2025 CVEs (page 33)
Page 33 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-62349 | Medium | 6.2 | 2026-01-30 | Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using… |
CVE-2025-62348 | High | 7.8 | 2026-01-30 | Salt's junos execution module contained an unsafe YAML decode/load usage. A specially crafted YAML payload processed by the junos module could lead to unintend… |
CVE-2025-51958 | Critical | 9.8 | 2026-01-30 | aelsantex runcommand 2014-04-01, a plugin for DokuWiki, allows unauthenticated attackers to execute arbitrary system commands via lib/plugins/runcommand/postac… |
CVE-2025-15497 | | 2026-01-30 | Insufficient epoch key slot processing in OpenVPN 2.7_alpha1 through 2.7_rc5 allows remote authenticated users to trigger an assert resulting in a denial of se… | |
CVE-2025-7964 | | 2026-01-30 | After receiving a malformed 802.15.4 MAC Data Request the Zigbee Coordinator sends a ‘network leave’ request to Zigbee router resulting in the Zigbee Route… | |
CVE-2025-4686 | High | 8.6 | 2026-01-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kodmatic Computer Software Tourism Construction Industry… |
CVE-2025-9226 | Medium | 4.6 | 2026-01-30 | Zohocorp ManageEngine OpManager, NetFlow Analyzer, and OpUtils versions prior to 128582 are affected by a stored cross-site scripting vulnerability in the Subn… |
CVE-2025-6723 | | 2026-01-30 | Chef InSpec versions up to 5.23 and before 7.0.107 creates named pipes with overly permissive default Windows access controls. A local attacker may interfere w… | |
CVE-2025-13176 | | 2026-01-30 | Planting a custom configuration file in ESET Inspect Connector allow load a malicious DLL. | |
CVE-2025-26385 | | 2026-01-30 | Johnson Controls Metasys component listed below have Improper Neutralization of Special Elements used in a Command (Command Injection) Vulnerability . Success… | |
CVE-2025-1395 | High | 8.2 | 2026-01-30 | Generation of Error Message Containing Sensitive Information vulnerability in Codriapp Innovation and Software Technologies Inc. HeyGarson allows Fuzzing for a… |
CVE-2025-12899 | Medium | 6.5 | 2026-01-30 | A flaw in Zephyr’s network stack allows an IPv4 packet containing ICMP type 128 to be misclassified as an ICMPv6 Echo Request. This results in an out-of-bounds… |
CVE-2025-15322 | Medium | 4.3 | 2026-01-30 | Tanium addressed an improper access controls vulnerability in Tanium Server. |
CVE-2025-15288 | Low | 3.1 | 2026-01-29 | Tanium addressed an improper access controls vulnerability in Interact. |
CVE-2025-69929 | Critical | 9.8 | 2026-01-29 | An issue in N3uron Web User Interface v.1.21.7-240207.1047 allows a remote attacker to escalate privileges via the password hashing on the client side using th… |
CVE-2025-69604 | High | 7.8 | 2026-01-29 | An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run… |
CVE-2025-69516 | High | 8.8 | 2026-01-29 | A Server-Side Template Injection (SSTI) vulnerability in the /reporting/templates/preview/ endpoint of Amidaware Tactical RMM, affecting versions equal to or e… |
CVE-2025-63658 | High | 7.5 | 2026-01-29 | A stack overflow in the mk_http_index_lookup function (mk_server/mk_http.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via se… |
CVE-2025-63657 | High | 7.5 | 2026-01-29 | An out-of-bounds read in the mk_mimetype_find function (mk_server/mk_mimetype.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) v… |
CVE-2025-63656 | High | 7.5 | 2026-01-29 | An out-of-bounds read in the header_cmp function (mk_server/mk_http_parser.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via… |
CVE-2025-63655 | High | 7.5 | 2026-01-29 | A NULL pointer dereference in the mk_http_range_parse function (mk_server/mk_http.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (Do… |
CVE-2025-63653 | High | 7.5 | 2026-01-29 | An out-of-bounds read in the mk_vhost_fdt_close function (mk_server/mk_vhost.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) vi… |
CVE-2025-63652 | High | 7.5 | 2026-01-29 | A use-after-free in the mk_http_request_end function (mk_server/mk_http.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via sen… |
CVE-2025-63651 | High | 7.5 | 2026-01-29 | A use-after-free in the mk_string_char_search function (mk_core/mk_string.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via s… |
CVE-2025-63650 | High | 7.5 | 2026-01-29 | An out-of-bounds read in the mk_ptr_to_buf in mk_core function (mk_memory.c) of monkey commit f37e984 allows attackers to cause a Denial of Service (DoS) via s… |
