2025 CVEs (page 354)
Page 354 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-23008 | High | 7.2 | 2025-04-10 | An improper privilege management vulnerability in the SonicWall NetExtender Windows (32 and 64 bit) client allows a low privileged attacker to modify configura… |
CVE-2025-22232 | Medium | 5.3 | 2025-04-10 | Spring Cloud Config Server may not use Vault token sent by clients using a X-CONFIG-TOKEN header when making requests to Vault. Your application may be affecte… |
CVE-2025-24866 | Low | 2.7 | 2025-04-10 | Mattermost versions 9.11.x <= 9.11.8 fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administrat… |
CVE-2025-32382 | | 2025-04-10 | Metabase is an open source Business Intelligence and Embedded Analytics tool. When admins change Snowflake connection details in Metabase (either updating a pa… | |
CVE-2025-32027 | Medium | 6.1 | 2025-04-10 | Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is… |
CVE-2025-29150 | Medium | 4.3 | 2025-04-10 | BlueCMS 1.6 suffers from Arbitrary File Deletion via the id parameter in an /publish.php?act=del request. |
CVE-2025-0362 | Medium | 6.4 | 2025-04-10 | An issue has been discovered in GitLab CE/EE affecting all versions from 7.7 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain conditi… |
CVE-2025-32743 | Critical | 9.0 | 2025-04-10 | In ConnMan through 1.44, the lookup string in ns_resolv in dnsproxy.c can be NULL or an empty string when the TC (Truncated) bit is set in a DNS response. This… |
CVE-2025-32395 | | 2025-04-10 | Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the… | |
CVE-2025-32391 | Medium | 6.4 | 2025-04-10 | HedgeDoc is an open source, real-time, collaborative, markdown notes application. Prior to 1.10.3, a malicious SVG file uploaded to HedgeDoc results in the pos… |
CVE-2025-32383 | Medium | 4.3 | 2025-04-10 | MaxKB (Max Knowledge Base) is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation (RAG)… |
CVE-2025-2469 | Low | 3.7 | 2025-04-10 | An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.9.6, and 17.10 before 17.10.4. The runtime profiling data of a specific… |
CVE-2025-29088 | Medium | 5.6 | 2025-04-10 | In SQLite 3.49.0 before 3.49.1, certain argument values to sqlite3_db_config (in the C-language API) can cause a denial of service (application crash). An sz*n… |
CVE-2025-29017 | High | 8.8 | 2025-04-10 | A Remote Code Execution (RCE) vulnerability exists in Code Astro Internet Banking System 2.0.0 due to improper file upload validation in the profile_pic parame… |
CVE-2025-30148 | Medium | 5.4 | 2025-04-10 | Silverstripe Framework is a PHP framework which powers the Silverstripe CMS. Prior to 5.3.23, bad actor with access to edit content in the CMS could send a spe… |
CVE-2025-2408 | Medium | 5.3 | 2025-04-10 | An issue has been discovered in GitLab CE/EE affecting all versions from 13.12 before 17.8.7, 17.9 before 17.9.6, and 17.10 before 17.10.4. Under certain condi… |
CVE-2025-27813 | High | 8.1 | 2025-04-10 | MSI Center before 2.0.52.0 has Missing PE Signature Validation. |
CVE-2025-27812 | High | 8.1 | 2025-04-10 | MSI Center before 2.0.52.0 allows TOCTOU Local Privilege Escalation. |
CVE-2025-25197 | Medium | 5.4 | 2025-04-10 | Silverstripe Elemental extends a page type to swap the content area for a list of manageable elements to compose a page out of rather than a single text field… |
CVE-2025-1677 | Medium | 6.5 | 2025-04-10 | A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all up to 17.8.7, 17.9 prior to 17.9.6 and 17.10 prior to 17.10.4 A denial of ser… |
CVE-2025-32755 | Critical | 9.1 | 2025-04-10 | In jenkins/ssh-slave Docker images based on Debian, SSH host keys are generated on image creation for images based on Debian, causing all containers based on i… |
CVE-2025-32754 | Critical | 9.1 | 2025-04-10 | In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all containers based o… |
CVE-2025-1073 | High | 7.5 | 2025-04-10 | Panasonic IR Control Hub (IR Blaster) versions 1.17 and earlier may allow an attacker with physical access to load unauthorized firmware onto the device. |
CVE-2025-31411 | Medium | 5.9 | 2025-04-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in aribhour Linet ERP-Woocommerce Integration linet-erp-woocommerc… |
CVE-2025-27350 | High | 7.1 | 2025-04-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hugh Mungus Vice Versa vice-versa allows Reflected XSS.Th… |
