2025 CVEs (page 34)
Page 34 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-33218 | High | 7.8 | 2026-01-28 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where an attacker could cause an integer overflow. A su… |
CVE-2025-33217 | High | 7.8 | 2026-01-28 | NVIDIA Display Driver for Windows contains a vulnerability where an attacker could trigger a use after free. A successful exploit of this vulnerability might l… |
CVE-2025-65890 | High | 7.5 | 2026-01-28 | A device-ID validation flaw in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) by calling flow.cuda.synchronize() with an invalid or out-of-… |
CVE-2025-65889 | High | 7.5 | 2026-01-28 | A type validation flaw in the flow.dstack() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-65888 | High | 7.5 | 2026-01-28 | A dimension validation flaw in the flow.empty() component of OneFlow 0.9.0 allows attackers to cause a Denial of Service (DoS) via a negative or excessively la… |
CVE-2025-65887 | Medium | 6.5 | 2026-01-28 | A division-by-zero vulnerability in the flow.floor_divide() component of OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via a crafted input… |
CVE-2025-65886 | High | 7.5 | 2026-01-28 | A shape mismatch vulnerability in OneFlow v0.9.0 allows attackers to cause a Denial of Service (DoS) via supplying crafted tensor shapes. |
CVE-2025-13919 | Medium | 4.4 | 2026-01-28 | Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a COM Hijacking vulnerability, which is a type of… |
CVE-2025-13918 | Medium | 6.7 | 2026-01-28 | Symantec Endpoint Protection, prior to 14.3 RU10 Patch 1, RU9 Patch 2, and RU8 Patch 3, may be susceptible to a Elevation of Privilege vulnerability, which is… |
CVE-2025-13917 | High | 7.0 | 2026-01-28 | WSS Agent, prior to 9.8.5, may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereby an attacker may attempt to compromise… |
CVE-2025-70336 | Medium | 4.8 | 2026-01-28 | A Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote attackers to inject arbitrary script or HTM… |
CVE-2025-69517 | High | 8.8 | 2026-01-28 | An HTML injection vulnerability in Amidaware Inc Tactical RMM v1.3.1 and earlier allows authenticated users to inject arbitrary HTML content during the creatio… |
CVE-2025-61140 | Critical | 9.8 | 2026-01-28 | The value function in jsonpath 1.1.1 lib/index.js is vulnerable to Prototype Pollution. |
CVE-2025-58150 | High | 8.8 | 2026-01-28 | Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled d… |
CVE-2025-57283 | High | 7.8 | 2026-01-28 | The Node.js package browserstack-local 1.5.8 contains a command injection vulnerability. This occurs because the logfile variable is not properly sanitized in… |
CVE-2025-14795 | Medium | 4.3 | 2026-01-28 | The Stop Spammers Classic plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2026.1. This is due to missing… |
CVE-2025-14865 | Medium | 6.4 | 2026-01-28 | The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'content_protector' shortc… |
CVE-2025-59901 | | 2026-01-28 | Disk Pulse Enterprise v10.4.18 has an authenticated reflected XSS vulnerability in the '/monitor_directory?sid=' endpoint, caused by insufficient validation of… | |
CVE-2025-59900 | Medium | 5.4 | 2026-01-28 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attac… |
CVE-2025-59899 | Medium | 5.4 | 2026-01-28 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attac… |
CVE-2025-59898 | Medium | 5.4 | 2026-01-28 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attac… |
CVE-2025-59897 | Medium | 5.4 | 2026-01-28 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attac… |
CVE-2025-59896 | Medium | 5.4 | 2026-01-28 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a persistent authenticated Cross-Site Scripting (XSS) vulnerability. An attac… |
CVE-2025-59895 | High | 7.5 | 2026-01-28 | Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18 contain a remote denial-of-service (DoS) vulnerability in the configuration restore f… |
CVE-2025-59894 | High | 8.0 | 2026-01-28 | Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause… |
CVE-2025-59893 | High | 8.0 | 2026-01-28 | Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause… |
CVE-2025-59892 | High | 8.0 | 2026-01-28 | Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause… |
