2025 CVEs (page 333)
Page 333 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-22883 | High | 7.8 | 2025-04-30 | Delta Electronics ISPSoft version 3.20 is vulnerable to an Out-Of-Bounds Write vulnerability that could allow an attacker to execute arbitrary code when parsin… |
CVE-2025-22882 | High | 7.8 | 2025-04-30 | Delta Electronics ISPSoft version 3.20 is vulnerable to a Stack-Based buffer overflow vulnerability that could allow an attacker to leverage debugging logic to… |
CVE-2025-3953 | Medium | 5.4 | 2025-04-30 | The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing… |
CVE-2025-3471 | Medium | 4.9 | 2025-04-30 | The SureForms WordPress plugin before 1.4.4 does not have proper authorisation check when updating its settings via the REST API, which could allow Contributo… |
CVE-2025-46560 | Medium | 6.5 | 2025-04-30 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.8.0 and prior to 0.8.5 are affected by a critica… |
CVE-2025-32444 | Critical | 10.0 | 2025-04-30 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.6.5 and prior to 0.8.5, having vLLM integration… |
CVE-2025-30202 | High | 7.5 | 2025-04-30 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.5.2 and prior to 0.8.5 are vulnerable to denial… |
CVE-2025-46552 | | 2025-04-29 | KHC-INVITATION-AUTOMATION is a GitHub automation script that automatically invites followers of a bot account to join your organization. In some commits on ver… | |
CVE-2025-29906 | High | 8.6 | 2025-04-29 | Finit is a fast init for Linux systems. Versions starting from 3.0-rc1 and prior to version 4.11 bundle an implementation of getty for the `tty` configuration… |
CVE-2025-46550 | Medium | 4.3 | 2025-04-29 | YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the `/?BazaR` endpoint and `idformulaire` parameter are vulnerable to cross-site scripting. An… |
CVE-2025-46549 | Medium | 4.3 | 2025-04-29 | YesWiki is a wiki system written in PHP. Prior to version 4.5.4, an attacker can use a reflected cross-site scripting attack to steal cookies from an authentic… |
CVE-2025-46348 | Critical | 10.0 | 2025-04-29 | YesWiki is a wiki system written in PHP. Prior to version 4.5.4, the request to commence a site backup can be performed and downloaded without authentication… |
CVE-2025-46344 | | 2025-04-29 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions starting from 4.0.1 and prior to 4.5.1, do not invoke… | |
CVE-2025-3910 | Medium | 5.4 | 2025-04-29 | A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirem… |
CVE-2025-3501 | High | 8.2 | 2025-04-29 | A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended. |
CVE-2025-4080 | Medium | 6.3 | 2025-04-29 | A vulnerability has been found in PHPGurukul Online Nurse Hiring System 1.0 and classified as critical. Affected by this vulnerability is an unknown functional… |
CVE-2025-4078 | Medium | 4.3 | 2025-04-29 | A vulnerability, which was classified as problematic, has been found in Wangshen SecGate 3600 2400. This issue affects some unknown processing of the file ?g=l… |
CVE-2025-0520 | | 2025-04-29 | An unrestricted file upload vulnerability in ShowDoc caused by improper validation of file extension allows execution of arbitrary PHP, leading to remote code… | |
CVE-2025-4079 | High | 7.3 | 2025-04-29 | A vulnerability, which was classified as critical, was found in PCMan FTP Server up to 2.0.7. Affected is an unknown function of the component RENAME Command H… |
CVE-2025-4095 | | 2025-04-29 | Registry Access Management (RAM) is a security feature allowing administrators to restrict access for their developers to only allowed registries. When a MacOS… | |
CVE-2025-4077 | Medium | 5.3 | 2025-04-29 | A vulnerability classified as critical was found in code-projects School Billing System 1.0. This vulnerability affects the function searchrec. The manipulatio… |
CVE-2025-4076 | Medium | 6.3 | 2025-04-29 | A vulnerability classified as critical has been found in LB-LINK BL-AC3600 up to 1.0.22. This affects the function easy_uci_set_option_string_0 of the file /cg… |
CVE-2025-4075 | Medium | 4.3 | 2025-04-29 | A vulnerability was found in VMSMan up to 20250416. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /login.p… |
