2025 CVEs (page 349)
Page 349 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-27939 | High | 7.5 | 2025-04-15 | An attacker can change registered email addresses of other users and take over arbitrary accounts. |
CVE-2025-27938 | Medium | 5.3 | 2025-04-15 | Unauthenticated attackers can obtain restricted information about a user's smart device collections (i.e., "rooms"). |
CVE-2025-27568 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can get users' emails by knowing usernames. A password reset email will be sent in response to this unsolicited request. |
CVE-2025-24487 | Medium | 5.3 | 2025-04-15 | An unauthenticated attacker can infer the existence of usernames in the system by querying an API. |
CVE-2025-21588 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.4.0-8.4.4 and 9.0.0-9.2.0. Eas… |
CVE-2025-21587 | High | 7.4 | 2025-04-15 | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions… |
CVE-2025-21586 | Medium | 5.4 | 2025-04-15 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.0… |
CVE-2025-21585 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 a… |
CVE-2025-21584 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9… |
CVE-2025-21583 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.4.0 and 9.0.0. Easily exploita… |
CVE-2025-21582 | Medium | 6.1 | 2025-04-15 | Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Preferences). Supported versions that are affected are 12… |
CVE-2025-21581 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 a… |
CVE-2025-21580 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9… |
CVE-2025-21579 | Medium | 4.9 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and… |
CVE-2025-21578 | Medium | 6.7 | 2025-04-15 | Vulnerability in Oracle Secure Backup (component: General). Supported versions that are affected are 12.1.0.1, 12.1.0.2, 12.1.0.3, 18.1.0.0, 18.1.0.1 and 18… |
CVE-2025-21577 | Medium | 6.5 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and 9.0.0-9… |
CVE-2025-21576 | Medium | 5.4 | 2025-04-15 | Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Personalization Server). Supported versions that are affected are… |
CVE-2025-21575 | Medium | 6.5 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and… |
CVE-2025-21574 | Medium | 6.5 | 2025-04-15 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Parser). Supported versions that are affected are 8.0.0-8.0.41, 8.4.0-8.4.4 and… |
CVE-2025-21573 | Medium | 6.0 | 2025-04-15 | Vulnerability in the Oracle Financial Services Revenue Management and Billing product of Oracle Financial Services Applications (component: Chatbot). Supporte… |
CVE-2025-1656 | High | 7.8 | 2025-04-15 | A maliciously crafted PDF file, when linked or imported into Autodesk applications, can force a Heap-Based Overflow vulnerability. A malicious actor can levera… |
CVE-2025-1277 | High | 7.8 | 2025-04-15 | A maliciously crafted PDF file, when parsed through Autodesk applications, can force a Memory Corruption vulnerability. A malicious actor can leverage this vul… |
CVE-2025-1276 | High | 7.8 | 2025-04-15 | A maliciously crafted DWG file, when parsed through certain Autodesk applications, can force an Out-of-Bounds Write vulnerability. A malicious actor may levera… |
CVE-2025-1275 | High | 7.8 | 2025-04-15 | A maliciously crafted JPG file, when linked or imported into certain Autodesk applications, can force a Heap-Based Overflow vulnerability. A malicious actor ca… |
CVE-2025-1274 | High | 7.8 | 2025-04-15 | A maliciously crafted RCS file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage this vulnera… |
CVE-2025-1273 | High | 7.8 | 2025-04-15 | A maliciously crafted PDF file, when linked or imported into Autodesk applications, can force a Heap-Based Overflow vulnerability. A malicious actor can levera… |
CVE-2025-32445 | Critical | 9.9 | 2025-04-15 | Argo Events is an event-driven workflow automation framework for Kubernetes. A user with permission to create/modify EventSource and Sensor custom resources ca… |
CVE-2025-32439 | Medium | 6.5 | 2025-04-15 | pleezer is a headless Deezer Connect player. Hook scripts in pleezer can be triggered by various events like track changes and playback state changes. In versi… |
CVE-2025-32438 | High | 8.8 | 2025-04-15 | make-initrd-ng is a tool for copying binaries and their dependencies. Local privilege escalation affecting all NixOS users. With systemd.shutdownRamfs.enable e… |
