2025 CVEs (page 341)
Page 341 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-39930 | High | 8.4 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: ASoC: simple-card-utils: Don't use __free(device_node) at graph_util_parse_dai() commit 4… |
CVE-2025-39778 | High | 7.1 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: objtool, nvmet: Fix out-of-bounds stack access in nvmet_ctrl_state_show() The csts_state_… |
CVE-2025-39755 | Medium | 5.5 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: staging: gpib: Fix cb7210 pcmcia Oops The pcmcia_driver struct was still only using the… |
CVE-2025-39735 | High | 7.1 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: jfs: fix slab-out-of-bounds read in ea_get() During the "size_check" label in ea_get(), t… |
CVE-2025-39728 | Medium | 5.5 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: clk: samsung: Fix UBSAN panic in samsung_clk_init() With UBSAN_ARRAY_BOUNDS=y, I'm hittin… |
CVE-2025-39688 | High | 7.5 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: nfsd: allow SC_STATUS_FREEABLE when searching via nfs4_lookup_stateid() The pynfs DELEG8… |
CVE-2025-38637 | Medium | 5.5 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: net_sched: skbprio: Remove overly strict queue assertions In the current implementation… |
CVE-2025-38575 | Medium | 5.5 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: use aead_request_free to match aead_request_alloc Use aead_request_free() instead… |
CVE-2025-38479 | High | 7.8 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: free irq correctly in remove path Add fsl_edma->txirq/errirq check t… |
CVE-2025-38240 | Medium | 5.5 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: dp: drm_err => dev_err in HPD path to avoid NULL ptr The function mtk_dp_wa… |
CVE-2025-38152 | Medium | 5.5 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: remoteproc: core: Clear table_sz when rproc_shutdown There is case as below could trigger… |
CVE-2025-38104 | Medium | 4.7 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Replace Mutex with Spinlock for RLCG register access to avoid Priority Inversi… |
CVE-2025-38049 | Medium | 5.5 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: x86/resctrl: Fix allocation of cleanest CLOSID on platforms with no monitors Commit 6e… |
CVE-2025-37925 | Medium | 5.5 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: jfs: reject on-disk inodes of an unsupported type Syzbot has reported the following BUG: … |
CVE-2025-37893 | High | 7.8 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Fix off-by-one error in build_prologue() Vincent reported that running BP… |
CVE-2025-37860 | Medium | 5.5 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: sfc: fix NULL dereferences in ef100_process_design_param() Since cited commit, ef100_prob… |
CVE-2025-37785 | High | 7.8 | 2025-04-18 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix OOB read when checking dotdot dir Mounting a corrupted filesystem with director… |
CVE-2025-3783 | Medium | 6.3 | 2025-04-18 | A vulnerability classified as critical was found in SourceCodester Web-based Pharmacy Product Management System 1.0. Affected by this vulnerability is an unkno… |
CVE-2025-3598 | Medium | 6.1 | 2025-04-18 | The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the commission_summary parame… |
CVE-2025-2162 | Medium | 4.8 | 2025-04-18 | The MapPress Maps for WordPress plugin before 2.94.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2025-1863 | Critical | 9.8 | 2025-04-18 | Insecure default settings have been found in recorder products provided by Yokogawa Electric Corporation. The default setting of the authentication function is… |
CVE-2025-39471 | Critical | 9.3 | 2025-04-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in pantherius Modal Survey modal-survey.This issue affects M… |
CVE-2025-39470 | High | 8.1 | 2025-04-18 | Path Traversal: '.../...//' vulnerability in ThimPress Ivy School ivy-school allows PHP Local File Inclusion.This issue affects Ivy School: from n/a through <=… |
CVE-2025-39469 | High | 7.1 | 2025-04-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pantherius Modal Survey modal-survey.This issue affects M… |