CVE-2025-22375 | | 2025-04-10 | An authentication bypass vulnerability was found in Videx's CyberAudit-Web. Through the exploitation of a logic flaw, an attacker could create a valid session… | |
CVE-2025-22374 | | 2025-04-10 | A Server-Side Request Forgery (SSRF) vulnerability was discovered in the videx-legacy-ssl web service of Videx’s CyberAudit-Web, affecting versions prior to 1… | |
CVE-2025-23386 | High | 7.8 | 2025-04-10 | A Incorrect Default Permissions vulnerability in the openSUSE Tumbleweed package gerbera allows the service user gerbera to escalate to root.,This issue affect… |
CVE-2025-27081 | Medium | 6.8 | 2025-04-10 | A potential security vulnerability in HPE NonStop OSM Service Connection Suite could potentially be exploited to allow a local Denial of Service. |
CVE-2025-22279 | High | 7.5 | 2025-04-10 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetCompareWishlist jet-comp… |
CVE-2025-32687 | High | 8.5 | 2025-04-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Magnigenie Review Stars Count For WooCommerce review-star… |
CVE-2025-32668 | High | 8.1 | 2025-04-10 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Rameez Iqbal Real Estate Manager real-… |
CVE-2025-32282 | Medium | 4.3 | 2025-04-10 | Cross-Site Request Forgery (CSRF) vulnerability in ShareThis ShareThis Dashboard for Google Analytics googleanalytics.This issue affects ShareThis Dashboard fo… |
CVE-2025-32275 | Medium | 4.3 | 2025-04-10 | Authentication Bypass by Spoofing vulnerability in Ays Pro Survey Maker survey-maker allows Identity Spoofing.This issue affects Survey Maker: from n/a through… |
CVE-2025-32260 | Medium | 5.3 | 2025-04-10 | Missing Authorization vulnerability in Detheme DethemeKit For Elementor dethemekit-for-elementor.This issue affects DethemeKit For Elementor: from n/a through… |
CVE-2025-32259 | Medium | 5.3 | 2025-04-10 | Missing Authorization vulnerability in Alimir WP ULike wp-ulike.This issue affects WP ULike: from n/a through <= 4.7.9.1. |
CVE-2025-32244 | Medium | 6.5 | 2025-04-10 | Missing Authorization vulnerability in QuantumCloud SEO Help seo-help allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-32243 | Medium | 6.5 | 2025-04-10 | Missing Authorization vulnerability in Toast Plugins Internal Link Optimiser internal-link-finder allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-32242 | Medium | 6.5 | 2025-04-10 | Missing Authorization vulnerability in Hive Support Hive Support hive-support allows Accessing Functionality Not Properly Constrained by ACLs.This issue affect… |
CVE-2025-32240 | Medium | 6.5 | 2025-04-10 | Missing Authorization vulnerability in wpvsingh Site Notify site-notify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-32236 | Medium | 4.3 | 2025-04-10 | Missing Authorization vulnerability in Vagonic Woocommerce Products Reorder Drag Drop Multiple Sort – Sortable, Rearrange Products Vagonic vagonic-sortable.Thi… |
CVE-2025-32230 | Medium | 4.3 | 2025-04-10 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Tutor LMS tutor.This issue affects Tutor LMS: from n/a t… |
CVE-2025-32228 | Medium | 4.3 | 2025-04-10 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in WP Messiah Ai Image Alt Text Generator for WP ai-image-alt-text-gen… |
CVE-2025-32227 | Medium | 4.3 | 2025-04-10 | Authentication Bypass by Spoofing vulnerability in Asgaros Asgaros Forum asgaros-forum allows Identity Spoofing.This issue affects Asgaros Forum: from n/a thro… |
CVE-2025-32221 | Medium | 5.4 | 2025-04-10 | Missing Authorization vulnerability in Spider Themes EazyDocs eazydocs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-32216 | Medium | 6.4 | 2025-04-10 | Missing Authorization vulnerability in Spider Themes Spider Elements spider-elements allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-32215 | Medium | 6.5 | 2025-04-10 | Unrestricted Upload of File with Dangerous Type vulnerability in Ability, Inc Accessibility Suite online-accessibility allows Stored XSS.This issue affects Acc… |
CVE-2025-32214 | Medium | 6.5 | 2025-04-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hive Support Hive Support hive-support allows Stored XSS… |
