2025 CVEs (page 320)
Page 320 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-31213 | High | 7.6 | 2025-05-12 | A logging issue was addressed with improved data redaction. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6… |
CVE-2025-31212 | Medium | 5.5 | 2025-05-12 | This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watch… |
CVE-2025-31210 | Medium | 6.5 | 2025-05-12 | The issue was addressed with improved UI. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. Processing web content may lead to a denial-of-servic… |
CVE-2025-31209 | Medium | 6.3 | 2025-05-12 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS So… |
CVE-2025-31208 | High | 7.5 | 2025-05-12 | The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ve… |
CVE-2025-31207 | High | 7.7 | 2025-05-12 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5. An app may be able to enumerate a user's installed apps. |
CVE-2025-31206 | Medium | 4.3 | 2025-05-12 | A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 1… |
CVE-2025-31205 | Medium | 6.5 | 2025-05-12 | The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchO… |
CVE-2025-31204 | High | 8.8 | 2025-05-12 | The issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2… |
CVE-2025-31196 | Medium | 5.5 | 2025-05-12 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.7, macOS Sequoia 15.4, macOS S… |
CVE-2025-31195 | Medium | 6.3 | 2025-05-12 | The issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.4. An app may be able to break out of its sandbox. |
CVE-2025-30453 | High | 7.8 | 2025-05-12 | The issue was addressed with additional permissions checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. A malicious a… |
CVE-2025-30448 | Critical | 9.1 | 2025-05-12 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.4, macOS Sonoma 1… |
CVE-2025-30442 | High | 7.8 | 2025-05-12 | The issue was addressed with improved input sanitization. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be a… |
CVE-2025-30440 | Medium | 5.5 | 2025-05-12 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able to bypas… |
CVE-2025-30436 | Critical | 9.1 | 2025-05-12 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.4 and iPadOS 18.4. An attacker may be able to use Sir… |
CVE-2025-24274 | High | 7.8 | 2025-05-12 | An input validation issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6… |
CVE-2025-24258 | High | 7.8 | 2025-05-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app ma… |
CVE-2025-24225 | Medium | 6.5 | 2025-05-12 | An injection issue was addressed with improved input validation. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. Processing an email may lead t… |
CVE-2025-24223 | High | 8.0 | 2025-05-12 | The issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2… |
CVE-2025-24222 | Medium | 6.5 | 2025-05-12 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.5. Processing maliciously crafted web content may lead to an une… |
CVE-2025-24220 | Medium | 5.5 | 2025-05-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.9. An app may be able to read a pe… |
CVE-2025-24155 | Medium | 5.5 | 2025-05-12 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able… |
CVE-2025-24144 | Medium | 5.5 | 2025-05-12 | An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.7, macOS Sequoia 15… |
CVE-2025-24142 | Medium | 5.5 | 2025-05-12 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventu… |
CVE-2025-24111 | Medium | 5.5 | 2025-05-12 | A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.7, macOS Sequoia 15.3, mac… |
CVE-2025-3659 | | 2025-05-12 | Improper authentication handling was identified in a set of HTTP POST requests affecting the following product families: * Digi PortServer TS - prior to a… | |
CVE-2025-1079 | High | 7.8 | 2025-05-12 | Client RCE on macOS and Linux via improper symbolic link resolution in Google Web Designer's preview feature |
CVE-2025-47682 | Critical | 9.3 | 2025-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allow… |
CVE-2025-44176 | Medium | 6.5 | 2025-05-12 | Tenda FH451 V1.0.0.9 is vulnerable to Remote Code Execution in the formSafeEmailFilter function. |
CVE-2025-44175 | Medium | 5.4 | 2025-05-12 | Tenda AC10 v4 V16.03.10.13 is vulnerable to Buffer Overflow in the GetParentControlInfo function. |