CVE-2025-59891 | High | 8.0 | 2026-01-28 | Cross-Site request forgery (CSRF) vulnerability in Sync Breeze Enterprise Server v10.4.18 and Disk Pulse Enterprise v10.4.18. An authenticated user could cause… |
CVE-2025-26386 | | 2026-01-28 | Johnson Controls iSTAR Configuration Utility (ICU) has Stack-based Buffer Overflow vulnerability. This issue affects iSTAR Configuration Utility (ICU) version… | |
CVE-2025-15511 | Medium | 5.3 | 2026-01-28 | The Rupantorpay plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle_webhook() function in a… |
CVE-2025-14616 | Medium | 4.3 | 2026-01-28 | The Recooty – Job Widget (Old Dashboard) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.6. This is… |
CVE-2025-14386 | High | 8.8 | 2026-01-28 | The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authentication bypass… |
CVE-2025-14283 | Medium | 6.4 | 2026-01-28 | The BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library plugin for WordPress is vulnerable to Stored C… |
CVE-2025-14063 | Medium | 6.1 | 2026-01-28 | The SEO Links Interlinking plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'google_error' parameter in all versions up to, and inc… |
CVE-2025-41351 | | 2026-01-28 | Vulnerability that allows a Padding Oracle Attack to be performed on the Funambol v30.0.0.20 cloud server. The thumbnail display URL allows an attacker to decr… | |
CVE-2025-7740 | | 2026-01-28 | Default credentials vulnerability exists in SuprOS product. If exploited, this could allow an authenticated local attacker to use an admin account created duri… | |
CVE-2025-40554 | Critical | 9.8 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific a… |
CVE-2025-40553 | Critical | 9.8 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would a… |
CVE-2025-40552 | Critical | 9.8 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute acti… |
CVE-2025-40551 | Critical | 9.8 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would a… |
CVE-2025-40537 | High | 7.5 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to a hardcoded credentials vulnerability that, under certain situations, could allow access to administrat… |
CVE-2025-40536 | High | 8.1 | 2026-01-28 | SolarWinds Web Help Desk was found to be susceptible to a security control bypass vulnerability that if exploited, could allow an unauthenticated attacker to g… |
CVE-2025-9082 | Medium | 6.4 | 2026-01-28 | The WPBITS Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widget parameters in versions up to, and includi… |
CVE-2025-14039 | Medium | 6.4 | 2026-01-28 | The Simple Folio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_simple_folio_item_client_name' and '_simple_folio_item_link' meta… |
CVE-2025-12709 | Medium | 6.4 | 2026-01-28 | The Interactions – Create Interactive Experiences in the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event selectors in… |
CVE-2025-8072 | Medium | 6.4 | 2026-01-28 | The Target Video Easy Publish plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘placeholder_img’ parameter in all versions up to, and… |
CVE-2025-14610 | High | 7.2 | 2026-01-28 | The TableMaster for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.3.6. This is due to the… |
CVE-2025-13471 | Medium | 5.3 | 2026-01-28 | The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases, allowing unauthenticated users to set arbitrar… |
CVE-2025-67645 | High | 8.8 | 2026-01-28 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a broken access control i… |
CVE-2025-55292 | High | 8.2 | 2026-01-28 | Meshtastic is an open source mesh networking solution. In the current Meshtastic architecture, a Node is identified by their NodeID, generated from the MAC add… |
CVE-2025-54373 | Medium | 6.5 | 2026-01-28 | OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 7.0.4 have a vulnerability where sen… |
CVE-2025-21589 | Critical | 9.8 | 2026-01-27 | An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router may allows a network-based attacker to bypas… |
CVE-2025-14988 | | 2026-01-27 | A security issue has been identified in ibaPDA that could allow unauthorized actions on the file system under certain conditions. This may impact the confident… | |