CVE-2025-32012 | High | 7.5 | 2025-04-15 | Jellyfin is an open source self hosted media server. In versions 10.9.0 to before 10.10.7, the /System/Restart endpoint provides administrators the ability to… |
CVE-2025-31497 | High | 7.5 | 2025-04-15 | TEIGarage is a webservice and RESTful service to transform, convert and validate various formats, focussing on the TEI format. The Document Conversion Service… |
CVE-2025-30206 | Critical | 9.8 | 2025-04-15 | Dpanel is a Docker visualization panel system which provides complete Docker management functions. The Dpanel service contains a hardcoded JWT secret in its de… |
CVE-2025-2567 | Critical | 9.8 | 2025-04-15 | An attacker could modify or disable settings, disrupt fuel monitoring and supply chain operations, leading to disabling of ATG monitoring. This would result… |
CVE-2025-1292 | Medium | 6.7 | 2025-04-15 | Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 122.0.6261.132 stable on Cr50 Boards allows an attacker with root access to gain persistence… |
CVE-2025-1122 | Medium | 6.7 | 2025-04-15 | Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 15753.50.0 stable on Cr50 Boards allows an attacker with root access to gain persistence and… |
CVE-2025-29213 | Medium | 5.5 | 2025-04-15 | A zip slip vulnerability in the component \service\migrate\MigrateForm.java of JEEWMS v3.7 allows attackers to execute arbitrary code via a crafted Zip file. |
CVE-2025-28399 | Critical | 9.8 | 2025-04-15 | An issue in Erick xmall v.1.1 and before allows a remote attacker to escalate privileges via the updateAddress method of the Address Controller class. |
CVE-2025-27791 | | 2025-04-15 | Collabora Online is a collaborative online office suite based on LibreOffice technology. In versions prior to 24.04.12.4, 23.05.19, and 22.05.25, there is a pa… | |
CVE-2025-25456 | Critical | 9.8 | 2025-04-15 | Tenda AC10 V4.0si_V16.03.10.20 is vulnerable to Buffer Overflow in AdvSetMacMtuWan via mac2. |
CVE-2025-24358 | | 2025-04-15 | gorilla/csrf provides Cross Site Request Forgery (CSRF) prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validat… | |
CVE-2025-22903 | Medium | 4.6 | 2025-04-15 | TOTOLINK N600R V4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the pin parameter in the function setWiFiWpsConfig. |
CVE-2025-22900 | Critical | 9.8 | 2025-04-15 | Totolink N600R v4.3.0cu.7647_B20210106 was discovered to contain a stack overflow via the macCloneMac parameter in the setWanConfig function. |
CVE-2025-3618 | Medium | 5.5 | 2025-04-15 | A denial-of-service vulnerability exists in the Rockwell Automation ThinManager. The software fails to adequately verify the outcome of memory allocation while… |
CVE-2025-3617 | High | 7.8 | 2025-04-15 | A privilege escalation vulnerability exists in the Rockwell Automation ThinManager. When the software starts up, files are deleted in the temporary folder caus… |
CVE-2025-33028 | Medium | 6.1 | 2025-04-15 | In WinZip through 29.0, there is a Mark-of-the-Web Bypass Vulnerability because of an incomplete fix for CVE-2024-8811. This vulnerability allows attackers to… |
CVE-2025-33027 | Medium | 6.1 | 2025-04-15 | In Bandisoft Bandizip through 7.37, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protecti… |
CVE-2025-33026 | Medium | 6.1 | 2025-04-15 | In PeaZip through 10.4.0, there is a Mark-of-the-Web Bypass Vulnerability. This vulnerability allows attackers to bypass the Mark-of-the-Web protection mechani… |
CVE-2025-29705 | Medium | 4.3 | 2025-04-15 | code-gen <=2.0.6 is vulnerable to Incorrect Access Control. The project does not have permission control allowing anyone to access such projects. |
CVE-2025-28100 | Critical | 9.8 | 2025-04-15 | A SQL Injection vulnerability in dingfanzuCMS v.1.0 allows a attacker to execute arbitrary code via not filtering the content correctly at the "operateOrder.ph… |
CVE-2025-32780 | High | 7.3 | 2025-04-15 | BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.6.2 is vulnerable to a DLL Hijacking vulnerability. By… |
CVE-2025-32779 | Medium | 6.5 | 2025-04-15 | E.D.D.I (Enhanced Dialog Driven Interface) is a middleware to connect and manage LLM API bots. In versions before 5.5.0, an attacker with access to the `/backu… |