CVE-2025-4074 | High | 7.3 | 2025-04-29 | A vulnerability was found in PHPGurukul Curfew e-Pass Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown fun… |
CVE-2025-46350 | Low | 3.5 | 2025-04-29 | YesWiki is a wiki system written in PHP. Prior to version 4.5.4, an attacker can use a reflected cross-site scripting attack to steal cookies from an authentic… |
CVE-2025-46349 | High | 7.6 | 2025-04-29 | YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any… |
CVE-2025-46347 | Critical | 9.8 | 2025-04-29 | YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki vulnerable to remote code execution. An arbitrary file write can be used to write a fi… |
CVE-2025-3911 | | 2025-04-29 | Recording of environment variables, configured for running containers, in Docker Desktop application logs could lead to unintentional disclosure of sensitive i… | |
CVE-2025-4073 | High | 7.3 | 2025-04-29 | A vulnerability was found in PHPGurukul Student Record System 3.20. It has been classified as critical. Affected is an unknown function of the file /change-pas… |
CVE-2025-4072 | Medium | 6.3 | 2025-04-29 | A vulnerability was found in PHPGurukul Online Nurse Hiring System 1.0 and classified as critical. This issue affects some unknown processing of the file /admi… |
CVE-2025-45956 | High | 8.8 | 2025-04-29 | A SQL injection vulnerability in manage_damage.php in Sourcecodester Computer Laboratory Management System v1.0 allows an authenticated attacker to execute arb… |
CVE-2025-23181 | High | 8.0 | 2025-04-29 | CWE-250: Execution with Unnecessary Privileges |
CVE-2025-23180 | High | 8.0 | 2025-04-29 | CWE-250: Execution with Unnecessary Privileges |
CVE-2025-0716 | Medium | 4.8 | 2025-04-29 | Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS allows attackers to bypass common image sou… |
CVE-2025-4071 | High | 7.3 | 2025-04-29 | A vulnerability has been found in PHPGurukul COVID19 Testing Management System 1.0 and classified as critical. This vulnerability affects unknown code of the f… |
CVE-2025-4070 | High | 7.3 | 2025-04-29 | A vulnerability, which was classified as critical, was found in PHPGurukul Rail Pass Management System 1.0. This affects an unknown part of the file /admin/cha… |
CVE-2025-4069 | Medium | 5.3 | 2025-04-29 | A vulnerability, which was classified as critical, has been found in code-projects Product Management System 1.0. Affected by this issue is the function add_it… |
CVE-2025-4068 | Medium | 5.3 | 2025-04-29 | A vulnerability classified as critical was found in code-projects Simple Movie Ticket Booking System 1.0. Affected by this vulnerability is the function change… |
CVE-2025-46346 | Medium | 5.4 | 2025-04-29 | YesWiki is a wiki system written in PHP. Prior to version 4.5.4, a stored cross-site scripting (XSS) vulnerability was discovered in the application’s comments… |
CVE-2025-40619 | High | 7.5 | 2025-04-29 | Bookgy does not provide for proper authorisation control in multiple areas of the application. This deficiency could allow a malicious actor, without authentic… |
CVE-2025-40618 | Critical | 9.8 | 2025-04-29 | SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request t… |
CVE-2025-40617 | Critical | 9.8 | 2025-04-29 | SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request t… |
CVE-2025-40616 | Medium | 6.1 | 2025-04-29 | Reflected Cross-Site Scripting (XSS) vulnerability in Bookgy. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sendi… |
CVE-2025-40615 | Medium | 6.1 | 2025-04-29 | Reflected Cross-Site Scripting (XSS) vulnerability in Bookgy. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sendi… |
CVE-2025-32354 | High | 8.8 | 2025-04-29 | In Zimbra Collaboration (ZCS) 9.0 through 10.1, a Cross-Site Request Forgery (CSRF) vulnerability exists in the GraphQL endpoint (/service/extension/graphql) o… |
CVE-2025-25962 | Critical | 9.8 | 2025-04-29 | An issue in Coresmartcontracts Uniswap v.3.0 and fixed in v.4.0 allows a remote attacker to escalate privileges via the _modifyPosition function |
CVE-2025-25403 | Critical | 9.8 | 2025-04-29 | Slims (Senayan Library Management Systems) 9 Bulian V9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/coll_type.php. |
CVE-2025-23179 | Medium | 5.5 | 2025-04-29 | CWE-798: Use of Hard-coded Credentials |
CVE-2025-23178 | High | 7.6 | 2025-04-29 | CWE-923: Improper Restriction of Communication Channel to Intended Endpoints |
