2025 CVEs (page 321)
Page 321 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-4396 | High | 7.5 | 2025-05-13 | The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, a… |
CVE-2025-35471 | High | 7.3 | 2025-05-13 | conda-forge openssl-feedstock before 066e83c (2024-05-20), on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can be written to by no… |
CVE-2025-43011 | High | 7.7 | 2025-05-13 | Under certain conditions, SAP Landscape Transformation's PCL Basis module does not perform the necessary authorization checks, allowing authenticated users to… |
CVE-2025-43010 | High | 8.3 | 2025-05-13 | SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) allows an authenticated attacker with SAP standard authorization to execute a cer… |
CVE-2025-43009 | Medium | 6.3 | 2025-05-13 | SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This… |
CVE-2025-43008 | Medium | 5.8 | 2025-05-13 | Due to missing authorization check, an unauthorized user can view the files of other company. This might lead to disclosure of personal data of employees. Ther… |
CVE-2025-43007 | Medium | 6.3 | 2025-05-13 | SAP Service Parts Management (SPM) does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate privileges. This… |
CVE-2025-43006 | Medium | 6.1 | 2025-05-13 | SAP Supplier Relationship Management (Master Data Management Catalogue) allows an unauthenticated attacker to execute malicious scripts in the application, pot… |
CVE-2025-43005 | Medium | 4.3 | 2025-05-13 | SAP GUI for Windows allows an unauthenticated attacker to exploit insecure obfuscation algorithms used by the GuiXT application to store user credentials. Whil… |
CVE-2025-43004 | Medium | 5.3 | 2025-05-13 | Due to a security misconfiguration vulnerability, customers can develop Production Operator Dashboards (PODs) that enable outside users to access customer data… |
CVE-2025-43003 | Medium | 6.4 | 2025-05-13 | SAP S/4 HANA allows an authenticated attacker with user privileges to configure a field not intended for their access and create a custom UI layout displaying… |
CVE-2025-43002 | Medium | 4.3 | 2025-05-13 | SAP S4CORE OData meta-data property allows an authenticated attacker to access restricted information due to missing authorization check. This could cause a lo… |
CVE-2025-43000 | High | 7.9 | 2025-05-13 | Under certain conditions Promotion Management Wizard (PMW) allows an attacker to access information which would otherwise be restricted.This has High impact on… |
CVE-2025-42999 | Critical | 9.1 | 2025-05-13 | SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could… |
CVE-2025-42997 | Medium | 6.6 | 2025-05-13 | Under certain conditions, SAP Gateway Client allows a high-privileged user to access restricted information beyond the scope of the application. Due to the pos… |
CVE-2025-31329 | Medium | 6.2 | 2025-05-13 | SAP NetWeaver is vulnerable to an Information Disclosure vulnerability caused by the injection of malicious instructions into user configuration settings. An a… |
CVE-2025-30018 | High | 8.6 | 2025-05-13 | The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) allows an unauthenticated attacker to submit an application servlet request with a craft… |
CVE-2025-30012 | Critical | 10.0 | 2025-05-13 | The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component, which allows an unauthenticated attacker to sen… |
CVE-2025-30011 | Medium | 5.3 | 2025-05-13 | The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an… |
CVE-2025-30010 | Medium | 6.1 | 2025-05-13 | The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an… |
CVE-2025-30009 | Medium | 6.1 | 2025-05-13 | he Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component within the affected SRM packages which allows an… |
CVE-2025-26662 | Medium | 4.4 | 2025-05-13 | The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. When a targeted vict… |
CVE-2025-46825 | Medium | 5.4 | 2025-05-12 | Kanboard is project management software that focuses on the Kanban methodology. Versions 1.2.26 through 1.2.44 have a Stored Cross-Site Scripting (XSS) Vulnera… |
CVE-2025-31260 | Medium | 5.5 | 2025-05-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive user data. |
CVE-2025-31259 | High | 7.8 | 2025-05-12 | A privacy issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app ma… |
CVE-2025-31258 | Medium | 6.5 | 2025-05-12 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5. An app may be able to break out of its sandbox. |
CVE-2025-31257 | Medium | 4.7 | 2025-05-12 | This issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2… |
CVE-2025-31256 | Medium | 5.5 | 2025-05-12 | The issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.5. Hot corner may unexpectedly reveal a user’s deleted notes. |
CVE-2025-31253 | High | 7.1 | 2025-05-12 | This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5. Muting the microphone during a FaceTime call may n… |
CVE-2025-31251 | Medium | 5.5 | 2025-05-12 | The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7… |
