2025 CVEs (page 327)
Page 327 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-25014 | Critical | 9.1 | 2025-05-06 | A Prototype pollution vulnerability in Kibana leads to arbitrary code execution via crafted HTTP requests to machine learning and reporting endpoints. |
CVE-2025-4041 | | 2025-05-06 | In Optigo Networks ONS NC600 versions 4.2.1-084 through 4.7.2-330, an attacker could connect with the device's ssh server and utilize the system's components t… | |
CVE-2025-46736 | Medium | 5.3 | 2025-05-06 | Umbraco is a free and open source .NET content management system. Prior to versions 10.8.10 and 13.8.1, based on an analysis of the timing of post login API re… |
CVE-2025-46735 | | 2025-05-06 | Terraform WinDNS Provider allows users to manage their Windows DNS server resources through Terraform. A security issue has been found in Terraform WinDNS Prov… | |
CVE-2025-45250 | Medium | 5.5 | 2025-05-06 | MrDoc v0.95 and before is vulnerable to Server-Side Request Forgery (SSRF) in the validate_url function of the app_doc/utils.py file. |
CVE-2025-32022 | Medium | 4.6 | 2025-05-06 | Finit provides fast init for Linux systems. Finit's urandom plugin has a heap buffer overwrite vulnerability at boot which leads to it overwriting other parts… |
CVE-2025-30165 | High | 8.0 | 2025-05-06 | vLLM is an inference and serving engine for large language models. In a multi-node vLLM deployment using the V0 engine, vLLM uses ZeroMQ for some multi-node co… |
CVE-2025-26262 | Medium | 6.5 | 2025-05-06 | An issue in the component /internals/functions of R-fx Networks Linux Malware Detect v1.6.5 allows attackers to escalate privileges and execute arbitrary code… |
CVE-2025-22476 | Medium | 5.5 | 2025-05-06 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection… |
CVE-2025-4384 | | 2025-05-06 | The MQTT add-on of PcVue fails to verify that a remote device’s certificate has not already expired or has not yet become valid. This allows malicious devices… | |
CVE-2025-4368 | High | 8.8 | 2025-05-06 | A vulnerability, which was classified as critical, was found in Tenda AC8 16.03.34.06. Affected is the function formGetRouterStatus of the file /goform/MtuSetM… |
CVE-2025-4363 | High | 7.3 | 2025-05-06 | A vulnerability, which was classified as critical, has been found in itsourcecode Gym Management System 1.0. This issue affects some unknown processing of the… |
CVE-2025-45492 | Critical | 9.8 | 2025-05-06 | Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the Iface parameter in the action_wireless function. |
CVE-2025-45491 | Critical | 9.8 | 2025-05-06 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the username parameter. |
CVE-2025-45490 | Critical | 9.8 | 2025-05-06 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the password parameter. |
CVE-2025-45489 | Critical | 9.8 | 2025-05-06 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the hostname parameter. |
CVE-2025-45488 | Critical | 9.8 | 2025-05-06 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the mailex parameter. |
CVE-2025-45487 | Critical | 9.8 | 2025-05-06 | Linksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.InternetConnection function. |
CVE-2025-23379 | Low | 3.5 | 2025-05-06 | Dell Storage Center - Dell Storage Manager, version(s) 21.0.20, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scriptin… |
CVE-2025-22479 | Low | 3.5 | 2025-05-06 | Dell Storage Center - Dell Storage Manager, version(s) 20.0.21, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vu… |
CVE-2025-22478 | High | 8.1 | 2025-05-06 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Restriction of XML External Entity Reference vulnerability. An unauthent… |
CVE-2025-22477 | High | 8.3 | 2025-05-06 | Dell Storage Center - Dell Storage Manager, version(s) 20.1.20, contain(s) an Improper Authentication vulnerability. An unauthenticated attacker with adjacent… |
CVE-2025-4374 | Medium | 6.5 | 2025-05-06 | A flaw was found in Quay. When an organization acts as a proxy cache, and a user or robot pulls an image that hasn't been mirrored yet, they are granted "Admin… |
CVE-2025-4373 | Medium | 4.8 | 2025-05-06 | A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the charac… |
CVE-2025-4362 | High | 7.3 | 2025-05-06 | A vulnerability classified as critical was found in itsourcecode Gym Management System 1.0. This vulnerability affects unknown code of the file /ajax.php?actio… |
