Premium Features allows Functionality Bypass.This issue affects CKE… |
CVE-2025-13979 | Medium | 5.4 | 2026-01-28 | Privilege Defined With Unsafe Actions vulnerability in Drupal Mini site allows Stored XSS.This issue affects Mini site: from 0.0.0 before 3.0.2. |
CVE-2025-71001 | Medium | 6.5 | 2026-01-28 | A segmentation violation in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-69602 | Critical | 9.1 | 2026-01-28 | A session fixation vulnerability exists in 66biolinks v62.0.0 by AltumCode, where the application does not regenerate the session identifier after successful a… |
CVE-2025-69601 | Medium | 6.5 | 2026-01-28 | A directory traversal (Zip Slip) vulnerability exists in the “Static Sites” feature of 66biolinks v44.0.0 by AltumCode. Uploaded ZIP archives are automatically… |
CVE-2025-68660 | Medium | 5.4 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, an endpoint lets any authenticated user bypass… |
CVE-2025-68659 | Medium | 4.3 | 2026-01-28 | Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have an application level denial of service vulner… |
CVE-2025-68479 | High | 7.1 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, some subscription endpoints lack proper checki… |
CVE-2025-67723 | Medium | 4.6 | 2026-01-28 | Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have a content-security-policy-mitigated cross-sit… |
CVE-2025-66488 | Medium | 4.6 | 2026-01-28 | Discourse is an open source discussion platform. A vulnerability present in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 affects anyone who uses… |
CVE-2025-71000 | High | 7.5 | 2026-01-28 | An issue in the flow.cuda.BoolTensor component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-70999 | High | 7.5 | 2026-01-28 | A GPU device-ID validation flaw in the flow.cuda.get_device_capability() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a… |
CVE-2025-65891 | High | 7.5 | 2026-01-28 | A GPU device-ID validation flaw in OneFlow v0.9.0 allows attackers to trigger a Denial of Dervice (DoS) by invoking flow.cuda.get_device_properties() with an i… |
CVE-2025-57796 | Medium | 6.8 | 2026-01-28 | Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords a… |
CVE-2025-57795 | Critical | 9.9 | 2026-01-28 | Explorance Blue versions prior to 8.14.13 contain an authenticated remote file download vulnerability in a web service component. In default configurations, th… |
CVE-2025-57794 | Critical | 9.1 | 2026-01-28 | Explorance Blue versions prior to 8.14.9 contain an authenticated unrestricted file upload vulnerability in the administrative interface. The application does… |
CVE-2025-57793 | High | 8.6 | 2026-01-28 | Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user-supplied input in a web application co… |
CVE-2025-57792 | Critical | 10.0 | 2026-01-28 | Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web application endpoint. A… |
CVE-2025-46316 | Medium | 4.3 | 2026-01-28 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in Pages 15.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1. Processing a… |
CVE-2025-46306 | Medium | 5.5 | 2026-01-28 | The issue was addressed with improved bounds checks. This issue is fixed in Keynote 15.1, iOS 26 and iPadOS 26, macOS Tahoe 26. Processing a maliciously crafte… |
CVE-2025-33237 | Medium | 5.5 | 2026-01-28 | NVIDIA HD Audio Driver for Windows contains a vulnerability where an attacker could exploit a NULL pointer dereference issue. A successful exploit of this vuln… |
CVE-2025-33220 | High | 7.8 | 2026-01-28 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause heap memory access after the memory is freed. A s… |
CVE-2025-33219 | High | 7.8 | 2026-01-28 | NVIDIA Display Driver for Linux contains a vulnerability in the NVIDIA kernel module where an attacker could cause an integer overflow or wraparound. A success… |
CVE-2025-33218 | High | 7.8 | 2026-01-28 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where an attacker could cause an integer overflow. A su… |
CVE-2025-33217 | High | 7.8 | 2026-01-28 | NVIDIA Display Driver for Windows contains a vulnerability where an attacker could trigger a use after free. A successful exploit of this vulnerability might l… |
CVE-2025-65890 | High | 7.5 | 2026-01-28 | A device-ID validation flaw in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) by calling flow.cuda.synchronize() with an invalid or out-of-… |
CVE-2025-65889 | High | 7.5 | 2026-01-28 | A type validation flaw in the flow.dstack() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-65888 | High | 7.5 | 2026-01-28 | A dimension validation flaw in the flow.empty() component of OneFlow 0.9.0 allows attackers to cause a Denial of Service (DoS) via a negative or excessively la… |