CVE-2025-31250 | Medium | 5.5 | 2025-05-12 | An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive… |
CVE-2025-31249 | High | 7.1 | 2025-05-12 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive user data. |
CVE-2025-31247 | High | 7.5 | 2025-05-12 | A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An attacker m… |
CVE-2025-31246 | High | 8.8 | 2025-05-12 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6. Connecting to a malicious AFP server may… |
CVE-2025-31245 | Medium | 5.5 | 2025-05-12 | The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ve… |
CVE-2025-31244 | High | 8.8 | 2025-05-12 | A file quarantine bypass was addressed with additional checks. This issue is fixed in macOS Sequoia 15.5. An app may be able to break out of its sandbox. |
CVE-2025-31242 | Medium | 5.5 | 2025-05-12 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequo… |
CVE-2025-31241 | Medium | 5.3 | 2025-05-12 | A double free issue was addressed with improved memory management. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS So… |
CVE-2025-31240 | High | 7.5 | 2025-05-12 | This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. Mounting a maliciously cra… |
CVE-2025-31239 | Medium | 4.3 | 2025-05-12 | A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS… |
CVE-2025-31238 | High | 7.3 | 2025-05-12 | The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchO… |
CVE-2025-31237 | High | 7.5 | 2025-05-12 | This issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. Mounting a maliciously cra… |
CVE-2025-31236 | Medium | 5.5 | 2025-05-12 | An information disclosure issue was addressed with improved privacy controls. This issue is fixed in macOS Sequoia 15.5. An app may be able to access sensitive… |
CVE-2025-31235 | Medium | 6.5 | 2025-05-12 | A double free issue was addressed with improved memory management. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura… |
CVE-2025-31234 | High | 8.2 | 2025-05-12 | The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5. An atta… |
CVE-2025-31233 | Medium | 6.3 | 2025-05-12 | The issue was addressed with improved input sanitization. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7… |
CVE-2025-31232 | High | 7.1 | 2025-05-12 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. A sandboxed app may be… |
CVE-2025-31228 | Medium | 6.8 | 2025-05-12 | The issue was addressed with improved authentication. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. An attacker with physical access to a dev… |
CVE-2025-31227 | Medium | 4.6 | 2025-05-12 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5. An attacker with physical access to a device may be able to… |
CVE-2025-31226 | Medium | 5.5 | 2025-05-12 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5… |
CVE-2025-31225 | High | 7.1 | 2025-05-12 | A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 18.5 and iPadOS 18.5. Call history from deleted apps may still appear in s… |
CVE-2025-31224 | High | 7.8 | 2025-05-12 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able to b… |
CVE-2025-31223 | High | 8.0 | 2025-05-12 | The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchO… |
CVE-2025-31222 | High | 7.8 | 2025-05-12 | A correctness issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura… |
CVE-2025-31221 | High | 7.5 | 2025-05-12 | An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Son… |
CVE-2025-31220 | Medium | 5.5 | 2025-05-12 | A privacy issue was addressed by removing sensitive data. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6… |
CVE-2025-31219 | High | 7.1 | 2025-05-12 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6… |
CVE-2025-31218 | Medium | 6.2 | 2025-05-12 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5. An app may be able to observe the hostnames of new network… |
CVE-2025-31217 | Medium | 6.5 | 2025-05-12 | The issue was addressed with improved input validation. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 1… |
CVE-2025-31215 | Medium | 6.5 | 2025-05-12 | The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvOS 18.5, visio… |
CVE-2025-31214 | High | 8.1 | 2025-05-12 | This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5. An attacker in a privileged network position may b… |
CVE-2025-31213 | High | 7.6 | 2025-05-12 | A logging issue was addressed with improved data redaction. This issue is fixed in iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6… |
CVE-2025-31212 | Medium | 5.5 | 2025-05-12 | This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watch… |
CVE-2025-31210 | Medium | 6.5 | 2025-05-12 | The issue was addressed with improved UI. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. Processing web content may lead to a denial-of-servic… |
CVE-2025-31209 | Medium | 6.3 | 2025-05-12 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS So… |
CVE-2025-31208 | High | 7.5 | 2025-05-12 | The issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ve… |