CVE-2025-42599 | Critical | 9.8 | 2025-04-18 | Active! mail 6 BuildInfo: 6.60.05008561 and earlier contains a stack-based buffer overflow vulnerability. Receiving a specially crafted request created and sen… |
CVE-2025-3520 | High | 8.1 | 2025-04-18 | The Avatar plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in a function in all versions up to, and incl… |
CVE-2025-2613 | Medium | 4.4 | 2025-04-18 | The Login Manager – Design Login Page, View Login Activity, Limit Login Attempts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom l… |
CVE-2025-25427 | Medium | 5.4 | 2025-04-18 | A stored cross-site scripting (XSS) vulnerability in the upnp.htm page of the web Interface in TP-Link WR841N v14/v14.6/v14.8 <= Build 241230 Rel. 50788n allow… |
CVE-2025-0467 | High | 8.2 | 2025-04-18 | Kernel software installed and running inside a Guest VM may exploit memory shared with the GPU Firmware to write data outside the Guest's virtualised GPU memor… |
CVE-2025-3509 | High | 7.2 | 2025-04-17 | A Remote Code Execution (RCE) vulnerability was identified in GitHub Enterprise Server that allowed attackers to execute arbitrary code by exploiting the pre-r… |
CVE-2025-3246 | High | 7.6 | 2025-04-17 | An improper neutralization of input vulnerability was identified in GitHub Enterprise Server that allowed cross-site scripting in GitHub Markdown that used `$$… |
CVE-2025-3124 | Medium | 4.3 | 2025-04-17 | A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a user to see the names of private repositories that they wouldn'… |
CVE-2025-29461 | High | 7.6 | 2025-04-17 | An issue in a-blogcms 3.1.15 allows a remote attacker to obtain sensitive information via the /bid/1/admin/entry-edit/ path. |
CVE-2025-29460 | High | 7.6 | 2025-04-17 | An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Add Mycode function. NOTE: the Supplier disputes this because of the a… |
CVE-2025-29459 | High | 7.6 | 2025-04-17 | An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Mail function. NOTE: the Supplier disputes this because of the allowed… |
CVE-2025-29458 | High | 7.6 | 2025-04-17 | An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Change Avatar function. NOTE: the Supplier disputes this because of th… |
CVE-2025-29457 | High | 7.6 | 2025-04-17 | An issue in MyBB 1.8.38 allows a remote attacker to obtain sensitive information via the Import a Theme function. NOTE: the Supplier disputes this because of t… |
CVE-2025-29456 | Medium | 6.5 | 2025-04-17 | An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the create Notes function. |
CVE-2025-29453 | Medium | 6.5 | 2025-04-17 | An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the my-contacts-settings… |
CVE-2025-29455 | Medium | 6.5 | 2025-04-17 | An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Travel Ideas" functio… |
CVE-2025-29454 | Medium | 6.5 | 2025-04-17 | An issue in personal-management-system Personal Management System 1.4.65 allows a remote attacker to obtain sensitive information via the Upload function. |
CVE-2025-29452 | High | 7.6 | 2025-04-17 | An issue in Seo Panel 4.11.0 allows a remote attacker to obtain sensitive information via the Proxy Manager component. |
CVE-2025-29451 | High | 7.6 | 2025-04-17 | An issue in Seo Panel 4.11.0 allows a remote attacker to obtain sensitive information via the Mail Setting component. |
CVE-2025-29450 | Medium | 6.5 | 2025-04-17 | An issue in twonav v.2.1.18-20241105 allows a remote attacker to obtain sensitive information via the site settings component. |
CVE-2025-29449 | Medium | 6.5 | 2025-04-17 | An issue in twonav v.2.1.18-20241105 allows a remote attacker to obtain sensitive information via the link identification function. |
CVE-2025-3765 | Medium | 6.3 | 2025-04-17 | A vulnerability, which was classified as critical, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This issue affects some u… |
CVE-2025-3764 | Medium | 6.3 | 2025-04-17 | A vulnerability classified as critical was found in SourceCodester Web-based Pharmacy Product Management System 1.0. This vulnerability affects unknown code of… |
CVE-2025-3763 | Medium | 5.3 | 2025-04-17 | A vulnerability classified as critical has been found in SourceCodester Phone Management System 1.0. This affects the function main of the component Password H… |
