2025 CVEs (page 333)
Page 333 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-37750 | Critical | 9.8 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix UAF in decryption with multichannel After commit f7025d861694 ("smb: cli… |
CVE-2025-37749 | High | 8.2 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: net: ppp: Add bound checking for skb data on ppp_sync_txmung Ensure we have enough data i… |
CVE-2025-37748 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: Fix NULL pointer deference in mtk_iommu_device_group Currently, mtk_iommu… |
CVE-2025-37747 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: perf: Fix hang while freeing sigtrap event Perf can hang while freeing a sigtrap event if… |
CVE-2025-37746 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: perf/dwc_pcie: fix duplicate pci_dev devices During platform_device_register, wrongly usi… |
CVE-2025-37745 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: PM: hibernate: Avoid deadlock in hibernate_compressor_param_set() syzbot reported a deadl… |
CVE-2025-37744 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12k_pci_remove() Kmemleak reported this error: unr… |
CVE-2025-37743 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Avoid memory leak while enabling statistics Driver uses monitor destination… |
CVE-2025-37742 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: jfs: Fix uninit-value access of imap allocated in the diMount() function syzbot reports t… |
CVE-2025-37741 | High | 7.8 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: jfs: Prevent copying of nlink with value 0 from disk inode syzbot report a deadlock in di… |
CVE-2025-37740 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: jfs: add sanity check for agwidth in dbMount The width in dmapctl of the AG is zero, it t… |
CVE-2025-37739 | High | 7.1 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid out-of-bounds access in f2fs_truncate_inode_blocks() syzbot reports an… |
CVE-2025-37738 | High | 7.8 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: ext4: ignore xattrs past end Once inside 'ext4_xattr_inode_dec_ref_all' we should ignore… |
CVE-2025-23163 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: net: vlan: don't propagate flags on open With the device instance lock, there is now a po… |
CVE-2025-23162 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/vf: Don't try to trigger a full GT reset if VF VFs don't have access to the GDRST(… |
CVE-2025-23161 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type The access to the PCI config space… |
CVE-2025-23160 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix a resource leak related to the scp device in FW initializatio… |
CVE-2025-23159 | High | 8.4 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add a check to handle OOB in sfr region sfr->buf_size is in shared mem… |
CVE-2025-23158 | High | 7.8 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi: add check to handle incorrect queue size qsize represents size of shar… |
CVE-2025-23157 | High | 7.8 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi_parser: add check to avoid out of bound access There is a possibility t… |
CVE-2025-23156 | High | 7.8 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: media: venus: hfi_parser: refactor hfi packet parsing logic words_count denotes the numbe… |
CVE-2025-23155 | High | 7.1 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Fix accessing freed irq affinity_hint In stmmac_request_irq_multi_msi(), a p… |
CVE-2025-23154 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: io_uring/net: fix io_req_post_cqe abuse by send bundle [ 114.987980][ T5313] WARNING: CP… |
CVE-2025-23153 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: arm/crc-t10dif: fix use of out-of-scope array in crc_t10dif_arch() Fix a silly bug where… |
CVE-2025-23152 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: arm64/crc-t10dif: fix use of out-of-scope array in crc_t10dif_arch() Fix a silly bug wher… |
CVE-2025-23151 | High | 7.8 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix race between unprepare and queue_buf A client driver may use mhi_unpr… |
