2025 CVEs (page 358)
Page 358 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-20940 | Medium | 4.0 | 2025-04-08 | Improper handling of insufficient permission in Samsung Device Health Manager Service prior to SMR Apr-2025 Release 1 allows local attackers to access provider… |
CVE-2025-20939 | Medium | 5.4 | 2025-04-08 | Improper authorization in wireless download protocol in Galaxy Watch prior to SMR Apr-2025 Release 1 allows physical attackers to update device unique identifi… |
CVE-2025-20938 | Medium | 5.5 | 2025-04-08 | Improper access control in SamsungContacts prior to SMR Apr-2025 Release 1 allows local attackers to access protected data in SamsungContacts. |
CVE-2025-20936 | High | 8.8 | 2025-04-08 | Improper access control in HDCP trustlet prior to SMR Apr-2025 Release 1 allows local attackers with shell privilege to escalate their privileges to root. |
CVE-2025-20935 | Medium | 5.5 | 2025-04-08 | Improper handling of insufficient permission or privileges in ClipboardService prior to SMR Apr-2025 Release 1 allows local attackers to access files with syst… |
CVE-2025-20934 | Medium | 5.5 | 2025-04-08 | Improper access control in Sticker Center prior to SMR Apr-2025 Release 1 allows local attackers to access image files with system privilege. |
CVE-2025-3408 | Medium | 6.3 | 2025-04-08 | A vulnerability was found in Nothings stb up to f056911. It has been rated as critical. Affected by this issue is the function stb_dupreplace. The manipulation… |
CVE-2025-3407 | Medium | 6.3 | 2025-04-08 | A vulnerability was found in Nothings stb up to f056911. It has been declared as critical. Affected by this vulnerability is the function stbhw_build_tileset_f… |
CVE-2025-3406 | Medium | 4.3 | 2025-04-08 | A vulnerability was found in Nothings stb up to f056911. It has been classified as problematic. Affected is the function stbhw_build_tileset_from_image of the… |
CVE-2025-3405 | Medium | 4.3 | 2025-04-08 | A vulnerability was found in FCJ Venture Builder appclientefiel 3.0.27. It has been declared as problematic. Affected by this vulnerability is an unknown funct… |
CVE-2025-3403 | Low | 2.7 | 2025-04-08 | A vulnerability was found in Vivotek NVR ND8422P, NVR ND9525P and NVR ND9541P 2.4.0.204/3.3.0.104/4.2.0.101. It has been classified as problematic. Affected is… |
CVE-2025-3402 | Medium | 6.3 | 2025-04-08 | A vulnerability was found in Seeyon Zhiyuan Interconnect FE Collaborative Office Platform 5.5.2 and classified as critical. This issue affects some unknown pro… |
CVE-2025-3401 | High | 7.3 | 2025-04-08 | A vulnerability has been found in ESAFENET CDG 5.6.3.154.205_20250114 and classified as critical. This vulnerability affects unknown code of the file /paramete… |
CVE-2025-3364 | Medium | 6.7 | 2025-04-08 | The SSH service of PowerStation from HGiga has a Chroot Escape vulnerability, allowing attackers with root privileges to bypass chroot restrictions and access… |
CVE-2025-32414 | Medium | 5.6 | 2025-04-08 | In libxml2 before 2.13.8 and 2.14.x before 2.14.2, out-of-bounds memory access can occur in the Python API (Python bindings) because of an incorrect return val… |
CVE-2025-32413 | Medium | 6.4 | 2025-04-08 | Vulnerability-Lookup before 2.7.1 allows stored XSS via a user bio in website/web/views/user.py. |
CVE-2025-3400 | High | 7.3 | 2025-04-08 | A vulnerability, which was classified as critical, was found in ESAFENET CDG 5.6.3.154.205_20250114. This affects an unknown part of the file /client/UnChkMail… |
CVE-2025-3399 | High | 7.3 | 2025-04-08 | A vulnerability, which was classified as critical, has been found in ESAFENET CDG 5.6.3.154.205_20250114. Affected by this issue is some unknown functionality… |
CVE-2025-3398 | Medium | 6.3 | 2025-04-08 | A vulnerability classified as critical was found in lenve VBlog up to 1.0.0. Affected by this vulnerability is the function configure of the file blogserver/sr… |