CVE-2025-32776 | Medium | 5.5 | 2025-04-15 | OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. By writing specially crafted data to… |
CVE-2025-29817 | Medium | 5.7 | 2025-04-15 | Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network. |
CVE-2025-32911 | Critical | 9.0 | 2025-04-15 | A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP cli… |
CVE-2025-28198 | Medium | 5.9 | 2025-04-15 | A SQL injection vulnerability in Hitout car sale 1.0 allows a remote attacker to obtain sensitive information via the orderBy parameter of the StoreController… |
CVE-2025-24949 | Medium | 6.5 | 2025-04-15 | In JotUrl 2.0, is possible to bypass security requirements during the password change process. |
CVE-2025-24948 | Medium | 6.5 | 2025-04-15 | In JotUrl 2.0, passwords are sent via HTTP GET-type requests, potentially exposing credentials to eavesdropping or insecure records. |
CVE-2025-3523 | Medium | 6.4 | 2025-04-15 | When an email contains multiple attachments with external links via the X-Mozilla-External-Attachment-URL header, only the last link is shown when hovering ove… |
CVE-2025-3522 | Medium | 6.3 | 2025-04-15 | Thunderbird processes the X-Mozilla-External-Attachment-URL header to handle attachments which can be hosted externally. When an email is opened, Thunderbird a… |
CVE-2025-32949 | Medium | 6.5 | 2025-04-15 | This vulnerability allows any authenticated user to cause the server to consume very large amounts of disk space when extracting a Zip Bomb. If user import i… |
CVE-2025-32948 | High | 7.5 | 2025-04-15 | The vulnerability allows any attacker to cause the PeerTube server to stop functioning, or in special cases send requests to arbitrary URLs (Blind SSRF). Attac… |
CVE-2025-32947 | High | 7.5 | 2025-04-15 | This vulnerability allows any attacker to cause the PeerTube server to stop responding to requests due to an infinite loop in the "inbox" endpoint when receivi… |
CVE-2025-2830 | Medium | 6.3 | 2025-04-15 | By crafting a malformed file name for an attachment in a multipart message, an attacker can trick Thunderbird into including a directory listing of /tmp when t… |
CVE-2025-29281 | High | 8.8 | 2025-04-15 | In PerfreeBlog version 4.0.11, regular users can exploit the arbitrary file upload vulnerability in the attach component to upload arbitrary files and execute… |
CVE-2025-28145 | Medium | 6.5 | 2025-04-15 | Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a command injection vulnerability via partition in /boafrm/formDisk… |
CVE-2025-28144 | Medium | 6.5 | 2025-04-15 | Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3 1.0.15 was discovered to contain a stack overflow vlunerability via peerPin parameter in the formWsc… |
CVE-2025-28143 | Medium | 6.5 | 2025-04-15 | Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the groupname at the /boafrm/… |
CVE-2025-28142 | Medium | 6.5 | 2025-04-15 | Edimax AC1200 Wave 2 Dual-Band Gigabit Router BR-6478AC V3_1.0.15 was discovered to contain a command injection vulnerability via the foldername in /boafrm/for… |
CVE-2025-27980 | Medium | 6.5 | 2025-04-15 | cashbook v4.0.3 has an arbitrary file read vulnerability in /api/entry/flow/invoice/show?invoice=. |
CVE-2025-29280 | Medium | 4.8 | 2025-04-15 | Stored cross-site scripting vulnerability exists in PerfreeBlog v4.0.11 in the website name field of the backend system settings interface allows an attacker t… |
CVE-2025-28137 | Critical | 9.8 | 2025-04-15 | The TOTOLINK A810R V4.1.2cu.5182_B20201026 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the Not… |
CVE-2025-28136 | Medium | 6.5 | 2025-04-15 | TOTOLINK A800R V4.1.2cu.5137_B20200730 was found to contain a buffer overflow vulnerability in the downloadFile.cgi. |
CVE-2025-3608 | Medium | 6.5 | 2025-04-15 | A race condition existed in nsHttpTransaction that could have been exploited to cause memory corruption, potentially leading to an exploitable condition. This… |
CVE-2025-32946 | Medium | 5.3 | 2025-04-15 | This vulnerability allows any attacker to add playlists to a different user’s channel using the ActivityPub protocol. The vulnerable code sets the owner of the… |
CVE-2025-32945 | Medium | 4.3 | 2025-04-15 | The vulnerability allows an existing user to add playlists to a different user’s channel using the PeerTube REST API. The vulnerable code sets the owner of the… |