CVE-2025-23150 | High | 7.8 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix off-by-one error in do_split Syzkaller detected a use-after-free issue in ext4_… |
CVE-2025-23149 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: tpm: do not start chip while suspended Checking TPM_CHIP_FLAG_SUSPENDED after the call to… |
CVE-2025-23148 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-chipid: Add NULL pointer check in exynos_chipid_probe() soc_dev_attr… |
CVE-2025-23147 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: i3c: Add NULL pointer check in i3c_master_queue_ibi() The I3C master driver may receive a… |
CVE-2025-23146 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: mfd: ene-kb3930: Fix a potential NULL pointer dereference The off_gpios could be NULL. Ad… |
CVE-2025-23145 | High | 7.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix NULL pointer in can_accept_new_subflow When testing valkey benchmark tool with… |
CVE-2025-23144 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() Lockdep detects… |
CVE-2025-23143 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. When I ran the repr… |
CVE-2025-23142 | High | 7.8 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: sctp: detect and prevent references to a freed transport in sendmsg sctp_sendmsg() re-use… |
CVE-2025-23141 | High | 7.8 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses Acquire a loc… |
CVE-2025-23140 | Medium | 5.5 | 2025-05-01 | In the Linux kernel, the following vulnerability has been resolved: misc: pci_endpoint_test: Avoid issue of interrupts remaining after request_irq error Afte… |
CVE-2025-4164 | High | 7.3 | 2025-05-01 | A vulnerability, which was classified as critical, was found in PHPGurukul Employee Record Management System 1.3. Affected is an unknown function of the file c… |
CVE-2025-4163 | Medium | 6.3 | 2025-05-01 | A vulnerability, which was classified as critical, has been found in PHPGurukul Land Record System 1.0. This issue affects some unknown processing of the file… |
CVE-2025-3890 | Medium | 6.4 | 2025-05-01 | The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wp_cart_button' shortcode in all version… |
CVE-2025-3889 | Medium | 5.3 | 2025-05-01 | The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 via the '… |
CVE-2025-3874 | Medium | 6.5 | 2025-05-01 | The WordPress Simple Shopping Cart plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.3 due to la… |
CVE-2025-1529 | Medium | 6.4 | 2025-05-01 | The AM LottiePlayer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via uploaded lottie files in all versions up to, and including, 3.5.3 due… |
CVE-2025-4162 | High | 7.3 | 2025-05-01 | A vulnerability classified as critical was found in PCMan FTP Server up to 2.0.7. This vulnerability affects unknown code of the component ASCII Command Handle… |
CVE-2025-4161 | High | 7.3 | 2025-05-01 | A vulnerability classified as critical has been found in PCMan FTP Server up to 2.0.7. This affects an unknown part of the component VERBOSE Command Handler. T… |
CVE-2025-27007 | Critical | 9.8 | 2025-05-01 | Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through… |
CVE-2025-4160 | High | 7.3 | 2025-05-01 | A vulnerability was found in PCMan FTP Server up to 2.0.7. It has been rated as critical. Affected by this issue is some unknown functionality of the component… |
CVE-2025-4159 | High | 7.3 | 2025-05-01 | A vulnerability was found in PCMan FTP Server up to 2.0.7. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the… |
CVE-2025-4158 | High | 7.3 | 2025-05-01 | A vulnerability was found in PCMan FTP Server up to 2.0.7. It has been classified as critical. Affected is an unknown function of the component PROMPT Command… |
CVE-2025-4157 | Medium | 6.3 | 2025-05-01 | A vulnerability was found in PHPGurukul Boat Booking System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/booki… |
CVE-2025-4156 | Medium | 6.3 | 2025-05-01 | A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/cha… |
CVE-2025-4155 | Medium | 6.3 | 2025-05-01 | A vulnerability, which was classified as critical, was found in PHPGurukul Boat Booking System 1.0. This affects an unknown part of the file /admin/edit-boat.p… |