CVE-2025-23177 | High | 7.6 | 2025-04-29 | CWE-427: Uncontrolled Search Path Element |
CVE-2025-1551 | Medium | 6.1 | 2025-04-29 | IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, and 9.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated… |
CVE-2025-4067 | Medium | 5.3 | 2025-04-29 | A vulnerability classified as critical has been found in ScriptAndTools Online-Travling-System 1.0. Affected is an unknown function of the file /admin/viewpack… |
CVE-2025-4066 | High | 7.3 | 2025-04-29 | A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /… |
CVE-2025-4065 | High | 7.3 | 2025-04-29 | A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /… |
CVE-2025-4093 | High | 8.1 | 2025-04-29 | Memory safety bug present in Firefox ESR 128.9, and Thunderbird 128.9. This bug showed evidence of memory corruption and we presume that with enough effort thi… |
CVE-2025-4092 | Medium | 6.5 | 2025-04-29 | Memory safety bugs present in Firefox 137 and Thunderbird 137. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2025-4091 | High | 8.1 | 2025-04-29 | Memory safety bugs present in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9. Some of these bugs showed evidence of memory corruption a… |
CVE-2025-4090 | Medium | 5.3 | 2025-04-29 | A vulnerability existed in Thunderbird for Android where potentially sensitive library locations were logged via Logcat. This vulnerability was fixed in Firefo… |
CVE-2025-4089 | Medium | 5.1 | 2025-04-29 | Due to insufficient escaping of special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leading t… |
CVE-2025-4088 | Medium | 6.5 | 2025-04-29 | A security vulnerability in Thunderbird allowed malicious sites to use redirects to send credentialed requests to arbitrary endpoints on any site that had invo… |
CVE-2025-4087 | Medium | 4.8 | 2025-04-29 | A vulnerability was identified in Thunderbird where XPath parsing could trigger undefined behavior due to missing null checks during attribute access. This cou… |
CVE-2025-4086 | Medium | 6.5 | 2025-04-29 | A specially crafted filename containing a large number of encoded newline characters could obscure the file's extension when displayed in the download dialog. … |
CVE-2025-4085 | High | 7.1 | 2025-04-29 | An attacker with control over a content process could potentially leverage the privileged UITour actor to leak sensitive information or escalate privileges. Th… |
CVE-2025-4084 | Medium | 5.7 | 2025-04-29 | Due to insufficient escaping of the special characters in the "copy as cURL" feature, an attacker could trick a user into using this command, potentially leadi… |
CVE-2025-4083 | Critical | 9.1 | 2025-04-29 | A process isolation vulnerability in Thunderbird stemmed from improper handling of javascript: URIs, which could allow content to execute in the top-level docu… |
CVE-2025-4082 | Medium | 5.9 | 2025-04-29 | Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to escalate… |
CVE-2025-4064 | Medium | 5.3 | 2025-04-29 | A vulnerability was found in ScriptAndTools Online-Travling-System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/vie… |
CVE-2025-4063 | Medium | 5.3 | 2025-04-29 | A vulnerability was found in code-projects Student Information Management System 1.0 and classified as critical. Affected by this issue is the function cancel… |
CVE-2025-4062 | Medium | 5.3 | 2025-04-29 | A vulnerability has been found in code-projects Theater Seat Booking System 1.0 and classified as critical. Affected by this vulnerability is the function canc… |
CVE-2025-3301 | | 2025-04-29 | DPA countermeasures are unavailable for ECDH key agreement and EdDSA signing operations on Curve25519 and Curve448 on all Series 2 modules and SoCs due to a la… | |
CVE-2025-2817 | High | 8.8 | 2025-04-29 | Thunderbird's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By… |
CVE-2025-4061 | Medium | 5.3 | 2025-04-29 | A vulnerability, which was classified as critical, was found in code-projects Clothing Store Management System up to 1.0. Affected is the function add_item. Th… |
CVE-2025-4060 | High | 7.3 | 2025-04-29 | A vulnerability, which was classified as critical, has been found in PHPGurukul Notice Board System 1.0. This issue affects some unknown processing of the file… |