CVE-2025-46750 | Medium | 4.4 | 2025-05-12 | SEL BIOS packages prior to 1.3.49152.117 or 2.6.49152.98 allow a local attacker to bypass password authentication and change password-protected BIOS settings… |
CVE-2025-46749 | Medium | 4.3 | 2025-05-12 | An authenticated user could submit scripting to fields that lack proper input and output sanitization leading to subsequent client-side script execution. |
CVE-2025-46748 | Low | 2.7 | 2025-05-12 | An authenticated user attempting to change their password could do so without using the current password. |
CVE-2025-46747 | Medium | 5.7 | 2025-05-12 | An authenticated user without user-management permissions could identify other user accounts. |
CVE-2025-46746 | Medium | 5.8 | 2025-05-12 | An administrator could discover another account's credentials. |
CVE-2025-46745 | Medium | 6.5 | 2025-05-12 | An authenticated user without user-management permissions could view other users account information. |
CVE-2025-46744 | Low | 2.7 | 2025-05-12 | An authenticated administrator could modify the Created By username for a user account |
CVE-2025-46743 | Medium | 6.3 | 2025-05-12 | An authenticated user's token could be used by another source after the user had logged out prior to the token expiring. |
CVE-2025-46742 | Medium | 4.3 | 2025-05-12 | Users who were required to change their password could still access system information before changing their password |
CVE-2025-46741 | Medium | 5.7 | 2025-05-12 | A suspended or recently logged-out user could continue to interact with Blueframe until the time-out period occurred. |
CVE-2025-46740 | High | 7.5 | 2025-05-12 | An authenticated user without user administrative permissions could change the administrator Account Name. |
CVE-2025-46739 | High | 8.1 | 2025-05-12 | An unauthenticated user could discover account credentials via a brute-force attack without rate limiting |
CVE-2025-45779 | Critical | 9.8 | 2025-05-12 | Tenda AC10 V1.0re_V15.03.06.46 is vulnerable to Buffer Overflow in the formSetPPTPUserList handler via the list POST parameter. |
CVE-2025-3632 | High | 7.5 | 2025-05-12 | IBM 4769 Developers Toolkit 7.0.0 through 7.5.52 could allow a remote attacker to cause a denial of service in the Hardware Security Module (HSM) due to improp… |
CVE-2025-47578 | Medium | 6.5 | 2025-05-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Edward Caissie BNS Twitter Follow Button bns-twitter-foll… |
CVE-2025-46738 | Medium | 6.6 | 2025-05-12 | An authenticated attacker can maliciously modify layout data files in the SEL-5033 installation directory to execute arbitrary code. |
CVE-2025-46737 | High | 7.4 | 2025-05-12 | SEL-5037 Grid Configurator contains an overly permissive Cross Origin Resource Sharing (CORS) configuration for a data gateway service in the application. This… |
CVE-2025-44830 | Critical | 9.8 | 2025-05-12 | EngineerCMS v1.02 through v.2.0.5 has a SQL injection vulnerability in the /project/addprojtemplet interface. |
CVE-2025-44022 | Critical | 9.8 | 2025-05-12 | An issue in vvveb CMS v.1.0.6 allows a remote attacker to execute arbitrary code via the Plugin mechanism. |
CVE-2025-47274 | | 2025-05-12 | ToolHive is a utility designed to simplify the deployment and management of Model Context Protocol (MCP) servers. Due to the ordering of code used to start an… | |
CVE-2025-46718 | Low | 3.3 | 2025-05-12 | sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with limited sudo privileges (e.g. execution of a single… |
CVE-2025-46717 | Low | 3.3 | 2025-05-12 | sudo-rs is a memory safe implementation of sudo and su written in Rust. Prior to version 0.2.6, users with no (or very limited) sudo privileges can determine w… |
CVE-2025-46611 | Medium | 6.1 | 2025-05-12 | Cross Site Scripting vulnerability in ARTEC EMA Mail v6.92 allows an attacker to execute arbitrary code via a crafted script. |
CVE-2025-46610 | High | 8.8 | 2025-05-12 | ARTEC EMA Mail 6.92 allows CSRF. |
CVE-2025-26846 | Critical | 9.8 | 2025-05-12 | An issue was discovered in Znuny before 7.1.4. Permissions are not checked properly when using the Generic Interface to update ticket metadata. |