CVE-2025-65887 | Medium | 6.5 | 2026-01-28 | A division-by-zero vulnerability in the flow.floor_divide() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input… |
CVE-2025-65886 | High | 7.5 | 2026-01-28 | A shape mismatch vulnerability in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via supplying crafted tensor shapes. |
CVE-2025-13919 | Medium | 4.4 | 2026-01-28 | Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a COM Hijacking vulnerability, which is a type of… |
CVE-2025-13918 | Medium | 6.7 | 2026-01-28 | Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a Elevation of Privilege vulnerability, which is… |
CVE-2025-13917 | High | 7.0 | 2026-01-28 | WSS Agent, prior to 9.8.5, may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereby an attacker may attempt to compromise… |
CVE-2025-70336 | Medium | 4.8 | 2026-01-28 | A Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote attackers to inject arbitrary script or HTM… |
CVE-2025-69517 | High | 8.8 | 2026-01-28 | An HTML injection vulnerability in Amidaware Inc Tactical RMM v1.3.1 and earlier allows authenticated users to inject arbitrary HTML content during the creatio… |
CVE-2025-61140 | Critical | 9.8 | 2026-01-28 | The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution. |
CVE-2025-58150 | High | 8.8 | 2026-01-28 | Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled d… |
CVE-2025-57283 | High | 7.8 | 2026-01-28 | The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in… |
CVE-2025-14795 | Medium | 4.3 | 2026-01-28 | The Stop Spammers Classic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2026.1. This is due to missing… |
CVE-2025-14865 | Medium | 6.4 | 2026-01-28 | The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'content_protector' shortc… |
CVE-2025-59901 | | 2026-01-28 | Disk Pulse Enterprise v10.4.18 has an authenticated reflected XSS vulnerability in the '/monitor_directory?sid=' endpoint, caused by insufficient validation of… | |
CVE-2025-59900 | Medium | 5.4 | 2026-01-28 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attac… |
CVE-2025-59899 | Medium | 5.4 | 2026-01-28 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attac… |
CVE-2025-59898 | Medium | 5.4 | 2026-01-28 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attac… |
CVE-2025-59897 | Medium | 5.4 | 2026-01-28 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attac… |
CVE-2025-59896 | Medium | 5.4 | 2026-01-28 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attac… |
CVE-2025-59895 | High | 7.5 | 2026-01-28 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a remote denial-of-service (DoS) vulnerability in the configuration restore f… |
CVE-2025-59894 | High | 8.0 | 2026-01-28 | Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause… |
CVE-2025-59893 | High | 8.0 | 2026-01-28 | Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause… |
CVE-2025-59892 | High | 8.0 | 2026-01-28 | Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause… |
CVE-2025-59891 | High | 8.0 | 2026-01-28 | Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause… |
CVE-2025-26386 | | 2026-01-28 | Johnson Controls iSTAR Configuration Utility (ICU) has Stack-based Buffer Overflow vulnerability. This issue affects iSTAR Configuration Utility (ICU) version… | |
CVE-2025-15511 | Medium | 5.3 | 2026-01-28 | The Rupantorpay plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_webhook() function in a… |
CVE-2025-14616 | Medium | 4.3 | 2026-01-28 | The Recooty – Job Widget (Old Dashboard) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is… |
CVE-2025-14386 | High | 8.8 | 2026-01-28 | The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authentication bypass… |
CVE-2025-14283 | Medium | 6.4 | 2026-01-28 | The BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library plugin for WordPress is vulnerable to Stored C… |
CVE-2025-14063 | Medium | 6.1 | 2026-01-28 | The SEO Links Interlinking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'google_error' parameter in all versions up to, and inc… |
CVE-2025-41351 | | 2026-01-28 | Vulnerability that allows a Padding Oracle Attack to be performed on the Funambol v30.0.0.20 cloud server. The thumbnail display URL allows an attacker to decr… | |
CVE-2025-7740 | | 2026-01-28 | Default credentials vulnerability exists in SuprOS product. If exploited, this could allow an authenticated local attacker to use an admin account created duri… | |
CVE-2025-40554 | Critical | 9.8 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific a… |
CVE-2025-40553 | Critical | 9.8 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would a… |
