2025 CVEs (page 34)

Page 34 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.

All CVEs published in 2025 — newest first (page 34 of 434)
CVESeverityScorePublishedSummary
CVE-2025-71160Medium5.52026-01-23In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: avoid chain re-validation if possible Hamza Mahfooz reports cpu sof…
CVE-2025-71159Critical9.82026-01-23In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free warning in btrfs_get_or_create_delayed_node() Previously, btrfs…
CVE-2025-71158High7.82026-01-23In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: ensure worker is torn down When an IRQ worker is running, unplugging the dev…
CVE-2025-69908High7.52026-01-23An unauthenticated information disclosure vulnerability in Newgen OmniApp allows attackers to enumerate valid privileged usernames via a publicly accessible cl…
CVE-2025-67125Medium4.42026-01-23A signed integer overflow in docopt.cpp v0.6.2 (LeafPattern::match in docopt_private.h) when merging occurrence counters (e.g., default LONG_MAX + first user "…
CVE-2025-67124Medium6.82026-01-23A TOCTOU and symlink race in svenstaro/miniserve 0.32.0 upload finalization (when uploads are enabled) can allow an attacker to overwrite arbitrary files outsi…
CVE-2025-66720High7.52026-01-23Null pointer dereference in free5gc pcf 1.4.0 in file internal/sbi/processor/ampolicy.go in function HandleDeletePoliciesPolAssoId.
CVE-2025-66719Critical9.12026-01-23An issue was discovered in Free5gc NRF 1.4.0. In the access-token generation logic of free5GC, the AccessTokenScopeCheck() function in file internal/sbi/proces…
CVE-2025-71157High7.82026-01-23In the Linux kernel, the following vulnerability has been resolved: RDMA/core: always drop device refcount in ib_del_sub_device_and_put() Since nldev_deldev(…
CVE-2025-71156High7.82026-01-23In the Linux kernel, the following vulnerability has been resolved: gve: defer interrupt enabling until NAPI registration Currently, interrupts are automatic…
CVE-2025-71155High7.82026-01-23In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix gmap_helper_zap_one_page() again A few checks were missing in gmap_helper_…
CVE-2025-71154Medium5.52026-01-23In the Linux kernel, the following vulnerability has been resolved: net: usb: rtl8150: fix memory leak on usb_submit_urb() failure In async_set_registers()…
CVE-2025-71153Medium5.52026-01-23In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix memory leak in get_file_all_info() In get_file_all_info(), if vfs_getattr() fa…
CVE-2025-71152High7.82026-01-23In the Linux kernel, the following vulnerability has been resolved: net: dsa: properly keep track of conduit reference Problem description ------------------…
CVE-2025-71151Medium5.52026-01-23In the Linux kernel, the following vulnerability has been resolved: cifs: Fix memory and information leak in smb3_reconfigure() In smb3_reconfigure(), if smb…
CVE-2025-71150High7.52026-01-23In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix refcount leak when invalid session is found on session lookup When a session i…
CVE-2025-71148Low3.32026-01-23In the Linux kernel, the following vulnerability has been resolved: net/handshake: restore destructor on submit failure handshake_req_submit() replaces sk->s…
CVE-2025-71147Medium5.52026-01-23In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix a memory leak in tpm2_load_cmd 'tpm2_load_cmd' allocates a tempoary bl…
CVE-2025-71146High7.52026-01-23In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conncount: fix leaked ct in error paths There are some situations where ct…
CVE-2025-69907High7.52026-01-23An unauthenticated information disclosure vulnerability exists in Newgen OmniDocs due to missing authentication and access control on the /omnidocs/GetListofCa…
CVE-2025-71145High7.82026-01-23In the Linux kernel, the following vulnerability has been resolved: usb: phy: isp1301: fix non-OF device reference imbalance A recent change fixing a device…
CVE-2025-13921Medium4.32026-01-23The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to unauthorized modification or loss of data d…
CVE-2025-4320Critical10.02026-01-23Authentication Bypass by Primary Weakness, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Technology Solutio…
CVE-2025-4319Critical9.42026-01-23Improper Restriction of Excessive Authentication Attempts, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Birebirsoft Software and Te…
CVE-2025-14866High8.82026-01-23The Melapress Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.1. This is due to a misconfigure…
CVE-2025-2204Medium4.72026-01-23Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Tapandsign Technologies Software Inc. Tap&Sign all…
CVE-2025-46699Medium4.32026-01-23Dell Data Protection Advisor, versions prior to 19.12, contains an Improper Neutralization of Special Elements Used in a Template Engine vulnerability in the S…
CVE-2025-14745Medium6.42026-01-23The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's…
CVE-2025-14069Medium6.42026-01-23The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_custom_schema_field' profile field i…
CVE-2025-67847High8.82026-01-23A flaw was found in Moodle. An attacker with access to the restore interface could trigger server-side execution of arbitrary code. This is due to insufficient…