CVE-2025-26841 | Medium | 6.1 | 2025-05-12 | Cross Site Scripting vulnerability in WPEVEREST Everest Forms before 3.0.9 allows an attacker to execute arbitrary code via a file upload. |
CVE-2025-45835 | High | 7.5 | 2025-05-12 | A null pointer dereference vulnerability was discovered in Netis WF2880 v2.1.40207. The vulnerability exists in the FUN_004904c8 function of the cgitest.cgi fi… |
CVE-2025-40627 | Medium | 6.1 | 2025-05-12 | Reflected Cross-Site Scripting (XSS) vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScript code in a victim's browser by sendi… |
CVE-2025-40626 | Medium | 6.1 | 2025-05-12 | Reflected Cross-Site Scripting (XSS) vulnerability in AbanteCart v1.4.0, that could allow an attacker to execute JavaScript code in a victim's browser by sendi… |
CVE-2025-47271 | | 2025-05-12 | The OZI action is a GitHub Action that publishes releases to PyPI and mirror releases, signature bundles, and provenance in a tagged release. In versions 1.13… | |
CVE-2025-47270 | High | 7.5 | 2025-05-12 | nimiq/core-rs-albatross is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. The `nimiq-network-libp2p` su… |
CVE-2025-46729 | | 2025-05-12 | julmud/phpDVDProfiler is an adoption of the defunct phpDVDProfiler project, which allows users to display on the web their DVD collections maintained with Inve… | |
CVE-2025-32390 | High | 8.5 | 2025-05-12 | EspoCRM is a free, open-source customer relationship management platform. Prior to version 9.0.8, HTML Injection in Knowledge Base (KB) articles leads to compl… |
CVE-2025-22247 | Medium | 6.1 | 2025-05-12 | VMware Tools contains an insecure file handling vulnerability. A malicious actor with non-administrative privileges on a guest VM may tamper the local files to… |
CVE-2025-1533 | | 2025-05-12 | A stack buffer overflow has been identified in the AsIO3.sys driver. This vulnerability can be triggered by input manipulation, may leading to a system crash (… | |
CVE-2025-41393 | Medium | 6.1 | 2025-05-12 | Reflected cross-site scripting vulnerability exists in the laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor. If exploit… |
CVE-2025-3496 | High | 7.5 | 2025-05-12 | An unauthenticated remote attacker can cause a buffer overflow which could lead to unexpected behaviour or DoS via Bluetooth or RS-232 interface. |
CVE-2025-4561 | High | 8.8 | 2025-05-12 | The KFOX from KingFor has an Arbitrary File Upload vulnerability, allowing remote attackers with regular privilege to upload and execute web shell backdoors, t… |
CVE-2025-4560 | Medium | 6.5 | 2025-05-12 | The ISOinsight from Netvision has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access certain system functions. These f… |
CVE-2025-4559 | Critical | 9.8 | 2025-05-12 | The ISOinsight from Netvision has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, an… |
CVE-2025-3649 | Medium | 6.8 | 2025-05-12 | The LightPress Lightbox WordPress plugin before 2.3.4 does not check download links point to valid, non-Javascript URLs, allowing users with at least the contr… |
CVE-2025-3597 | Medium | 5.9 | 2025-05-12 | The Firelight Lightbox WordPress plugin before 2.3.15 does not prevent users with post writing capabilities from executing arbitrary Javascript when the jQuery… |
CVE-2025-4558 | Critical | 9.8 | 2025-05-12 | The GPM from WormHole Tech has an Unverified Password Change vulnerability, allowing unauthenticated remote attackers to change any user's password and use the… |
CVE-2025-4557 | Critical | 9.1 | 2025-05-12 | The specific APIs of Parking Management System from ZONG YU has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access spe… |
CVE-2025-4556 | Critical | 9.8 | 2025-05-12 | The web management interface of Okcat Parking Management Platform from ZONG YU has an Arbitrary File Upload vulnerability, allowing unauthenticated remote atta… |
CVE-2025-4555 | Critical | 9.8 | 2025-05-12 | The web management interface of Okcat Parking Management Platform from ZONG YU has a Missing Authentication vulnerability, allowing unauthenticated remote atta… |
CVE-2025-4554 | High | 7.3 | 2025-05-12 | A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0. It has been classified as critical. This affects an unknown part of the file… |