CVE-2025-32213 | Medium | 6.5 | 2025-04-10 | Missing Authorization vulnerability in flothemesplugins Flo Forms flo-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-32212 | Medium | 6.5 | 2025-04-10 | Missing Authorization vulnerability in Specia Theme Specia Companion specia-companion allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-32210 | Medium | 6.5 | 2025-04-10 | Missing Authorization vulnerability in CreativeMindsSolutions CM Registration and Invitation Codes cm-invitation-codes allows Exploiting Incorrectly Configured… |
CVE-2025-32209 | Medium | 6.5 | 2025-04-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in totalprocessing Nomupay Payment Processing Gateway totalprocess… |
CVE-2025-32208 | Medium | 6.5 | 2025-04-10 | Missing Authorization vulnerability in Hive Support Hive Support hive-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-32206 | Critical | 9.1 | 2025-04-10 | Unrestricted Upload of File with Dangerous Type vulnerability in LABCAT Processing Projects processing-projects allows Upload a Web Shell to a Web Server.This… |
CVE-2025-32205 | Low | 2.7 | 2025-04-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in piotnetdotcom Piotnet Forms piotnetforms.This issue affects Pio… |
CVE-2025-32202 | Critical | 9.1 | 2025-04-10 | Unrestricted Upload of File with Dangerous Type vulnerability in Brian Batt - elearningfreak.com Insert or Embed Articulate Content into WordPress insert-or-em… |
CVE-2025-32199 | Medium | 6.5 | 2025-04-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eyale-vc Contact Form Builder by vcita contact-form-with-… |
CVE-2025-32198 | Medium | 6.5 | 2025-04-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themefusecom Brizy brizy.This issue affects Brizy: from n… |
CVE-2025-32160 | High | 7.5 | 2025-04-10 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ashan Perera EventON eventon-lite.This… |
CVE-2025-32158 | High | 7.5 | 2025-04-10 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Syed Balkhi aThemes Addons for Element… |
CVE-2025-32145 | High | 8.8 | 2025-04-10 | Deserialization of Untrusted Data vulnerability in magepeopleteam WpEvently mage-eventpress allows Object Injection.This issue affects WpEvently: from n/a thro… |
CVE-2025-32140 | Critical | 9.9 | 2025-04-10 | Unrestricted Upload of File with Dangerous Type vulnerability in Nirmal Kumar Ram WP Remote Thumbnail wp-remote-thumbnail allows Upload a Web Shell to a Web Se… |
CVE-2025-32139 | Medium | 5.9 | 2025-04-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FooPlugins FooBox Image Lightbox foobox-image-lightbox.T… |
CVE-2025-32128 | High | 7.6 | 2025-04-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in aaronfrey Nearby Locations nearby-locations allows SQL In… |
CVE-2025-32119 | High | 8.2 | 2025-04-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in CardGate CardGate Payments for WooCommerce cardgate allow… |
CVE-2025-32116 | High | 7.1 | 2025-04-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Studi7 QR Master qr-master allows Reflected XSS.This issu… |
CVE-2025-32115 | High | 7.1 | 2025-04-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Popping Content Light popping-content-light all… |
CVE-2025-32114 | High | 7.1 | 2025-04-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 5sterrenspecialist WordPress 5sterrenspecialist Plugin 5-… |
CVE-2025-31524 | High | 8.8 | 2025-04-10 | Incorrect Privilege Assignment vulnerability in John James Jacoby WP User Profiles wp-users-profiles allows Privilege Escalation.This issue affects WP User Pro… |
CVE-2025-30582 | High | 8.1 | 2025-04-10 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in aytechnet DyaPress ERP/CRM dyapress allows PHP Local File Inclu… |
CVE-2025-3417 | High | 8.8 | 2025-04-10 | The Embedder plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on… |
CVE-2025-2809 | High | 7.3 | 2025-04-10 | The azurecurve Shortcodes in Comments plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.2. This is… |
CVE-2025-2805 | High | 7.3 | 2025-04-10 | The ORDER POST plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.0.2. This is due to the software all… |
CVE-2025-2719 | Medium | 6.5 | 2025-04-10 | The Swatchly – WooCommerce Variation Swatches for Products (product attributes: Image swatch, Color swatches, Label swatches) plugin for WordPress is vulnerabl… |
CVE-2025-0539 | High | 8.8 | 2025-04-10 | In affected Microsoft Windows versions of Octopus Deploy, the server can be coerced into sending server-side requests that contain authentication material allo… |
CVE-2025-3102 | High | 8.1 | 2025-04-10 | The SureTriggers: All-in-One Automation Platform plugin for WordPress is vulnerable to an authentication bypass leading to administrative account creation due… |