CVE-2025-3762 | High | 7.3 | 2025-04-17 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. Affected by this issue is some unknown functionality of the component MPUT… |
CVE-2025-29316 | Medium | 6.2 | 2025-04-17 | An issue in DataPatrol Screenshot watermark, printing watermark agent v.3.5.2.0 allows a physically proximate attacker to obtain sensitive information. NOTE: t… |
CVE-2025-29722 | Medium | 6.3 | 2025-04-17 | A CSRF vulnerability in Commercify v1.0 allows remote attackers to perform unauthorized actions on behalf of authenticated users. The issue exists due to missi… |
CVE-2025-28101 | Medium | 6.5 | 2025-04-17 | An arbitrary file deletion vulnerability in the /post/{postTitle} component of flaskBlog v2.6.1 allows attackers to delete article titles created by other user… |
CVE-2025-28009 | Critical | 9.8 | 2025-04-17 | A SQL Injection vulnerability exists in the `u` parameter of the progress-body-weight.php endpoint of Dietiqa App v1.0.20. |
CVE-2025-26269 | Low | 3.3 | 2025-04-17 | DragonflyDB Dragonfly through 1.28.2 (fixed in 1.29.0) allows authenticated users to cause a denial of service (daemon crash) via a Lua library command that re… |
CVE-2025-26268 | Low | 3.3 | 2025-04-17 | DragonflyDB Dragonfly before 1.27.0 allows authenticated users to cause a denial of service (daemon crash) via a crafted Redis command. The validity of the sca… |
CVE-2025-25455 | High | 7.5 | 2025-04-17 | Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via wanMTU2. |
CVE-2025-25454 | High | 7.5 | 2025-04-17 | Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via wanSpeed2. |
CVE-2025-32415 | Low | 2.9 | 2025-04-17 | In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploit this, a crafted XM… |
CVE-2025-2947 | High | 7.2 | 2025-04-17 | IBM i 7.6 contains a privilege escalation vulnerability due to incorrect profile swapping in an OS command. A malicious actor can use the command to elevate… |
CVE-2025-29662 | Critical | 9.8 | 2025-04-17 | A RCE vulnerability in the core application in LandChat 3.25.12.18 allows an unauthenticated attacker to execute system code via remote network access. |
CVE-2025-29661 | High | 7.2 | 2025-04-17 | Litepubl CMS <= 7.0.9 is vulnerable to RCE in admin/service/run. |
CVE-2025-29181 | High | 7.2 | 2025-04-17 | FOXCMS <= V1.25 is vulnerable to SQL Injection via $param['title'] in /admin/util/Field.php. |
CVE-2025-29180 | High | 7.2 | 2025-04-17 | In FOXCMS <=1.25, the installdb.php file has a time - based blind SQL injection vulnerability. The url_prefix, domain, and my_website POST parameters are direc… |
CVE-2025-29039 | High | 7.2 | 2025-04-17 | An issue in dlink DIR 832x 240802 allows a remote attacker to execute arbitrary code via the function 0x41dda8 |
CVE-2025-43015 | High | 8.3 | 2025-04-17 | In JetBrains RubyMine before 2025.1 remote Interpreter overwrote ports to listen on all interfaces |
CVE-2025-43014 | Medium | 6.1 | 2025-04-17 | In JetBrains Toolbox App before 2.6 the SSH plugin established connections without sufficient user confirmation |
CVE-2025-43013 | Medium | 6.9 | 2025-04-17 | In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possible |
CVE-2025-43012 | High | 8.3 | 2025-04-17 | In JetBrains Toolbox App before 2.6 command injection in SSH plugin was possible |
CVE-2025-42921 | Medium | 4.2 | 2025-04-17 | In JetBrains Toolbox App before 2.6 host key verification was missing in SSH plugin |
CVE-2025-39596 | Critical | 9.8 | 2025-04-17 | Weak Authentication vulnerability in Quentn.com GmbH Quentn WP quentn-wp allows Privilege Escalation.This issue affects Quentn WP: from n/a through <= 1.2.8. |
CVE-2025-39595 | Critical | 9.3 | 2025-04-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Quentn.com GmbH Quentn WP quentn-wp allows SQL Injection… |
CVE-2025-39594 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Arigato Autoresponder and Newsletter bft-autoresponde… |
CVE-2025-39588 | Critical | 9.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Object Injection.This issue affects U… |
CVE-2025-39587 | Critical | 9.3 | 2025-04-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix Cost Calculator Builder cost-calculator-builder… |