CVE-2025-32944 | Medium | 6.5 | 2025-04-15 | The vulnerability allows any authenticated user to cause the PeerTube server to stop functioning in a persistent manner. If user import is enabled (which is t… |
CVE-2025-32103 | Medium | 5.0 | 2025-04-15 | CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows directory traversal via the /WebInterface/function/ URI to read files accessible by SMB at… |
CVE-2025-32102 | Medium | 5.0 | 2025-04-15 | CrushFTP 9.x and 10.x through 10.8.4 and 11.x through 11.3.1 allows SSRF via the host and port parameters in a command=telnetSocket request to the /WebInterfac… |
CVE-2025-32929 | High | 7.5 | 2025-04-15 | Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Generator for WooCommerce embedding-barcodes-into-product-pages-and-orders all… |
CVE-2025-31011 | High | 7.1 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ReichertBrothers SimplyRETS Real Estate IDX simply-rets a… |
CVE-2025-30985 | Critical | 9.8 | 2025-04-15 | Deserialization of Untrusted Data vulnerability in kagla GNUCommerce gnucommerce allows Object Injection.This issue affects GNUCommerce: from n/a through <= 1… |
CVE-2025-30965 | Medium | 4.3 | 2025-04-15 | Cross-Site Request Forgery (CSRF) vulnerability in NotFound WPJobBoard allows Cross Site Request Forgery. This issue affects WPJobBoard: from n/a through n/a. |
CVE-2025-30964 | Medium | 5.4 | 2025-04-15 | Server-Side Request Forgery (SSRF) vulnerability in ThemeGoods Photography photography allows Server Side Request Forgery.This issue affects Photography: from… |
CVE-2025-30962 | High | 7.1 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fs-code FS Poster fs-poster allows Reflected XSS.This iss… |
CVE-2025-26992 | High | 7.1 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fatcatapps Landing Page Cat landing-page-cat allows Refle… |
CVE-2025-26990 | Medium | 4.4 | 2025-04-15 | Server-Side Request Forgery (SSRF) vulnerability in WP Royal Royal Elementor Addons royal-elementor-addons allows Server Side Request Forgery.This issue affect… |
CVE-2025-26982 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Eric-Oliver Mächler DSGVO Youtube dsgvo-youtube allows DO… |
CVE-2025-26959 | High | 8.8 | 2025-04-15 | Missing Authorization vulnerability in Quý Lê 91 Administrator Z administrator-z allows Privilege Escalation.This issue affects Administrator Z: from n/a throu… |
CVE-2025-26958 | High | 7.5 | 2025-04-15 | Missing Authorization vulnerability in Crocoblock JetBlog jet-blog allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetBlog… |
CVE-2025-26955 | Medium | 4.3 | 2025-04-15 | Missing Authorization vulnerability in vowelweb Industrial Lite industrial-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-26954 | High | 7.1 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 1pluginjquery ZooEffect 1-jquery-photo-gallery-slideshow-… |
CVE-2025-26944 | High | 7.5 | 2025-04-15 | Missing Authorization vulnerability in Crocoblock JetPopup jet-popup allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetPopu… |
CVE-2025-26942 | High | 7.5 | 2025-04-15 | Missing Authorization vulnerability in Crocoblock JetTricks jet-tricks allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JetTr… |
CVE-2025-26894 | High | 7.5 | 2025-04-15 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mobeen Abdullah Coming Soon, Maintenan… |
CVE-2025-26889 | High | 7.5 | 2025-04-15 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hockeydata hockeydata LOS hockeydata-l… |
CVE-2025-26745 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RSTheme RS Elements Elementor Addon rselements-lite allow… |
CVE-2025-26744 | Medium | 6.5 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows DOM-Based XSS.This iss… |
CVE-2025-26743 | High | 7.1 | 2025-04-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TC.K Advance WP Query Search Filter advance-wp-query-sear… |
CVE-2025-26741 | High | 8.8 | 2025-04-15 | Missing Authorization vulnerability in AWEOS GmbH Email Notifications for Updates wp-update-mail-notification allows Privilege Escalation.This issue affects Em… |
CVE-2025-32943 | Low | 3.7 | 2025-04-15 | The vulnerability allows any authenticated user to leak the contents of arbitrary “.m3u8” files from the PeerTube server due to a path traversal in the HLS end… |