CVE-2025-3397 | Medium | 4.3 | 2025-04-08 | A vulnerability classified as problematic has been found in YzmCMS 7.1. Affected is an unknown function of the file message.tpl. The manipulation of the argume… |
CVE-2025-3393 | Low | 3.5 | 2025-04-08 | A vulnerability was found in mrcen springboot-ucan-admin up to 5f35162032cbe9288a04e429ef35301545143509. It has been classified as problematic. This affects an… |
CVE-2025-3392 | Low | 3.5 | 2025-04-08 | A vulnerability was found in hailey888 oa_system up to 2025.01.01 and classified as problematic. Affected by this issue is the function Save of the file cn/gso… |
CVE-2025-3363 | Critical | 9.8 | 2025-04-08 | The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands an… |
CVE-2025-3362 | Critical | 9.8 | 2025-04-08 | The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands an… |
CVE-2025-3361 | Critical | 9.8 | 2025-04-08 | The web service of iSherlock from HGiga has an OS Command Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary OS commands an… |
CVE-2025-2526 | High | 8.8 | 2025-04-08 | The Streamit theme for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 4.0.2. This is due to the plu… |
CVE-2025-2525 | High | 8.8 | 2025-04-08 | The Streamit theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'st_Authentication_Controller::edit_profile… |
CVE-2025-2519 | Medium | 6.5 | 2025-04-08 | The Sreamit theme for WordPress is vulnerable to arbitrary file downloads in all versions up to, and including, 4.0.1. This is due to insufficient file validat… |
CVE-2025-3391 | Low | 3.5 | 2025-04-08 | A vulnerability has been found in hailey888 oa_system up to 2025.01.01 and classified as problematic. Affected by this vulnerability is the function outAddress… |
CVE-2025-3390 | Low | 3.5 | 2025-04-08 | A vulnerability, which was classified as problematic, was found in hailey888 oa_system up to 2025.01.01. Affected is the function addandchangeday of the file c… |
CVE-2025-3389 | Low | 3.5 | 2025-04-08 | A vulnerability, which was classified as problematic, has been found in hailey888 oa_system up to 2025.01.01. This issue affects the function testMess of the f… |
CVE-2025-3388 | Medium | 4.3 | 2025-04-07 | A vulnerability classified as problematic was found in hailey888 oa_system up to 2025.01.01. This vulnerability affects the function loginCheck of the file cn/… |
CVE-2025-3387 | Low | 3.5 | 2025-04-07 | A vulnerability classified as problematic has been found in renrenio renren-security up to 5.4.0. This affects an unknown part of the component JSON Handler. T… |
CVE-2025-3386 | Low | 2.4 | 2025-04-07 | A vulnerability was found in LinZhaoguan pb-cms 2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin#… |
CVE-2025-3385 | Low | 2.4 | 2025-04-07 | A vulnerability was found in LinZhaoguan pb-cms 2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the com… |
CVE-2025-32409 | High | 8.1 | 2025-04-07 | Ratta SuperNote A6 X2 Nomad before December 2024 allows remote code execution because an arbitrary firmware image (signed with debug keys) can be sent to TCP p… |
CVE-2025-0942 | High | 8.6 | 2025-04-07 | The DB chooser functionality in Jalios JPlatform 10 SP6 before 10.0.6 improperly neutralizes special elements used in an SQL command allows for unauthenticated… |
CVE-2025-3384 | High | 7.3 | 2025-04-07 | A vulnerability was found in 1000 Projects Human Resource Management System 1.0. It has been classified as critical. Affected is an unknown function of the fil… |
CVE-2025-3383 | High | 7.3 | 2025-04-07 | A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0 and classified as critical. This issue affects some unknown proces… |
CVE-2025-32034 | High | 7.5 | 2025-04-07 | The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Prior to 1… |