CVE-2025-3489 | Medium | 4.3 | 2025-04-10 | A vulnerability was found in Nababur Simple-User-Management-System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality… |
CVE-2025-27690 | Critical | 9.8 | 2025-04-10 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.1.0, contains a use of default password vulnerability. An unauthenticated attacker with remote access coul… |
CVE-2025-26480 | Medium | 5.3 | 2025-04-10 | Dell PowerScale OneFS, versions 9.5.0.0 through 9.10.0.0, contains an uncontrolled resource consumption vulnerability. An unauthenticated attacker with remote… |
CVE-2025-26479 | Low | 3.1 | 2025-04-10 | Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.0, contains an out-of-bounds write vulnerability. An attacker could potentially exploit this vulnerabili… |
CVE-2025-26330 | High | 7.0 | 2025-04-10 | Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.1, contains an incorrect authorization vulnerability. An unauthenticated attacker with local access coul… |
CVE-2025-23378 | Low | 3.3 | 2025-04-10 | Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.0, contains an exposure of information through directory listing vulnerability. A low privileged attacke… |
CVE-2025-22471 | Medium | 6.5 | 2025-04-10 | Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.0.1, contains an integer overflow or wraparound vulnerability. An unauthenticated attacker with remote acc… |
CVE-2025-32728 | Medium | 4.3 | 2025-04-10 | In sshd in OpenSSH before 10.0, the DisableForwarding directive does not adhere to the documentation stating that it disables X11 and agent forwarding. |
CVE-2025-29989 | Low | 3.1 | 2025-04-10 | Dell Client Platform BIOS contains a Security Version Number Mutable to Older Versions vulnerability. A high privileged attacker with local access could potent… |
CVE-2025-32387 | Medium | 6.5 | 2025-04-09 | Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to pars… |
CVE-2025-32386 | Medium | 6.5 | 2025-04-09 | Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed (e… |
CVE-2025-24375 | Medium | 5.0 | 2025-04-09 | Charmed MySQL K8s operator is a Charmed Operator for running MySQL on Kubernetes. Before revision 221, the method for calling a SQL DDL or python based mysql-s… |
CVE-2025-29018 | Medium | 4.8 | 2025-04-09 | A Stored Cross-Site Scripting (XSS) vulnerability exists in the name parameter of pages_add_acc_type.php in Code Astro Internet Banking System 2.0.0. |
CVE-2025-30660 | High | 7.5 | 2025-04-09 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series allows an… |
CVE-2025-30659 | High | 7.5 | 2025-04-09 | An Improper Handling of Length Parameter Inconsistency vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on SRX Series allows an… |
CVE-2025-30658 | High | 7.5 | 2025-04-09 | A Missing Release of Memory after Effective Lifetime vulnerability in the Anti-Virus processing of Juniper Networks Junos OS on SRX Series allows an unauthen… |
CVE-2025-30657 | Medium | 5.3 | 2025-04-09 | An Improper Encoding or Escaping of Output vulnerability in the Sampling Route Record Daemon (SRRD) of Juniper Networks Junos OS allows an unauthenticated, net… |
CVE-2025-30656 | High | 7.5 | 2025-04-09 | An Improper Handling of Additional Special Element vulnerability in the Packet Forwarding Engine (PFE) of Juniper Networks Junos OS on MX Series with MS-MPC, M… |
CVE-2025-30655 | Medium | 5.5 | 2025-04-09 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved al… |
CVE-2025-30654 | Medium | 5.5 | 2025-04-09 | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in the User Interface (UI) of Juniper Networks Junos OS and Junos OS Evolved allows… |
CVE-2025-30653 | Medium | 6.5 | 2025-04-09 | An Expired Pointer Dereference vulnerability in Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, adja… |
CVE-2025-30652 | Medium | 5.5 | 2025-04-09 | An Improper Handling of Exceptional Conditions vulnerability in routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local… |
CVE-2025-30651 | High | 7.5 | 2025-04-09 | A Buffer Access with Incorrect Length Value vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unau… |
CVE-2025-30649 | High | 7.5 | 2025-04-09 | An Improper Input Validation vulnerability in the syslog stream TCP transport of Juniper Networks Junos OS on MX240, MX480 and MX960 devices with MX-SPC3 Secur… |