CVE-2025-4553 | High | 7.3 | 2025-05-12 | A vulnerability was found in PHPGurukul Apartment Visitors Management System 1.0 and classified as critical. Affected by this issue is some unknown functionali… |
CVE-2025-4552 | Medium | 5.4 | 2025-05-12 | A vulnerability has been found in ContiNew Admin up to 3.6.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2025-4551 | Low | 3.5 | 2025-05-11 | A vulnerability, which was classified as problematic, was found in ContiNew Admin up to 3.6.0. Affected is an unknown function of the file /dev-api/common/file… |
CVE-2025-4550 | High | 7.3 | 2025-05-11 | A vulnerability, which was classified as critical, has been found in PHPGurukul Apartment Visitors Management System 1.0. This issue affects some unknown proce… |
CVE-2025-4549 | High | 7.3 | 2025-05-11 | A vulnerability classified as critical was found in Campcodes Online Food Ordering System 1.0. This vulnerability affects unknown code of the file /routers/reg… |
CVE-2025-4548 | High | 7.3 | 2025-05-11 | A vulnerability classified as critical has been found in Campcodes Online Food Ordering System 1.0. This affects an unknown part of the file /routers/router.ph… |
CVE-2025-4547 | Low | 2.4 | 2025-05-11 | A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been rated as problematic. Affected by this issue is some… |
CVE-2025-4546 | Medium | 4.7 | 2025-05-11 | A vulnerability was found in 1Panel-dev MaxKB up to 1.10.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-4545 | Medium | 5.4 | 2025-05-11 | A vulnerability was found in CTCMS Content Management System 2.1.2. It has been classified as critical. Affected is the function del of the file ctcms\apps\con… |
CVE-2025-4544 | Medium | 6.6 | 2025-05-11 | A vulnerability was found in D-Link DI-8100 up to 16.07.26A1 and classified as critical. This issue affects some unknown processing of the file /ddos.asp of th… |
CVE-2025-4543 | High | 7.3 | 2025-05-11 | A vulnerability, which was classified as critical, was found in LyLme Spage 2.1. This affects an unknown part of the file lylme_spage/blob/master/admin/ajax_li… |
CVE-2025-4542 | Low | 3.1 | 2025-05-11 | A vulnerability, which was classified as problematic, has been found in Freeebird Hotel 酒店管理系统 API up to 1.2. Affected by this issue is some unknown functional… |
CVE-2025-4541 | Medium | 6.3 | 2025-05-11 | A vulnerability classified as critical has been found in LmxCMS 1.41. Affected is the function manageZt of the file c\admin\ZtAction.class.php of the component… |
CVE-2025-4540 | High | 7.0 | 2025-05-11 | A vulnerability was found in MTSoftware C-Lodop 6.6.1.1 on Windows. It has been rated as critical. This issue affects some unknown processing of the component… |
CVE-2025-4539 | High | 7.0 | 2025-05-11 | A vulnerability was found in Hainan ToDesk 4.7.6.3. It has been declared as critical. This vulnerability affects unknown code in the library profapi.dll of the… |
CVE-2025-4538 | Medium | 6.3 | 2025-05-11 | A vulnerability was found in kkFileView 4.4.0. It has been classified as critical. This affects an unknown part of the file /fileUpload. The manipulation of th… |
CVE-2025-4537 | Low | 3.1 | 2025-05-11 | A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.8.9 and classified as problematic. Affected by this issue is some unknown functionality of the fil… |
CVE-2025-4536 | Medium | 5.3 | 2025-05-11 | A vulnerability has been found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 1.0 and classified as critical. Affected by this vulnera… |
CVE-2025-4535 | Medium | 5.3 | 2025-05-11 | A vulnerability, which was classified as problematic, was found in Gosuncn Technology Group Audio-Visual Integrated Management Platform 4.0. Affected is an unk… |
CVE-2025-4534 | Low | 3.7 | 2025-05-11 | A vulnerability, which was classified as problematic, has been found in SunGrow Logger1000 01_A. This issue affects some unknown processing. The manipulation l… |
CVE-2025-4533 | Low | 2.7 | 2025-05-11 | A vulnerability classified as problematic was found in JeecgBoot up to 3.8.0. This vulnerability affects the function unzipFile of the file /jeecg-boot/airag/k… |
CVE-2025-4532 | High | 7.0 | 2025-05-11 | A vulnerability classified as critical has been found in Shanghai Bairui Information Technology SunloginClient 15.8.3.19819. This affects an unknown part in th… |