CVE-2025-3839High8.02026-01-23A flaw was found in Epiphany, a tool that allows websites to open external URL handler applications with minimal user interaction. This design can be misused t…
CVE-2025-15522Medium6.42026-01-23The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…
CVE-2025-15351High7.82026-01-23Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut…
CVE-2025-15350High7.82026-01-23Anritsu VectorStar CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execut…
CVE-2025-15349High7.52026-01-23Anritsu ShockLine SCPI Race Condition Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on af…
CVE-2025-15348High7.82026-01-23Anritsu ShockLine CHX File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute…
CVE-2025-15063Critical9.82026-01-23Ollama MCP Server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affe…
CVE-2025-15062High7.82026-01-23Trimble SketchUp SKP File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a…
CVE-2025-15061Critical9.82026-01-23Framelink Figma MCP Server fetchWithRetry Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrar…
CVE-2025-15059High7.82026-01-23GIMP PSP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on a…
CVE-2025-11002High7.82026-01-237-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte…
CVE-2025-9290Medium5.92026-01-23An authentication weakness was identified in Omada Controllers, Gateways and Access Points, controller-device adoption due to improper handling of random value…
CVE-2025-67652Medium6.12026-01-22An attacker with access to the project file could use the exposed credentials to impersonate users, escalate privileges, or gain unauthorized access to syste…
CVE-2025-55705High7.32026-01-22This vulnerability occurs when the system permits multiple simultaneous connections to the backend using the same charging station ID. This can result in una…
CVE-2025-54816Critical9.42026-01-22This vulnerability occurs when a WebSocket endpoint does not enforce proper authentication mechanisms, allowing unauthorized users to establish connections…
CVE-2025-53968High7.52026-01-22This vulnerability arises because there are no limitations on the number of authentication attempts a user can make. An attacker can exploit this weakness by…
CVE-2025-25051Medium6.12026-01-22An attacker could decrypt sensitive data, impersonate legitimate users or devices, and potentially gain access to network resources for lateral attacks.
CVE-2025-9289Medium4.72026-01-22A Cross-Site Scripting (XSS) vulnerability was identified in a parameter in Omada Controllers due to improper input sanitization. Exploitation requires advance…
CVE-2025-147512026-01-22A low-privileged user can bypass account credentials without confirming the user's current authentication state, which may lead to unauthorized privilege escal…
CVE-2025-147502026-01-22The web application does not sufficiently verify inputs that are assumed to be immutable but are actually externally controllable. A low-privileged user can mo…
CVE-2025-22234Medium5.32026-01-22The fix applied in CVE-2025-22228 inadvertently broke the timing attack mitigation implemented in DaoAuthenticationProvider. This can allow attackers to infer…
CVE-2025-68609Medium6.62026-01-22A vulnerability in Palantir's Aries service allowed unauthenticated access to log viewing and management functionality on Apollo instances using default config…
CVE-2025-66428High8.82026-01-22An issue with WordPress directory names in WebPros WordPress Toolkit before 6.9.1 allows privilege escalation.
CVE-2025-56590Critical9.82026-01-22An issue was discovered in the InsertFromURL() function of the Apryse HTML2PDF SDK thru 11.10. This vulnerability could allow an attacker to execute arbitrary…
CVE-2025-70899Medium6.52026-01-22PHPgurukul Online Course Registration v3.1 lacks Cross-Site Request Forgery (CSRF) protection on all administrative forms. An attacker can perform unauthorized…
CVE-2025-69828Critical10.02026-01-22File Upload vulnerability in TMS Global Software TMS Management Console v.6.3.7.27386.20250818 allows a remote attacker to execute arbitrary code via the Logo…
CVE-2025-69321High7.12026-01-22Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Spa grandspa allows Reflected XSS.This i…
CVE-2025-69320High7.12026-01-22Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Magazine grandmagazine allows Reflected…
CVE-2025-69319High7.52026-01-22Improper Control of Generation of Code ('Code Injection') vulnerability in Beaver Builder Beaver Builder beaver-builder-lite-version allows Code Injection.This…
CVE-2025-69318High7.12026-01-22Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hossni Mubarak JobWP jobwp allows Stored XSS.This issue a…
CVE-2025-69317High7.12026-01-22Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in scriptsbundle CarSpot carspot allows Reflected XSS.This i…
CVE-2025-69316High7.12026-01-22Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RealMag777 TableOn posts-table-filterable allows Reflecte…
CVE-2025-69315Medium6.52026-01-22Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Contr…
CVE-2025-69314High8.12026-01-22Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes Werkstatt werkstatt allows…
CVE-2025-69313High7.52026-01-22Missing Authorization vulnerability in WPXPO PostX ultimate-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pos…