CVE-2025-12810 | Medium | 6.5 | 2026-01-27 | Improper Authentication vulnerability in Delinea Inc. Secret Server On-Prem (RPC Password Rotation modules).This issue affects Secret Server On-Prem: 11.8.1, 1… |
CVE-2025-33234 | High | 7.8 | 2026-01-27 | NVIDIA runx contains a vulnerability where an attacker could cause a code injection. A successful exploit of this vulnerability might lead to code execution, d… |
CVE-2025-14911 | Medium | 6.5 | 2026-01-27 | User-controlled chunkSize metadata from MongoDB lacks appropriate validation allowing malformed GridFS metadata to overflow the bounding container. |
CVE-2025-69564 | Critical | 9.8 | 2026-01-27 | code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExAddNewUser.php via the Name, Address, email, UserName, Password, confirm_p… |
CVE-2025-69563 | Critical | 9.8 | 2026-01-27 | code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /ExLogin.php via the Password parameter. |
CVE-2025-69562 | Critical | 9.8 | 2026-01-27 | code-projects Mobile Shop Management System 1.0 is vulnerable to SQL Injection in /insertmessage.php via the userid parameter. |
CVE-2025-69559 | Critical | 9.8 | 2026-01-27 | code-projects Computer Book Store 1.0 is vulnerable to File Upload in admin_add.php. |
CVE-2025-65264 | Medium | 5.5 | 2026-01-27 | The kernel driver of CPUID CPU-Z v2.17 and earlier does not validate user-supplied values passed via its IOCTL interface, allowing an attacker to access sensit… |
CVE-2025-69565 | Critical | 9.8 | 2026-01-27 | code-projects Mobile Shop Management System 1.0 is vulnerable to File Upload in /ExAddProduct.php. |
CVE-2025-69421 | High | 7.5 | 2026-01-27 | Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL… |
CVE-2025-69420 | High | 7.5 | 2026-01-27 | Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first vali… |
CVE-2025-69419 | High | 7.4 | 2026-01-27 | Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII… |
CVE-2025-69418 | Medium | 4.0 | 2026-01-27 | Issue summary: When using the low-level OCB API directly with AES-NI or<br>other hardware-accelerated code paths, inputs whose length is not a multiple<br>of 1… |
CVE-2025-68670 | Critical | 9.1 | 2026-01-27 | xrdp is an open source RDP server. xrdp before v0.10.5 contains an unauthenticated stack-based buffer overflow vulnerability. The issue stems from improper bou… |
CVE-2025-68160 | Medium | 4.7 | 2026-01-27 | Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-ba… |
CVE-2025-66199 | Medium | 5.9 | 2026-01-27 | Issue summary: A TLS 1.3 connection using certificate compression can be forced to allocate a large buffer before decompression without checking against the co… |
CVE-2025-55102 | High | 7.5 | 2026-01-27 | A denial-of-service vulnerability exists in the NetX IPv6 component functionality of Eclipse ThreadX NetX Duo. A specially crafted network packet of "Packet To… |
CVE-2025-55095 | Medium | 4.2 | 2026-01-27 | The function _ux_host_class_storage_media_mount() is responsible for mounting partitions on a USB mass storage device. When it encounters an extended partition… |
CVE-2025-28164 | Medium | 5.5 | 2026-01-27 | Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via png_create_read_struct() function. |
CVE-2025-28162 | Medium | 5.5 | 2026-01-27 | Buffer Overflow vulnerability in libpng 1.6.43-1.6.46 allows a local attacker to cause a denial of service via the pngimage with AddressSanitizer (ASan), the p… |
CVE-2025-15469 | Medium | 5.5 | 2026-01-27 | Issue summary: The 'openssl dgst' command-line tool silently truncates input data to 16MB when using one-shot signing algorithms and reports success instead of… |
CVE-2025-15468 | Medium | 5.9 | 2026-01-27 | Issue summary: If an application using the SSL_CIPHER_find() function in a QUIC protocol client or server receives an unknown cipher suite from the peer, a NUL… |
CVE-2025-15467 | High | 8.8 | 2026-01-27 | Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact sum… |
CVE-2025-11187 | Medium | 6.1 | 2026-01-27 | Issue summary: PBMAC1 parameters in PKCS#12 files are missing validation which can trigger a stack-based buffer overflow, invalid pointer or NULL pointer deref… |
CVE-2025-41728 | Medium | 5.3 | 2026-01-27 | A low privileged remote attacker may be able to disclose confidential information from the memory of a privileged process by sending specially crafted calls to… |