CVE-2025-63649 | High | 7.5 | 2026-01-29 | An out-of-bounds read in the http_parser_transfer_encoding_chunked function (mk_server/mk_http_parser.c) of monkey commit f37e984 allows attackers to cause a D… |
CVE-2025-15550 | Medium | 5.3 | 2026-01-29 | birkir prime <= 0.4.0.beta.0 contains a cross-site request forgery vulnerability in its GraphQL endpoint that allows attackers to exploit GET-based query reque… |
CVE-2025-15549 | Medium | 4.8 | 2026-01-29 | FluentCMS 2026 contains a stored cross-site scripting vulnerability that allows authenticated administrators to upload SVG files with embedded JavaScript via t… |
CVE-2025-69749 | Medium | 6.1 | 2026-01-29 | Cross Site Scripting vulnerability in tale v.2.0.5 allows an attacker to execute arbitrary code. |
CVE-2025-15548 | Medium | 6.5 | 2026-01-29 | Some VX800v v1.0 web interface endpoints transmit sensitive information over unencrypted HTTP due to missing application layer encryption, allowing a network a… |
CVE-2025-15543 | Medium | 4.6 | 2026-01-29 | Improper link resolution in USB HTTP access path in VX800v v1.0 allows a crafted USB device to expose root filesystem contents, giving an attacker with physica… |
CVE-2025-15542 | Medium | 5.3 | 2026-01-29 | Improper handling of exceptional conditions in VX800v v1.0 in SIP processing allows an attacker to flood the device with crafted INVITE messages, blocking all… |
CVE-2025-15541 | Medium | 6.3 | 2026-01-29 | Improper link resolution in the VX800v v1.0 SFTP service allows authenticated adjacent attackers to use crafted symbolic links to access system files, resultin… |
CVE-2025-13399 | High | 8.8 | 2026-01-29 | A weakness in the web interface’s application layer encryption in VX800v v1.0 allows an adjacent attacker to brute force the weak AES key and decrypt intercept… |
CVE-2025-45160 | Medium | 5.4 | 2026-01-29 | A HTML injection vulnerability exists in the file upload functionality of Cacti <= 1.2.29. When a file with an invalid format is uploaded, the application refl… |
CVE-2025-15545 | Medium | 6.8 | 2026-01-29 | The backup restore function does not properly validate unexpected or unrecognized tags within the backup file. When such a crafted file is restored, the inject… |
CVE-2025-71011 | Medium | 6.2 | 2026-01-29 | An input validation vulnerability in the flow.Tensor.new_empty/flow.Tensor.new_ones/flow.Tensor.new_zeros component of OneFlow v0.9.0 allows attackers to cause… |
CVE-2025-62514 | High | 8.3 | 2026-01-29 | Parsec is a cloud-based application for cryptographically secure file sharing. In versions on the 3.x branch prior to 3.6.0, `libparsec_crypto`, a component of… |
CVE-2025-13905 | | 2026-01-29 | CWE-276: Incorrect Default Permissions vulnerability exists that could cause privilege escalation through the reverse shell when one or more executable servi… | |
CVE-2025-7714 | High | 7.5 | 2026-01-29 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Global Interactive Design Media Software Inc. Content Man… |
CVE-2025-7713 | High | 7.5 | 2026-01-29 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Global Interactive Design Media Software Inc. Cont… |
CVE-2025-71009 | Medium | 6.2 | 2026-01-29 | An input validation vulnerability in the flow.scatter/flow.scatter_add component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a cr… |
CVE-2025-71008 | Medium | 6.2 | 2026-01-29 | A segmentation violation in the oneflow._oneflow_internal.autograd.Function.FunctionCtx.mark_non_differentiable component of OneFlow v0.9.0 allows attackers to… |
CVE-2025-7014 | Medium | 5.7 | 2026-01-29 | Session Fixation vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Session Hijacking. This issue affects Menu Panel: through 29012026. NOTE… |
CVE-2025-7013 | Medium | 5.7 | 2026-01-29 | Authorization Bypass Through User-Controlled Key vulnerability in QR Menu Pro Smart Menu Systems Menu Panel allows Exploitation of Trusted Identifiers. This i… |
CVE-2025-7016 | High | 8.0 | 2026-01-29 | Improper Access Control vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Authentication Abuse. This issue affects… |
CVE-2025-7015 | Medium | 5.7 | 2026-01-29 | Session Fixation vulnerability in Akın Software Computer Import Export Industry and Trade Ltd. QR Menu allows Session Fixation. This issue affects QR Menu: be… |
CVE-2025-14975 | High | 8.1 | 2026-01-29 | The Custom Login Page Customizer WordPress plugin before 2.5.4 does not have a proper password reset process, allowing a few unauthenticated requests to reset… |