CVE-2025-31207 | High | 7.7 | 2025-05-12 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.5 and iPadOS 18.5. An app may be able to enumerate a user's installed apps. |
CVE-2025-31206 | Medium | 4.3 | 2025-05-12 | A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 1… |
CVE-2025-31205 | Medium | 6.5 | 2025-05-12 | The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchO… |
CVE-2025-31204 | High | 8.8 | 2025-05-12 | The issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2… |
CVE-2025-31196 | Medium | 5.5 | 2025-05-12 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.7, macOS Sequoia 15.4, macOS S… |
CVE-2025-31195 | Medium | 6.3 | 2025-05-12 | The issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.4. An app may be able to break out of its sandbox. |
CVE-2025-30453 | High | 7.8 | 2025-05-12 | The issue was addressed with additional permissions checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. A malicious a… |
CVE-2025-30448 | Critical | 9.1 | 2025-05-12 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.4, macOS Sonoma 1… |
CVE-2025-30442 | High | 7.8 | 2025-05-12 | The issue was addressed with improved input sanitization. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be a… |
CVE-2025-30440 | Medium | 5.5 | 2025-05-12 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able to bypas… |
CVE-2025-30436 | Critical | 9.1 | 2025-05-12 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.4 and iPadOS 18.4. An attacker may be able to use Sir… |
CVE-2025-24274 | High | 7.8 | 2025-05-12 | An input validation issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventura 13.7.6… |
CVE-2025-24258 | High | 7.8 | 2025-05-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app ma… |
CVE-2025-24225 | Medium | 6.5 | 2025-05-12 | An injection issue was addressed with improved input validation. This issue is fixed in iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7. Processing an email may lead t… |
CVE-2025-24223 | High | 8.0 | 2025-05-12 | The issue was addressed with improved memory handling. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2… |
CVE-2025-24222 | Medium | 6.5 | 2025-05-12 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.5. Processing maliciously crafted web content may lead to an une… |
CVE-2025-24220 | Medium | 5.5 | 2025-05-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.9. An app may be able to read a pe… |
CVE-2025-24155 | Medium | 5.5 | 2025-05-12 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.6, macOS Ventura 13.7.6. An app may be able… |
CVE-2025-24144 | Medium | 5.5 | 2025-05-12 | An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.7, macOS Sequoia 15… |
CVE-2025-24142 | Medium | 5.5 | 2025-05-12 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.5, macOS Sonoma 14.7.6, macOS Ventu… |
CVE-2025-24111 | Medium | 5.5 | 2025-05-12 | A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.7, macOS Sequoia 15.3, mac… |
CVE-2025-3659 | | 2025-05-12 | Improper authentication handling was identified in a set of HTTP POST requests affecting the following product families: * Digi PortServer TS - prior to a… | |
CVE-2025-1079 | High | 7.8 | 2025-05-12 | Client RCE on macOS and Linux via improper symbolic link resolution in Google Web Designer's preview feature |
CVE-2025-47682 | Critical | 9.3 | 2025-05-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cozy Vision SMS Alert Order Notifications sms-alert allow… |
CVE-2025-44176 | Medium | 6.5 | 2025-05-12 | Tenda FH451 V1.0.0.9 is vulnerable to Remote Code Execution in the formSafeEmailFilter function. |
CVE-2025-44175 | Medium | 5.4 | 2025-05-12 | Tenda AC10 v4 V16.03.10.13 is vulnerable to Buffer Overflow in the GetParentControlInfo function. |
CVE-2025-46750 | Medium | 4.4 | 2025-05-12 | SEL BIOS packages prior to 1.3.49152.117 or 2.6.49152.98 allow a local attacker to bypass password authentication and change password-protected BIOS settings… |
CVE-2025-46749 | Medium | 4.3 | 2025-05-12 | An authenticated user could submit scripting to fields that lack proper input and output sanitization leading to subsequent client-side script execution. |
CVE-2025-46748 | Low | 2.7 | 2025-05-12 | An authenticated user attempting to change their password could do so without using the current password. |
CVE-2025-46747 | Medium | 5.7 | 2025-05-12 | An authenticated user without user-management permissions could identify other user accounts. |
CVE-2025-46746 | Medium | 5.8 | 2025-05-12 | An administrator could discover another account's credentials. |
CVE-2025-46745 | Medium | 6.5 | 2025-05-12 | An authenticated user without user-management permissions could view other users account information. |
CVE-2025-46744 | Low | 2.7 | 2025-05-12 | An authenticated administrator could modify the Created By username for a user account |
CVE-2025-46743 | Medium | 6.3 | 2025-05-12 | An authenticated user's token could be used by another source after the user had logged out prior to the token expiring. |