CVE-2025-4361 | High | 7.3 | 2025-05-06 | A vulnerability classified as critical has been found in PHPGurukul Company Visitor Management System 2.0. This affects an unknown part of the file /department… |
CVE-2025-4360 | High | 7.3 | 2025-05-06 | A vulnerability, which was classified as critical, has been found in itsourcecode Gym Management System 1.0. Affected by this issue is some unknown functionali… |
CVE-2025-46814 | Low | 3.4 | 2025-05-06 | FastAPI Guard is a security library for FastAPI that provides middleware to control IPs, log requests, and detect penetration attempts. An HTTP header injectio… |
CVE-2025-2898 | High | 7.5 | 2025-05-06 | IBM Maximo Application Suite 9.0 could allow an attacker with some level of access to elevate their privileges due to a security configuration vulnerability in… |
CVE-2025-4359 | High | 7.3 | 2025-05-06 | A vulnerability classified as critical was found in itsourcecode Gym Management System 1.0. Affected by this vulnerability is an unknown functionality of the f… |
CVE-2025-4358 | High | 7.3 | 2025-05-06 | A vulnerability classified as critical has been found in PHPGurukul Company Visitor Management System 2.0. Affected is an unknown function of the file /admin-p… |
CVE-2025-4357 | Medium | 4.7 | 2025-05-06 | A vulnerability was found in Tenda RX3 16.03.13.11_multi. It has been rated as critical. This issue affects some unknown processing of the file /goform/telnet… |
CVE-2025-4356 | High | 8.8 | 2025-05-06 | A vulnerability was found in Tenda DAP-1520 1.10B04_BETA02. It has been declared as critical. This vulnerability affects the function mod_graph_auth_uri_handle… |
CVE-2025-4355 | High | 8.8 | 2025-05-06 | A vulnerability was found in Tenda DAP-1520 1.10B04_BETA02. It has been classified as critical. This affects the function set_ws_action of the file /dws/api/… |
CVE-2025-4354 | High | 8.8 | 2025-05-06 | A vulnerability was found in Tenda DAP-1520 1.10B04_BETA02 and classified as critical. Affected by this issue is the function check_dws_cookie of the file /sto… |
CVE-2025-4353 | Medium | 6.3 | 2025-05-06 | A vulnerability, which was classified as critical, was found in Brilliance Golden Link Secondary System up to 20250424. Affected is an unknown function of the… |
CVE-2025-4352 | Medium | 6.3 | 2025-05-06 | A vulnerability, which was classified as critical, has been found in Brilliance Golden Link Secondary System up to 20250424. This issue affects some unknown pr… |
CVE-2025-4350 | High | 8.8 | 2025-05-06 | A vulnerability classified as critical was found in D-Link DIR-600L up to 2.07B01. This vulnerability affects the function wake_on_lan. The manipulation of the… |
CVE-2025-4349 | High | 8.8 | 2025-05-06 | A vulnerability classified as critical has been found in D-Link DIR-600L up to 2.07B01. This affects the function formSysCmd. The manipulation of the argument… |
CVE-2025-0984 | High | 8.2 | 2025-05-06 | Unrestricted Upload of File with Dangerous Type, Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in N… |
CVE-2025-4348 | High | 8.8 | 2025-05-06 | A vulnerability was found in D-Link DIR-600L up to 2.07B01. It has been rated as critical. Affected by this issue is the function formSetWanL2TP. The manipulat… |
CVE-2025-4347 | High | 8.8 | 2025-05-06 | A vulnerability was found in D-Link DIR-600L up to 2.07B01. It has been declared as critical. Affected by this vulnerability is the function formWlSiteSurvey… |
CVE-2025-40625 | Critical | 9.8 | 2025-05-06 | Unrestricted file upload in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to upload any file within the server, even a malicious file… |
CVE-2025-40624 | Critical | 9.8 | 2025-05-06 | SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information… |
CVE-2025-40623 | Critical | 9.8 | 2025-05-06 | SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information… |
CVE-2025-40622 | Critical | 9.8 | 2025-05-06 | SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information… |
CVE-2025-40621 | Critical | 9.8 | 2025-05-06 | SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information… |
CVE-2025-40620 | Critical | 9.8 | 2025-05-06 | SQL injection in TCMAN's GIM v11. This vulnerability allows an unauthenticated attacker to inject an SQL statement to obtain, update and delete all information… |