CVE-2025-55704 | Medium | 5.3 | 2026-01-29 | Hidden functionality issue exists in multiple MFPs provided by Brother Industries, Ltd., which may allow an attacker to obtain the logs of the affected product… |
CVE-2025-53869 | Low | 3.7 | 2026-01-29 | Multiple MFPs provided by Brother Industries, Ltd. does not properly validate server certificates, which may allow a man-in-the-middle attacker to replace the… |
CVE-2025-15344 | Medium | 6.3 | 2026-01-29 | Tanium addressed a SQL injection vulnerability in Asset. |
CVE-2025-71007 | High | 7.5 | 2026-01-28 | An input validation vulnerability in the oneflow.index_add component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-71006 | Medium | 6.5 | 2026-01-28 | A floating point exception (FPE) in the oneflow.reshape component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-71005 | Medium | 6.5 | 2026-01-28 | A floating point exception (FPE) in the oneflow.view component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-71004 | Medium | 6.5 | 2026-01-28 | A segmentation violation in the oneflow.logical_or component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-71003 | High | 7.5 | 2026-01-28 | An input validation vulnerability in the flow.arange() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-71002 | Medium | 6.5 | 2026-01-28 | A floating-point exception (FPE) in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-69289 | Medium | 5.4 | 2026-01-28 | Discourse is an open source discussion platform. A privilege escalation vulnerability in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 allows a n… |
CVE-2025-69218 | Medium | 6.5 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, moderators can access the `top_uploads` admin… |
CVE-2025-68934 | Medium | 6.5 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, authenticated users can submit crafted payload… |
CVE-2025-68933 | Medium | 6.9 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, non-admin moderators with the `moderators_chan… |
CVE-2025-68666 | Medium | 6.5 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, users archives are viewable by users with mode… |
CVE-2025-68662 | High | 7.6 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, a hostname validation issue in FinalDestinatio… |
CVE-2025-68119 | High | 7.0 | 2026-01-28 | Downloading and building modules with malicious version strings can cause local code execution. On systems with Mercurial (hg) installed, downloading modules f… |
CVE-2025-61731 | High | 7.8 | 2026-01-28 | Building a malicious file with cmd/go can cause can cause a write to an attacker-controlled file with partial control of the file content. The "#cgo pkg-config… |
CVE-2025-61730 | Medium | 5.3 | 2026-01-28 | During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extens… |
CVE-2025-61728 | Medium | 6.5 | 2026-01-28 | archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of servic… |
CVE-2025-61726 | High | 7.5 | 2026-01-28 | The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited… |
CVE-2025-46691 | High | 7.8 | 2026-01-28 | Dell PremierColor Panel Driver, versions prior to 1.0.0.1 A01, contains an Improper Access Control vulnerability. A low privileged attacker with local access c… |
CVE-2025-14840 | High | 7.5 | 2026-01-28 | Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal HTTP Client Manager allows Forceful Browsing.This issue affects HTTP Client Manage… |
CVE-2025-14472 | High | 8.1 | 2026-01-28 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia Content Hub allows Cross Site Request Forgery.This issue affects Acquia Content Hub: from 0.0… |
CVE-2025-13986 | Medium | 4.2 | 2026-01-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass.This issue affects Disable Logi… |
CVE-2025-13985 | Medium | 5.3 | 2026-01-28 | Incorrect Authorization vulnerability in Drupal Entity Share allows Forceful Browsing.This issue affects Entity Share: from 0.0.0 before 3.13.0. |
CVE-2025-13984 | Medium | 6.1 | 2026-01-28 | Permissive Cross-domain Security Policy with Untrusted Domains vulnerability in Drupal Next.Js allows Cross-Site Scripting (XSS).This issue affects Next.Js: fr… |
CVE-2025-13983 | Medium | 5.4 | 2026-01-28 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Tagify allows Cross-Site Scripting (XSS).This issu… |
CVE-2025-13982 | High | 8.1 | 2026-01-28 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Login Time Restriction allows Cross Site Request Forgery.This issue affects Login Time Restriction: f… |