CVE-2025-39586 | High | 8.5 | 2025-04-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-a… |
CVE-2025-39583 | High | 7.1 | 2025-04-17 | Missing Authorization vulnerability in Bertha AI – Andrew Palmer BERTHA AI bertha-ai-free allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-39580 | Medium | 5.8 | 2025-04-17 | Missing Authorization vulnerability in jidaikobo Dashi dashi allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Dashi: from n/a… |
CVE-2025-39569 | High | 8.5 | 2025-04-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in taskbuilder Taskbuilder taskbuilder allows Blind SQL Inje… |
CVE-2025-39568 | High | 7.5 | 2025-04-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Arture B.V. StoreContrl Woocommerce storecontrl-wp-connection a… |
CVE-2025-39567 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamalli Web Directory Free web-directory-free allows Ref… |
CVE-2025-39562 | Medium | 5.9 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Payment Form for PayPal Pro payment-form-for-p… |
CVE-2025-39559 | Medium | 6.5 | 2025-04-17 | Missing Authorization vulnerability in Eivin Landa Bring Fraktguiden for WooCommerce bring-fraktguiden-for-woocommerce allows Exploiting Incorrectly Configured… |
CVE-2025-39558 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM Perks support-x allows Reflected XSS.This i… |
CVE-2025-39554 | Medium | 6.5 | 2025-04-17 | Missing Authorization vulnerability in Elliot Sowersby / RelyWP AI Text to Speech ai-text-to-speech allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-39551 | Critical | 9.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in Mahmudul Hasan Arif FluentBoards fluent-boards allows Object Injection.This issue affects FluentBoards: from… |
CVE-2025-39550 | Critical | 9.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in Shahjahan Jewel FluentCommunity fluent-community allows Object Injection.This issue affects FluentCommunity… |
CVE-2025-39542 | High | 8.8 | 2025-04-17 | Incorrect Privilege Assignment vulnerability in Jauhari Xelion Xelion Webchat xelion-webchat allows Privilege Escalation.This issue affects Xelion Webchat: fro… |
CVE-2025-39535 | High | 7.2 | 2025-04-17 | Authentication Bypass Using an Alternate Path or Channel vulnerability in appsbd Vitepos vitepos-lite allows Authentication Abuse.This issue affects Vitepos: f… |
CVE-2025-39533 | High | 8.8 | 2025-04-17 | Missing Authorization vulnerability in Starfish Reviews Starfish Review Generation & Marketing starfish-reviews allows Privilege Escalation.This issue affects… |
CVE-2025-39532 | High | 7.5 | 2025-04-17 | Missing Authorization vulnerability in spicethemes Spice Blocks spice-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-39527 | High | 8.8 | 2025-04-17 | Deserialization of Untrusted Data vulnerability in bestweblayout Rating by BestWebSoft rating-bws allows Object Injection.This issue affects Rating by BestWebS… |
CVE-2025-39526 | High | 8.1 | 2025-04-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nicdark Hotel Booking nd-booking allow… |
CVE-2025-39521 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani Contact Form vCard Generator contact-form-vc… |
CVE-2025-39519 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in runthings.dev Bulk Page Stub Creator bulk-page-stub-creat… |
CVE-2025-39464 | High | 7.1 | 2025-04-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in rtowebsites AdminQuickbar adminquickbar allows Reflected… |
CVE-2025-39462 | High | 7.5 | 2025-04-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in teamzt Smart Agreements smart-agreemen… |
CVE-2025-39461 | High | 7.5 | 2025-04-17 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nawawi Jamili Docket Cache docket-cach… |
CVE-2025-39457 | Medium | 5.3 | 2025-04-17 | Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Confi… |
CVE-2025-39456 | Medium | 5.4 | 2025-04-17 | Missing Authorization vulnerability in iTRON WP Logger wp-data-logger allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-39455 | High | 7.1 | 2025-04-17 | Cross-Site Request Forgery (CSRF) vulnerability in IP2Location IP2Location Variables ip2location-variables allows Reflected XSS.This issue affects IP2Location… |