CVE-2025-4346 | High | 8.8 | 2025-05-06 | A vulnerability was found in D-Link DIR-600L up to 2.07B01. It has been classified as critical. Affected is the function formSetWAN_Wizard534. The manipulation… |
CVE-2025-4345 | High | 8.8 | 2025-05-06 | A vulnerability was found in D-Link DIR-600L up to 2.07B01 and classified as critical. This issue affects the function formSetLog. The manipulation of the argu… |
CVE-2025-4344 | High | 8.8 | 2025-05-06 | A vulnerability, which was classified as critical, was found in D-Link DIR-600L up to 2.07B01. This affects the function formLogin. The manipulation of the arg… |
CVE-2025-46762 | High | 8.1 | 2025-05-06 | Schema parsing in the parquet-avro module of Apache Parquet 1.15.0 and previous versions allows bad actors to execute arbitrary code. While 1.15.1 introduced… |
CVE-2025-3782 | Medium | 6.4 | 2025-05-06 | The Cision Block plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 4.3.0 due to in… |
CVE-2025-2011 | High | 7.5 | 2025-05-06 | The Slider & Popup Builder by Depicter plugin for WordPress is vulnerable to generic SQL Injection via the ‘s' parameter in all versions up to, and including… |
CVE-2025-4343 | High | 8.8 | 2025-05-06 | A vulnerability has been found in D-Link DIR-600L up to 2.07B01 and classified as critical. This vulnerability affects the function formEasySetupWizard. The ma… |
CVE-2025-4342 | High | 8.8 | 2025-05-06 | A vulnerability, which was classified as critical, has been found in D-Link DIR-600L up to 2.07B01. Affected by this issue is the function formEasySetupWizard3… |
CVE-2025-4341 | Medium | 6.3 | 2025-05-06 | A vulnerability classified as critical was found in D-Link DIR-880L up to 104WWb01. Affected by this vulnerability is the function sub_16570 of the file /htdoc… |
CVE-2025-27248 | Low | 3.3 | 2025-05-06 | in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference. |
CVE-2025-27241 | Low | 3.3 | 2025-05-06 | in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference. |
CVE-2025-27132 | Low | 3.8 | 2025-05-06 | in OpenHarmony v5.0.3 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability… |
CVE-2025-25218 | Low | 3.3 | 2025-05-06 | in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through NULL pointer dereference. |
CVE-2025-25052 | Low | 3.3 | 2025-05-06 | in OpenHarmony v5.0.3 and prior versions allow a local attacker cause DOS through buffer overflow. |
CVE-2025-22886 | Low | 3.3 | 2025-05-06 | in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory. |
CVE-2025-21475 | High | 7.8 | 2025-05-06 | Memory corruption while processing escape code, when DisplayId is passed with large unsigned value. |
CVE-2025-21470 | High | 7.8 | 2025-05-06 | Memory corruption while processing image encoding, when configuration is NULL in IOCTL parameter. |
CVE-2025-21469 | High | 7.8 | 2025-05-06 | Memory corruption while processing image encoding, when input buffer length is 0 in IOCTL call. |
CVE-2025-21468 | High | 7.8 | 2025-05-06 | Memory corruption while reading response from FW, when buffer size is changed by FW while driver is using this size to write null character at the end of buffe… |
CVE-2025-21467 | High | 7.8 | 2025-05-06 | Memory corruption while reading the FW response from the shared queue. |
CVE-2025-21462 | High | 7.8 | 2025-05-06 | Memory corruption while processing an IOCTL request, when buffer significantly exceeds the command argument limit. |
CVE-2025-21460 | High | 7.8 | 2025-05-06 | Memory corruption while processing a message, when the buffer is controlled by a Guest VM, the value can be changed continuously. |
CVE-2025-21459 | High | 7.5 | 2025-05-06 | Transient DOS while parsing per STA profile in ML IE. |
CVE-2025-21453 | High | 7.8 | 2025-05-06 | Memory corruption while processing a data structure, when an iterator is accessed after it has been removed, potential failures occur. |
CVE-2025-4340 | Medium | 6.3 | 2025-05-06 | A vulnerability classified as critical has been found in D-Link DIR-890L and DIR-806A1 up to 100CNb11/108B03. Affected is the function sub_175C8 of the file /h… |
CVE-2025-4333 | Medium | 6.3 | 2025-05-06 | A vulnerability was found in feng_ha_ha/megagao ssm-erp and production_ssm up to 0.0.1. It has been classified as critical. This affects the function uploadFil… |
CVE-2025-4332 | High | 7.3 | 2025-05-06 | A vulnerability was found in PHPGurukul Company Visitor Management System 2.0 and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2025-4331 | High | 7.3 | 2025-05-06 | A vulnerability classified as critical was found in SourceCodester Online Student Clearance System 1.0. This vulnerability affects unknown code of the file /Ad… |