CVE-2025-4035 | Medium | 4.3 | 2025-04-29 | A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at leas… |
CVE-2025-4059 | Medium | 5.3 | 2025-04-29 | A vulnerability classified as critical was found in code-projects Prison Management System 1.0. This vulnerability affects the function addrecord of the compon… |
CVE-2025-4058 | High | 7.3 | 2025-04-29 | A vulnerability classified as critical has been found in Projectworlds Online Examination System 1.0. This affects an unknown part of the file /Bloodgroop_proc… |
CVE-2025-3929 | Medium | 6.1 | 2025-04-29 | An XSS issue was discovered in MDaemon Email Server version 25.0.1 and below. An attacker can send a specially crafted HTML e-mail message with JavaScript in a… |
CVE-2025-3891 | High | 7.5 | 2025-04-29 | A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending… |
CVE-2025-30194 | High | 7.5 | 2025-04-29 | When DNSdist is configured to provide DoH via the nghttp2 provider, an attacker can cause a denial of service by crafting a DoH exchange that triggers an illeg… |
CVE-2025-1194 | Medium | 6.5 | 2025-04-29 | A Regular Expression Denial of Service (ReDoS) vulnerability was identified in the huggingface/transformers library, specifically in the file `tokenization_gpt… |
CVE-2025-3452 | Medium | 4.3 | 2025-04-29 | The SecuPress Free — WordPress Security plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'secup… |
CVE-2025-2893 | Medium | 6.4 | 2025-04-29 | The Gutenverse – Ultimate Block Addons and Page Builder for Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's coun… |
CVE-2025-46343 | Medium | 5.0 | 2025-04-29 | n8n is a workflow automation platform. Prior to version 1.90.0, n8n is vulnerable to stored cross-site scripting (XSS) through the attachments view endpoint. n… |
CVE-2025-46338 | Medium | 6.1 | 2025-04-29 | Audiobookshelf is a self-hosted audiobook and podcast server. Prior to version 2.21.0, an improper input handling vulnerability in the `/api/upload` endpoint a… |
CVE-2025-46330 | Low | 3.3 | 2025-04-29 | libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, incorrectly treat malformed requests that caused the HTT… |
CVE-2025-46329 | Low | 3.3 | 2025-04-29 | libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, are vulnerable to local logging of sensitive information… |
CVE-2025-31203 | Medium | 6.5 | 2025-04-29 | An integer overflow was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Son… |
CVE-2025-31202 | Medium | 5.5 | 2025-04-29 | A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, tvOS 18.4, vision… |
CVE-2025-31197 | Medium | 5.7 | 2025-04-29 | The issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ve… |
CVE-2025-30445 | Medium | 6.5 | 2025-04-29 | A type confusion issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14… |
CVE-2025-24271 | Medium | 5.4 | 2025-04-29 | An access issue was addressed with improved access restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sono… |
CVE-2025-24270 | Medium | 5.7 | 2025-04-29 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7… |
CVE-2025-24252 | High | 8.8 | 2025-04-29 | A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS… |
CVE-2025-24251 | Medium | 6.5 | 2025-04-29 | The issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ve… |
CVE-2025-24206 | High | 7.7 | 2025-04-29 | An authentication issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS… |
CVE-2025-24179 | Medium | 5.7 | 2025-04-29 | A null pointer dereference was addressed with improved input validation. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, ma… |
CVE-2025-46328 | Low | 3.3 | 2025-04-28 | snowflake-connector-nodejs is a NodeJS driver for Snowflake. Versions starting from 1.10.0 to before 2.0.4, are vulnerable to a Time-of-Check to Time-of-Use (T… |
CVE-2025-46327 | Low | 3.3 | 2025-04-28 | gosnowflake is the Snowflake Golang driver. Versions starting from 1.7.0 to before 1.13.3, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condi… |
CVE-2025-46326 | Low | 3.3 | 2025-04-28 | snowflake-connector-net is the Snowflake Connector for .NET. Versions starting from 2.1.2 to before 4.4.1, are vulnerable to a Time-of-Check to Time-of-Use (TO… |
CVE-2025-4039 | High | 7.3 | 2025-04-28 | A vulnerability was found in PHPGurukul Rail Pass Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of… |