2025 CVEs (page 356)
Page 356 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-27727 | High | 7.8 | 2025-04-08 | Improper link resolution before file access ('link following') in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2025-27492 | High | 7.0 | 2025-04-08 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Secure Channel allows an authorized attacker to elevate… |
CVE-2025-27491 | High | 7.1 | 2025-04-08 | Use after free in Windows Hyper-V allows an authorized attacker to execute code over a network. |
CVE-2025-27490 | High | 7.8 | 2025-04-08 | Heap-based buffer overflow in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-27489 | High | 7.8 | 2025-04-08 | Improper input validation in Azure Local allows an authorized attacker to elevate privileges locally. |
CVE-2025-27487 | High | 8.0 | 2025-04-08 | Heap-based buffer overflow in Remote Desktop Client allows an authorized attacker to execute code over a network. |
CVE-2025-27486 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-27485 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-27484 | High | 7.5 | 2025-04-08 | Sensitive data storage in improperly locked memory in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges ov… |
CVE-2025-27483 | High | 7.8 | 2025-04-08 | Out-of-bounds read in Windows NTFS allows an unauthorized attacker to elevate privileges locally. |
CVE-2025-27482 | High | 8.1 | 2025-04-08 | Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network. |
CVE-2025-27481 | High | 8.8 | 2025-04-08 | Stack-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network. |
CVE-2025-27480 | High | 8.1 | 2025-04-08 | Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network. |
CVE-2025-27479 | High | 7.5 | 2025-04-08 | Insufficient resource pool in Windows Kerberos allows an unauthorized attacker to deny service over a network. |
CVE-2025-27478 | High | 7.0 | 2025-04-08 | Heap-based buffer overflow in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally. |
CVE-2025-27477 | High | 8.8 | 2025-04-08 | Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network. |
CVE-2025-27476 | High | 7.8 | 2025-04-08 | Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally. |
CVE-2025-27475 | High | 7.0 | 2025-04-08 | Sensitive data storage in improperly locked memory in Windows Update Stack allows an authorized attacker to elevate privileges locally. |
CVE-2025-27474 | Medium | 6.5 | 2025-04-08 | Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-27473 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows HTTP.sys allows an unauthorized attacker to deny service over a network. |
CVE-2025-27472 | Medium | 5.4 | 2025-04-08 | Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2025-27471 | Medium | 5.9 | 2025-04-08 | Sensitive data storage in improperly locked memory in Microsoft Streaming Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-27470 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-27469 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network. |
CVE-2025-27467 | High | 7.8 | 2025-04-08 | Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally. |
CVE-2025-27205 | Medium | 5.4 | 2025-04-08 | Adobe Experience Manager Screens versions FP11.3 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low pr… |
CVE-2025-27204 | Medium | 5.5 | 2025-04-08 | After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2025-27202 | Medium | 5.5 | 2025-04-08 | Animate versions 24.0.7, 23.0.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2025-27201 | Medium | 5.5 | 2025-04-08 | Animate versions 24.0.7, 23.0.10 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker… |
CVE-2025-27200 | High | 7.8 | 2025-04-08 | Animate versions 24.0.7, 23.0.10 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the… |
CVE-2025-27199 | High | 7.8 | 2025-04-08 | Animate versions 24.0.7, 23.0.10 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the co… |
CVE-2025-27198 | High | 7.8 | 2025-04-08 | Photoshop Desktop versions 25.12.1, 26.4.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution… |
CVE-2025-27196 | High | 7.8 | 2025-04-08 | Premiere Pro versions 25.1, 24.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the… |
CVE-2025-27195 | High | 7.8 | 2025-04-08 | Media Encoder versions 25.1, 24.6.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the… |
CVE-2025-27194 | High | 7.8 | 2025-04-08 | Media Encoder versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2025-27193 | High | 7.8 | 2025-04-08 | Bridge versions 14.1.5, 15.0.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-27187 | Medium | 5.5 | 2025-04-08 | After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2025-27186 | Medium | 5.5 | 2025-04-08 | After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2025-27185 | Medium | 5.5 | 2025-04-08 | After Effects versions 25.1, 24.6.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service… |
CVE-2025-27184 | Medium | 5.5 | 2025-04-08 | After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2025-27183 | High | 7.8 | 2025-04-08 | After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2025-27182 | High | 7.8 | 2025-04-08 | After Effects versions 25.1, 24.6.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2025-26688 | High | 7.8 | 2025-04-08 | Stack-based buffer overflow in Microsoft Virtual Hard Drive allows an authorized attacker to elevate privileges locally. |
CVE-2025-26687 | High | 7.5 | 2025-04-08 | Use after free in Windows Win32K - GRFX allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-26686 | High | 7.5 | 2025-04-08 | Sensitive data storage in improperly locked memory in Windows TCP/IP allows an unauthorized attacker to execute code over a network. |
CVE-2025-26682 | High | 7.5 | 2025-04-08 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
CVE-2025-26681 | Medium | 6.7 | 2025-04-08 | Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. |
CVE-2025-26680 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-26679 | High | 7.8 | 2025-04-08 | Use after free in RPC Endpoint Mapper Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-26678 | High | 8.4 | 2025-04-08 | Improper access control in Windows Defender Application Control (WDAC) allows an unauthorized attacker to bypass a security feature locally. |