CVE-2025-46593 | Medium | 5.1 | 2025-05-06 | Process residence vulnerability in abnormal scenarios in the print module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-46592 | Medium | 4.4 | 2025-05-06 | Null pointer dereference vulnerability in the USB HDI driver module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-46591 | Medium | 6.2 | 2025-05-06 | Out-of-bounds data read vulnerability in the authorization module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-46590 | Medium | 6.3 | 2025-05-06 | Bypass vulnerability in the network search instruction authentication module Impact: Successful exploitation of this vulnerability can bypass authentication an… |
CVE-2025-46589 | Medium | 4.4 | 2025-05-06 | Vulnerability of unauthorized access in the app lock module Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality. |
CVE-2025-46588 | Medium | 4.4 | 2025-05-06 | Vulnerability of unauthorized access in the app lock module Impact: Successful exploitation of this vulnerability will affect integrity and confidentiality. |
CVE-2025-46587 | Medium | 6.2 | 2025-05-06 | Permission control vulnerability in the media library module Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-3281 | Medium | 5.3 | 2025-05-06 | The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Refere… |
CVE-2025-3020 | Medium | 5.4 | 2025-05-06 | An low privileged remote Attacker can execute arbitrary web scripts or HTML via a crafted payload injected into several fields of the configuration webpage wit… |
CVE-2025-4329 | Medium | 4.3 | 2025-05-06 | A vulnerability was found in 74CMS up to 3.33.0. It has been rated as problematic. Affected by this issue is the function index of the file /index.php/index/do… |
CVE-2025-4328 | Low | 3.5 | 2025-05-06 | A vulnerability was found in fp2952 spring-cloud-base up to 7f050dc6db9afab82c5ce1d41cd74ed255ec9bfa. It has been declared as problematic. Affected by this vul… |
CVE-2025-4327 | Medium | 4.3 | 2025-05-06 | A vulnerability was found in MRCMS 3.1.2. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross-site request… |
CVE-2025-46586 | Medium | 5.1 | 2025-05-06 | Permission control vulnerability in the contacts module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-46585 | High | 7.5 | 2025-05-06 | Out-of-bounds array read/write vulnerability in the kernel module Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-46584 | High | 7.8 | 2025-05-06 | Vulnerability of improper authentication logic implementation in the file system module Impact: Successful exploitation of this vulnerability may affect servic… |
CVE-2025-4326 | Low | 2.4 | 2025-05-06 | A vulnerability was found in MRCMS 3.1.2 and classified as problematic. This issue affects some unknown processing of the file /admin/chip/add.do of the compon… |
CVE-2025-4325 | Low | 2.4 | 2025-05-06 | A vulnerability has been found in MRCMS 3.1.2 and classified as problematic. This vulnerability affects unknown code of the file /admin/category/add.do of the… |
CVE-2025-4324 | Low | 2.4 | 2025-05-06 | A vulnerability, which was classified as problematic, was found in MRCMS 3.1.2. This affects an unknown part of the file /admin/link/edit.do of the component E… |
CVE-2025-4337 | Medium | 4.3 | 2025-05-06 | The AHAthat Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorr… |
CVE-2025-4323 | Low | 2.4 | 2025-05-06 | A vulnerability, which was classified as problematic, has been found in MRCMS 3.1.2. Affected by this issue is some unknown functionality of the component Edit… |
CVE-2025-4314 | High | 7.3 | 2025-05-06 | A vulnerability has been found in SourceCodester Advanced Web Store 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2025-4313 | High | 7.3 | 2025-05-06 | A vulnerability, which was classified as critical, was found in SourceCodester Advanced Web Store 1.0. Affected is an unknown function of the file /admin/admin… |
CVE-2025-2802 | High | 7.3 | 2025-05-06 | The LayoutBoxx plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 0.3.1. This is due to the software all… |
CVE-2025-4312 | High | 7.3 | 2025-05-06 | A vulnerability, which was classified as critical, has been found in SourceCodester Advanced Web Store 1.0. This issue affects some unknown processing of the f… |