CVE-2025-13981 | Medium | 4.4 | 2026-01-28 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artificial Intelligence) allows Cross-Site Scr… |
CVE-2025-13980 | Medium | 5.3 | 2026-01-28 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal CKEditor 5 Premium Features allows Functionality Bypass.This issue affects CKE… |
CVE-2025-13979 | Medium | 5.4 | 2026-01-28 | Privilege Defined With Unsafe Actions vulnerability in Drupal Mini site allows Stored XSS.This issue affects Mini site: from 0.0.0 before 3.0.2. |
CVE-2025-71001 | Medium | 6.5 | 2026-01-28 | A segmentation violation in the flow.column_stack component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-69602 | Critical | 9.1 | 2026-01-28 | A session fixation vulnerability exists in 66biolinks v62.0.0 by AltumCode, where the application does not regenerate the session identifier after successful a… |
CVE-2025-69601 | Medium | 6.5 | 2026-01-28 | A directory traversal (Zip Slip) vulnerability exists in the “Static Sites” feature of 66biolinks v44.0.0 by AltumCode. Uploaded ZIP archives are automatically… |
CVE-2025-68660 | Medium | 5.4 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, an endpoint lets any authenticated user bypass… |
CVE-2025-68659 | Medium | 4.3 | 2026-01-28 | Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have an application level denial of service vulner… |
CVE-2025-68479 | High | 7.1 | 2026-01-28 | Discourse is an open source discussion platform. In versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0, some subscription endpoints lack proper checki… |
CVE-2025-67723 | Medium | 4.6 | 2026-01-28 | Discourse is an open source discussion platform. Versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 have a content-security-policy-mitigated cross-sit… |
CVE-2025-66488 | Medium | 4.6 | 2026-01-28 | Discourse is an open source discussion platform. A vulnerability present in versions prior to 3.5.4, 2025.11.2, 2025.12.1, and 2026.1.0 affects anyone who uses… |
CVE-2025-71000 | High | 7.5 | 2026-01-28 | An issue in the flow.cuda.BoolTensor component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-70999 | High | 7.5 | 2026-01-28 | A GPU device-ID validation flaw in the flow.cuda.get_device_capability() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a… |
CVE-2025-65891 | High | 7.5 | 2026-01-28 | A GPU device-ID validation flaw in OneFlow v0.9.0 allows attackers to trigger a Denial of Dervice (DoS) by invoking flow.cuda.get_device_properties() with an i… |
CVE-2025-57796 | Medium | 6.8 | 2026-01-28 | Explorance Blue versions prior to 8.14.12 use reversible symmetric encryption with a hardcoded static key to protect sensitive data, including user passwords a… |
CVE-2025-57795 | Critical | 9.9 | 2026-01-28 | Explorance Blue versions prior to 8.14.13 contain an authenticated remote file download vulnerability in a web service component. In default configurations, th… |
CVE-2025-57794 | Critical | 9.1 | 2026-01-28 | Explorance Blue versions prior to 8.14.9 contain an authenticated unrestricted file upload vulnerability in the administrative interface. The application does… |
CVE-2025-57793 | High | 8.6 | 2026-01-28 | Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user-supplied input in a web application co… |
CVE-2025-57792 | Critical | 10.0 | 2026-01-28 | Explorance Blue versions prior to 8.14.9 contain a SQL injection vulnerability caused by insufficient validation of user input in a web application endpoint. A… |
CVE-2025-46316 | Medium | 4.3 | 2026-01-28 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in Pages 15.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1. Processing a… |
CVE-2025-46306 | Medium | 5.5 | 2026-01-28 | The issue was addressed with improved bounds checks. This issue is fixed in Keynote 15.1, iOS 26 and iPadOS 26, macOS Tahoe 26. Processing a maliciously crafte… |
CVE-2025-33237 | Medium | 5.5 | 2026-01-28 | NVIDIA HD Audio Driver for Windows contains a vulnerability where an attacker could exploit a NULL pointer dereference issue. A successful exploit of this vuln… |
CVE-2025-33220 | High | 7.8 | 2026-01-28 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager, where a malicious guest could cause heap memory access after the memory is freed. A s… |
CVE-2025-33219 | High | 7.8 | 2026-01-28 | NVIDIA Display Driver for Linux contains a vulnerability in the NVIDIA kernel module where an attacker could cause an integer overflow or wraparound. A success… |