CVE-2025-40552 | Critical | 9.8 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute acti… |
CVE-2025-40551 | Critical | 9.8 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would a… |
CVE-2025-40537 | High | 7.5 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to a hardcoded credentials vulnerability that, under certain situations, could allow access to administrat… |
CVE-2025-40536 | High | 8.1 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to g… |
CVE-2025-9082 | Medium | 6.4 | 2026-01-28 | The WPBITS Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget parameters in versions up to, and includi… |
CVE-2025-14039 | Medium | 6.4 | 2026-01-28 | The Simple Folio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_simple_folio_item_client_name' and '_simple_folio_item_link' meta… |
CVE-2025-12709 | Medium | 6.4 | 2026-01-28 | The Interactions – Create Interactive Experiences in the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event selectors in… |
CVE-2025-8072 | Medium | 6.4 | 2026-01-28 | The Target Video Easy Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘placeholder_img’ parameter in all versions up to, and… |
CVE-2025-14610 | High | 7.2 | 2026-01-28 | The TableMaster for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.6. This is due to the… |
CVE-2025-13471 | Medium | 5.3 | 2026-01-28 | The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrar… |
CVE-2025-67645 | High | 8.8 | 2026-01-28 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a broken access control i… |
CVE-2025-55292 | High | 8.2 | 2026-01-28 | Meshtastic is an open source mesh networking solution. In the current Meshtastic architecture, a Node is identified by their NodeID, generated from the MAC add… |
CVE-2025-54373 | Medium | 6.5 | 2026-01-28 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a vulnerability where sen… |
CVE-2025-21589 | Critical | 9.8 | 2026-01-27 | An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router may allows a network-based attacker to bypas… |
CVE-2025-14988 | | 2026-01-27 | A security issue has been identified in ibaPDA that could allow unauthorized actions on the file system under certain conditions. This may impact the confident… | |
CVE-2025-12810 | Medium | 6.5 | 2026-01-27 | Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem (RPC Password Rotation modules).This issue affects Secret Server On-Prem: 11.8.1, 1… |
CVE-2025-33234 | High | 7.8 | 2026-01-27 | NVIDIA runx contains a vulnerability where an attacker could cause a code injection. A successful exploit of this vulnerability might lead to code execution, d… |
CVE-2025-14911 | Medium | 6.5 | 2026-01-27 | User-controlled chunkSize metadata from MongoDB lacks appropriate validation allowing malformed GridFS metadata to overflow the bounding container. |
CVE-2025-69564 | Critical | 9.8 | 2026-01-27 | code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExAddNewUser.php via the Name, Address, email, UserName, Password, confirm_p… |
CVE-2025-69563 | Critical | 9.8 | 2026-01-27 | code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExLogin.php via the Password parameter. |
CVE-2025-69562 | Critical | 9.8 | 2026-01-27 | code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /insertmessage.php via the userid parameter. |
CVE-2025-69559 | Critical | 9.8 | 2026-01-27 | code-projects Computer Book Store 1.0 is vulnerable to File Upload in admin_add.php. |
CVE-2025-65264 | Medium | 5.5 | 2026-01-27 | The kernel driver of CPUID CPU-Z v2.17 and earlier does not validate user-supplied values passed via its IOCTL interface, allowing an attacker to access sensit… |
CVE-2025-69565 | Critical | 9.8 | 2026-01-27 | code-projects Mobile Shop Management System 1.0 is vulnerable to File Upload in /ExAddProduct.php. |
CVE-2025-69421 | High | 7.5 | 2026-01-27 | Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL… |
CVE-2025-69420 | High | 7.5 | 2026-01-27 | Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first vali… |
CVE-2025-69419 | High | 7.4 | 2026-01-27 | Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII… |
CVE-2025-69418 | Medium | 4.0 | 2026-01-27 | Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 1… |
CVE-2025-68670 | Critical | 9.1 | 2026-01-27 | xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bou… |
CVE-2025-68160 | Medium | 4.7 | 2026-01-27 | Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-ba… |
CVE-2025-66199 | Medium | 5.9 | 2026-01-27 | Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the co… |
CVE-2025-55102 | High | 7.5 | 2026-01-27 | A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet To… |