CVE-2025-47154 | Critical | 9.0 | 2025-05-01 | LibJS in Ladybird before f5a6704 mishandles the freeing of the vector that arguments_list references, leading to a use-after-free, and allowing remote attacker… |
CVE-2025-4154 | Medium | 6.3 | 2025-05-01 | A vulnerability, which was classified as critical, has been found in PHPGurukul Pre-School Enrollment System 1.0. Affected by this issue is some unknown functi… |
CVE-2025-4153 | High | 7.3 | 2025-05-01 | A vulnerability classified as critical was found in PHPGurukul Park Ticketing Management System 2.0. Affected by this vulnerability is an unknown functionality… |
CVE-2025-4100 | Medium | 6.4 | 2025-05-01 | The Nautic Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'np_marinetraffic_map' shortcode in all versions up to, and… |
CVE-2025-47153 | Medium | 6.5 | 2025-05-01 | Certain build processes for libuv and Node.js for 32-bit systems, such as for the nodejs binary package through nodejs_20.19.0+dfsg-2_i386.deb for Debian GNU/L… |
CVE-2025-3521 | Medium | 6.4 | 2025-05-01 | The Team Members – Best WordPress Team Plugin with Team Slider, Team Showcase & Team Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2025-4152 | High | 7.3 | 2025-05-01 | A vulnerability classified as critical has been found in PHPGurukul Online Birth Certificate System 1.0. Affected is an unknown function of the file /admin/bwd… |
CVE-2025-4151 | High | 7.3 | 2025-05-01 | A vulnerability was found in PHPGurukul Curfew e-Pass Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the f… |
CVE-2025-3504 | Medium | 4.8 | 2025-05-01 | The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perfo… |
CVE-2025-3503 | Medium | 4.8 | 2025-05-01 | The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perfo… |
CVE-2025-3502 | Medium | 4.8 | 2025-05-01 | The WP Maps WordPress plugin before 4.7.2 does not sanitise and escape some of its Map settings, which could allow high privilege users such as admin to perfo… |
CVE-2025-4150 | High | 8.8 | 2025-05-01 | A vulnerability was found in Netgear EX6200 1.0.3.94. It has been declared as critical. This vulnerability affects the function sub_54340. The manipulation of… |
CVE-2025-4099 | Medium | 6.4 | 2025-05-01 | The List Children plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'list_children' shortcode in all versions up to, and inclu… |
CVE-2025-3952 | High | 8.1 | 2025-05-01 | The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due… |
CVE-2025-4149 | High | 8.8 | 2025-05-01 | A vulnerability was found in Netgear EX6200 1.0.3.94. It has been classified as critical. This affects the function sub_54014. The manipulation of the argument… |
CVE-2025-4148 | High | 8.8 | 2025-05-01 | A vulnerability was found in Netgear EX6200 1.0.3.94 and classified as critical. Affected by this issue is the function sub_503FC. The manipulation of the argu… |
CVE-2025-2168 | Medium | 4.3 | 2025-05-01 | The Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin for… |
CVE-2025-1305 | High | 8.8 | 2025-05-01 | The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.2.5.4. This is due to missing or incorr… |
CVE-2025-1304 | High | 8.8 | 2025-05-01 | The NewsBlogger theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the newsblogger_install_and_activate_plugin()… |
CVE-2025-2816 | High | 8.1 | 2025-05-01 | The Page View Count plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability ch… |
CVE-2025-4147 | High | 8.8 | 2025-05-01 | A vulnerability has been found in Netgear EX6200 1.0.3.94 and classified as critical. Affected by this vulnerability is the function sub_47F7C. The manipulatio… |
CVE-2025-4146 | High | 8.8 | 2025-05-01 | A vulnerability, which was classified as critical, was found in Netgear EX6200 1.0.3.94. Affected is the function sub_41940. The manipulation of the argument h… |
CVE-2025-4145 | High | 8.8 | 2025-05-01 | A vulnerability, which was classified as critical, has been found in Netgear EX6200 1.0.3.94. This issue affects the function sub_3D0BC. The manipulation of th… |
CVE-2025-4144 | Critical | 9.8 | 2025-05-01 | PKCE was implemented in the OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp . However… |