CVE-2025-26676 | Medium | 6.5 | 2025-04-08 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-26675 | High | 7.8 | 2025-04-08 | Out-of-bounds read in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. |
CVE-2025-26674 | High | 7.8 | 2025-04-08 | Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code locally. |
CVE-2025-26673 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network. |
CVE-2025-26672 | Medium | 6.5 | 2025-04-08 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-26671 | High | 8.1 | 2025-04-08 | Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network. |
CVE-2025-26670 | High | 8.1 | 2025-04-08 | Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network. |
CVE-2025-26669 | High | 8.8 | 2025-04-08 | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-26668 | High | 7.5 | 2025-04-08 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
CVE-2025-26667 | Medium | 6.5 | 2025-04-08 | Exposure of sensitive information to an unauthorized actor in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose info… |
CVE-2025-26666 | High | 7.8 | 2025-04-08 | Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code locally. |
CVE-2025-26665 | High | 7.0 | 2025-04-08 | Sensitive data storage in improperly locked memory in Windows upnphost.dll allows an authorized attacker to elevate privileges locally. |
CVE-2025-26664 | Medium | 6.5 | 2025-04-08 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-26663 | High | 8.1 | 2025-04-08 | Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network. |
CVE-2025-26652 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-26651 | Medium | 6.5 | 2025-04-08 | Exposed dangerous method or function in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network. |
CVE-2025-26649 | High | 7.0 | 2025-04-08 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Secure Channel allows an authorized attacker to elevate… |
CVE-2025-26648 | High | 7.8 | 2025-04-08 | Sensitive data storage in improperly locked memory in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2025-26647 | High | 8.8 | 2025-04-08 | Improper input validation in Windows Kerberos allows an authorized attacker to elevate privileges over a network. |
CVE-2025-26644 | Medium | 5.1 | 2025-04-08 | Automated recognition mechanism with inadequate detection or handling of adversarial input perturbations in Windows Hello allows an unauthorized attacker to pe… |
CVE-2025-26642 | High | 7.8 | 2025-04-08 | Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-26641 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows Cryptographic Services allows an unauthorized attacker to deny service over a network. |
CVE-2025-26640 | High | 7.0 | 2025-04-08 | Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally. |
CVE-2025-26639 | High | 7.8 | 2025-04-08 | Integer overflow or wraparound in Windows USB Print Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-26637 | Medium | 6.8 | 2025-04-08 | Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. |
CVE-2025-26635 | Medium | 6.5 | 2025-04-08 | Weak authentication in Windows Hello allows an authorized attacker to bypass a security feature over a network. |
CVE-2025-26628 | High | 7.3 | 2025-04-08 | Insufficiently protected credentials in Azure Local Cluster allows an authorized attacker to disclose information locally. |
CVE-2025-25002 | Medium | 6.8 | 2025-04-08 | Insertion of sensitive information into log file in Azure Local Cluster allows an authorized attacker to disclose information over an adjacent network. |
CVE-2025-24074 | High | 7.8 | 2025-04-08 | Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2025-24073 | High | 7.8 | 2025-04-08 | Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2025-24062 | High | 7.8 | 2025-04-08 | Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2025-24060 | High | 7.8 | 2025-04-08 | Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2025-24058 | High | 7.8 | 2025-04-08 | Improper input validation in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2025-21222 | High | 8.8 | 2025-04-08 | Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network. |
CVE-2025-21221 | High | 8.8 | 2025-04-08 | Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network. |
CVE-2025-21205 | High | 8.8 | 2025-04-08 | Heap-based buffer overflow in Windows Telephony Service allows an unauthorized attacker to execute code over a network. |
CVE-2025-21204 | High | 7.8 | 2025-04-08 | Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally. |
CVE-2025-21203 | Medium | 6.5 | 2025-04-08 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-21197 | Medium | 6.5 | 2025-04-08 | Improper access control in Windows NTFS allows an authorized attacker to disclose file path information under a folder where the attacker doesn't have permissi… |
CVE-2025-21191 | High | 7.0 | 2025-04-08 | Time-of-check time-of-use (toctou) race condition in Windows Local Security Authority (LSA) allows an authorized attacker to elevate privileges locally. |
CVE-2025-21174 | High | 7.5 | 2025-04-08 | Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network. |
CVE-2025-32279 | Medium | 4.3 | 2025-04-08 | Missing Authorization vulnerability in Shahjada Live Forms liveforms.This issue affects Live Forms: from n/a through <= 4.8.5. |
CVE-2025-32211 | Medium | 6.5 | 2025-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Broadstreet Broadstreet Ads broadstreet allows Stored XSS… |
CVE-2025-32164 | Medium | 6.5 | 2025-04-08 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in maennchen1.de m1.DownloadList m1downloadlist allows Retrieve Embedd… |
CVE-2025-32117 | High | 7.1 | 2025-04-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OTWthemes Widgetize Pages Light widgetize-pages-light all… |
CVE-2025-30671 | Medium | 6.5 | 2025-04-08 | Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access. |
CVE-2025-30670 | Medium | 6.5 | 2025-04-08 | Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network access. |
CVE-2025-27443 | Low | 2.8 | 2025-04-08 | Insecure default variable initialization in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a loss of integrity via local acces… |
CVE-2025-27442 | Medium | 4.6 | 2025-04-08 | Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access. |
CVE-2025-27441 | Medium | 4.6 | 2025-04-08 | Cross site scripting in some Zoom Workplace Apps may allow an unauthenticated user to conduct a loss of integrity via adjacent network access. |