CVE-2025-69312Critical9.12026-01-22Unrestricted Upload of File with Dangerous Type vulnerability in Xpro Xpro Elementor Addons xpro-elementor-addons allows Upload a Web Shell to a Web Server.Thi…
CVE-2025-69311High7.62026-01-22Missing Authorization vulnerability in Broadstreet Broadstreet Ads broadstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This iss…
CVE-2025-69300Medium5.42026-01-22Missing Authorization vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control…
CVE-2025-69293High8.82026-01-22Incorrect Privilege Assignment vulnerability in e-plugins Final User final-user allows Privilege Escalation.This issue affects Final User: from n/a through <=…
CVE-2025-69292High8.82026-01-22Incorrect Privilege Assignment vulnerability in e-plugins WP Membership wp-membership allows Privilege Escalation.This issue affects WP Membership: from n/a th…
CVE-2025-69193High7.32026-01-22Missing Authorization vulnerability in e-plugins WP Membership wp-membership allows Exploiting Incorrectly Configured Access Control Security Levels.This issue…
CVE-2025-69192High7.32026-01-22Missing Authorization vulnerability in e-plugins Real Estate Pro real-estate-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This i…
CVE-2025-69191High7.32026-01-22Missing Authorization vulnerability in e-plugins ListingHub listinghub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec…
CVE-2025-69190High7.32026-01-22Missing Authorization vulnerability in e-plugins Listihub listihub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects L…
CVE-2025-69188High7.32026-01-22Missing Authorization vulnerability in e-plugins fitness-trainer fitness-trainer allows Exploiting Incorrectly Configured Access Control Security Levels.This i…
CVE-2025-69187High7.32026-01-22Missing Authorization vulnerability in e-plugins Final User final-user allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec…
CVE-2025-69186High7.32026-01-22Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting Incorrectly Configured Access Control Se…
CVE-2025-69185High7.32026-01-22Missing Authorization vulnerability in e-plugins Hotel Listing hotel-listing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue…
CVE-2025-69184High7.32026-01-22Missing Authorization vulnerability in e-plugins Institutions Directory institutions-directory allows Exploiting Incorrectly Configured Access Control Security…
CVE-2025-69183High8.82026-01-22Incorrect Privilege Assignment vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Privilege Escalation.This issue affects Ho…
CVE-2025-69182High8.82026-01-22Incorrect Privilege Assignment vulnerability in e-plugins Institutions Directory institutions-directory allows Privilege Escalation.This issue affects Institut…
CVE-2025-69181High7.32026-01-22Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configured Access Control Security Levels.This…
CVE-2025-69180High8.52026-01-22Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themepassion Ultra Portfolio ultra-portfolio allows Blind…
CVE-2025-69102High7.12026-01-22Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Boopathi Rajan WP Test Email wp-test-email allows Reflect…
CVE-2025-69101Critical9.82026-01-22Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Workreap Core workreap_core allows Authentication Abuse.This issue affects…
CVE-2025-69100High8.12026-01-22Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in fuelthemes North north-wp allows PHP L…
CVE-2025-69099High8.82026-01-22Deserialization of Untrusted Data vulnerability in fuelthemes North north-wp allows Object Injection.This issue affects North: from n/a through <= 5.7.5.
CVE-2025-69098High7.12026-01-22Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWave Hide My WP hide_my_wp allows Reflected XSS.This is…
CVE-2025-69097High8.62026-01-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in VibeThemes WPLMS wplms_plugin allows Path Traversal.This issue…
CVE-2025-69095Medium6.52026-01-22Missing Authorization vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Exploiting Incorrectly Configured Access Control Security L…
CVE-2025-69079Critical9.82026-01-22Deserialization of Untrusted Data vulnerability in ThemeREX Sound | Musical Instruments Online Store musicplace allows Object Injection.This issue affects Soun…
CVE-2025-69078High8.12026-01-22Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Malta malta allows PHP Lo…
CVE-2025-69077High8.12026-01-22Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Hobo hobo allows PHP Loca…
CVE-2025-69076High8.12026-01-22Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Modern Housewife modernho…
CVE-2025-69075High8.12026-01-22Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Yolox yolox allows PHP Lo…
CVE-2025-69074High8.12026-01-22Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Pearson Specter pearsonsp…
CVE-2025-69073High8.12026-01-22Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Piqes piqes allows PHP Lo…
CVE-2025-69072High8.12026-01-22Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Prider prider allows PHP…
CVE-2025-69071High8.12026-01-22Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes TanTum tantum allows PHP…
CVE-2025-69070High8.12026-01-22Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Tornados tornados allows…