CVE-2025-4143 | Medium | 6.1 | 2025-05-01 | The OAuth implementation in workers-oauth-provider that is part of MCP framework https://github.com/cloudflare/workers-mcp , did not correctly validate that r… |
CVE-2025-4142 | High | 8.8 | 2025-04-30 | A vulnerability has been found in Netgear EX6200 1.0.3.94 and classified as critical. This vulnerability affects the function sub_3C8EC. The manipulation of th… |
CVE-2025-4141 | High | 8.8 | 2025-04-30 | A vulnerability, which was classified as critical, was found in Netgear EX6200 1.0.3.94. This affects the function sub_3C03C. The manipulation of the argument… |
CVE-2025-4140 | High | 8.8 | 2025-04-30 | A vulnerability, which was classified as critical, has been found in Netgear EX6120 1.0.3.94. Affected by this issue is the function sub_30394. The manipulatio… |
CVE-2025-4139 | High | 8.8 | 2025-04-30 | A vulnerability classified as critical was found in Netgear EX6120 1.0.0.68. Affected by this vulnerability is the function fwAcosCgiInbound. The manipulation… |
CVE-2025-30422 | Medium | 6.5 | 2025-04-30 | A buffer overflow was addressed with improved input validation. This issue is fixed in AirPlay audio SDK 2.7.1 and AirPlay video SDK 3.6.0.126. An attacker on… |
CVE-2025-24132 | Medium | 6.5 | 2025-04-30 | The issue was addressed with improved memory handling. This issue is fixed in AirPlay audio SDK 2.7.1 and AirPlay video SDK 3.6.0.126. An attacker on the local… |
CVE-2025-4136 | Medium | 5.4 | 2025-04-30 | A vulnerability was found in Weitong Mall 1.0.0. It has been classified as critical. This affects an unknown part of the component Sale Endpoint. The manipulat… |
CVE-2025-2082 | High | 7.5 | 2025-04-30 | Tesla Model 3 VCSEC Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on aff… |
CVE-2025-27611 | | 2025-04-30 | base-x is a base encoder and decoder of any given alphabet using bitcoin style leading zero compression. Versions 4.0.0, 5.0.0, and all prior to 3.0.11, are vu… | |
CVE-2025-46558 | Critical | 9.0 | 2025-04-30 | XWiki Contrib's Syntax Markdown allows importing Markdown content into wiki pages and creating wiki content in Markdown. In versions starting from 8.2 to befor… |
CVE-2025-46557 | Critical | 9.8 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 15.3-rc-1 to before 15.10.14, from 16.0.0-rc-1 to before 16.4.6, and from 16.5.0-rc-1 to before 16… |
CVE-2025-46554 | Medium | 5.3 | 2025-04-30 | XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and… |
CVE-2025-46331 | Critical | 9.8 | 2025-04-30 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.10 to v1.3.6 (Hel… |
CVE-2025-32777 | | 2025-04-30 | Volcano is a Kubernetes-native batch scheduling system. Prior to versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2, attacke… | |
CVE-2025-2170 | High | 7.2 | 2025-04-30 | A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface, which in specific conditions could potent… |
CVE-2025-24887 | Medium | 6.3 | 2025-04-30 | OpenCTI is an open-source cyber threat intelligence platform. In versions starting from 6.4.8 to before 6.4.10, the allow/deny lists can be bypassed, allowing… |
CVE-2025-4135 | Medium | 6.3 | 2025-04-30 | A vulnerability was found in Netgear WG302v2 up to 5.2.9 and classified as critical. Affected by this issue is the function ui_get_input_value. The manipulatio… |
CVE-2025-46619 | High | 7.6 | 2025-04-30 | A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthorized access to sens… |
CVE-2025-44194 | High | 7.3 | 2025-04-30 | SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_household. |
CVE-2025-44193 | High | 7.6 | 2025-04-30 | SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_complaint. |
CVE-2025-44192 | Critical | 9.8 | 2025-04-30 | SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangay_management/admin/?page=view_clearance. |
CVE-2025-39413 | Medium | 4.3 | 2025-04-30 | Missing Authorization vulnerability in David Gwyer Simple Sitemap – Create a Responsive HTML Sitemap simple-sitemap.This issue affects Simple Sitemap – Create… |
CVE-2025-33074 | High | 7.5 | 2025-04-30 | Improper verification of cryptographic signature in Microsoft Azure Functions allows an authorized attacker to execute code over a network. |