CVE-2025-41727 | High | 7.8 | 2026-01-27 | A local low privileged attacker can bypass the authentication of the Device Manager user interface, allowing them to perform privileged operations and gain adm… |
CVE-2025-41726 | High | 8.8 | 2026-01-27 | A low privileged remote attacker can execute arbitrary code by sending specially crafted calls to the web service of the Device Manager or locally via an API a… |
CVE-2025-12387 | | 2026-01-27 | A vulnerability in the Pix-Link LV-WR21Q router's language module allows remote attackers to trigger a denial of service (DoS) by sending a specially crafted H… | |
CVE-2025-12386 | | 2026-01-27 | Pix-Link LV-WR21Q does not enforce any form of authentication for endpoint /goform/getHomePageInfo. Remote unauthenticated attacker is able to use this endpoin… | |
CVE-2025-14971 | Medium | 5.3 | 2026-01-27 | The Link Invoice Payment for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the creat… |
CVE-2025-30248 | | 2026-01-26 | DLL hijacking in the WD Discovery Installer in Western Digital WD Discovery 5.2.730 on Windows allows a local attacker to execute arbitrary code via placement… | |
CVE-2025-59473 | High | 7.2 | 2026-01-26 | SQL Injection vulnerability in the Structure for Admin authenticated user |
CVE-2025-59472 | Medium | 5.9 | 2026-01-26 | A denial of service vulnerability exists in Next.js versions with Partial Prerendering (PPR) enabled when running in minimal mode. The PPR resume endpoint acce… |
CVE-2025-59471 | Medium | 5.9 | 2026-01-26 | A denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimizat… |
CVE-2025-9820 | Medium | 4.0 | 2026-01-26 | A flaw was found in the GnuTLS library, specifically in the gnutls_pkcs11_token_init() function that handles PKCS#11 token initialization. When a token label l… |
CVE-2025-9615 | Low | 3.3 | 2026-01-26 | A flaw was found in NetworkManager. The NetworkManager package allows access to files that may belong to other users. NetworkManager allows non-root users to c… |
CVE-2025-9522 | Medium | 5.3 | 2026-01-26 | Blind Server-Side Request Forgery (SSRF) in Omada Controllers through webhook functionality, enabling crafted requests to internal services, which may lead to… |
CVE-2025-9521 | Medium | 6.5 | 2026-01-26 | Password Confirmation Bypass vulnerability in Omada Controllers, allowing an attacker with a valid session token to bypass secondary verification, and change t… |
CVE-2025-9520 | Medium | 6.8 | 2026-01-26 | An IDOR vulnerability exists in Omada Controllers that allows an attacker with Administrator permissions to manipulate requests and potentially hijack the Owne… |
CVE-2025-14969 | Medium | 4.3 | 2026-01-26 | A flaw was found in Hibernate Reactive. When an HTTP endpoint is exposed to perform database operations, a remote client can prematurely close the HTTP connect… |
CVE-2025-14525 | Medium | 6.4 | 2026-01-26 | A flaw was found in kubevirt. A user within a virtual machine (VM), if the guest agent is active, can exploit this by causing the agent to report an excessive… |
CVE-2025-14459 | High | 8.5 | 2026-01-26 | A flaw was found in KubeVirt Containerized Data Importer (CDI). This vulnerability allows a user to clone PersistentVolumeClaims (PVCs) from unauthorized names… |
CVE-2025-11687 | Medium | 6.1 | 2026-01-26 | A flaw was found in the gi-docgen. This vulnerability allows arbitrary JavaScript execution in the context of the page — enabling DOM access, session cookie th… |
CVE-2025-11065 | Medium | 5.3 | 2026-01-26 | A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information… |
CVE-2025-70368 | Medium | 5.4 | 2026-01-26 | Worklenz version 2.1.5 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Project Updates feature. An attacker can submit a malicious payload in… |
CVE-2025-14756 | High | 8.8 | 2026-01-26 | Command injection vulnerability was found in the admin interface component of TP-Link Archer MR600 v5 firmware, allowing authenticated attackers to execute sys… |
CVE-2025-71178 | | 2026-01-26 | Crucial Storage Executive installer versions prior to 11.08.082025.00 contain a DLL preloading vulnerability. During installation, the installer runs with elev… |