CVE-2025-32033 | High | 7.5 | 2025-04-07 | The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Prior to 1… |
CVE-2025-32032 | High | 7.5 | 2025-04-07 | The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerab… |
CVE-2025-32031 | High | 7.5 | 2025-04-07 | Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gatew… |
CVE-2025-32030 | High | 7.5 | 2025-04-07 | Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gatew… |
CVE-2025-32029 | | 2025-04-07 | ts-asn1-der is a collection of utility classes to encode ASN.1 data following DER rule. Incorrect number DER encoding can lead to denial on service for absolut… | |
CVE-2025-31496 | High | 7.5 | 2025-04-07 | apollo-compiler is a query-based compiler for the GraphQL query language. Prior to 1.27.0, a vulnerability in Apollo Compiler allowed queries with deeply neste… |
CVE-2025-3382 | Medium | 6.3 | 2025-04-07 | A vulnerability has been found in joey-zhou xiaozhi-esp32-server-java up to a14fe8115842ee42ab5c7a51706b8a85db5200b7 and classified as critical. This vulnerabi… |
CVE-2025-3381 | Medium | 6.3 | 2025-04-07 | A vulnerability, which was classified as critical, was found in zhangyanbo2007 youkefu 4.2.0. This affects an unknown part of the file WebIMController.java of… |
CVE-2025-29769 | Medium | 5.5 | 2025-04-07 | libvips is a demand-driven, horizontally threaded image processing library. The heifsave operation could incorrectly determine the presence of an alpha channe… |
CVE-2025-29594 | Medium | 6.1 | 2025-04-07 | A vulnerability exists in the errorpage.php file of the CS2-WeaponPaints-Website v2.1.7 where user-controlled input is not adequately validated before being pr… |
CVE-2025-29482 | Medium | 6.2 | 2025-04-07 | Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code via the SAO (Sample Adaptive Offset) processing of libde265. |
CVE-2025-29481 | Medium | 6.2 | 2025-04-07 | Buffer Overflow vulnerability in libbpf 1.5.0 allows a local attacker to execute arbitrary code via the bpf_object__init_prog` function of libbpf. This has bee… |
CVE-2025-29480 | Medium | 5.5 | 2025-04-07 | Buffer Overflow vulnerability in gdal 3.10.2 allows a local attacker to cause a denial of service via the OGRSpatialReference::Release function. NOTE: the Supp… |
CVE-2025-29478 | Medium | 5.5 | 2025-04-07 | An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the cfl_list_size in cfl_list.h:165. |
CVE-2025-29087 | Low | 3.2 | 2025-04-07 | In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocated buffer. If the… |
CVE-2025-3380 | High | 7.3 | 2025-04-07 | A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. Affected by this issue is some unknown functionality of the compon… |
CVE-2025-3379 | High | 7.3 | 2025-04-07 | A vulnerability classified as critical was found in PCMan FTP Server 2.0.7. Affected by this vulnerability is an unknown functionality of the component EPSV Co… |
CVE-2025-3378 | High | 7.3 | 2025-04-07 | A vulnerability classified as critical has been found in PCMan FTP Server 2.0.7. Affected is an unknown function of the component EPRT Command Handler. The man… |
CVE-2025-3377 | High | 7.3 | 2025-04-07 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been rated as critical. This issue affects some unknown processing of the component ENC Command Han… |
CVE-2025-3426 | | 2025-04-07 | We observed that Intellispace Portal binaries doesn’t have any protection mechanisms to prevent reverse engineering. Specifically, the app’s code is not obfusc… | |
CVE-2025-3376 | High | 7.3 | 2025-04-07 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been declared as critical. This vulnerability affects unknown code of the component CONF Command Ha… |
CVE-2025-3375 | High | 7.3 | 2025-04-07 | A vulnerability was found in PCMan FTP Server 2.0.7. It has been classified as critical. This affects an unknown part of the component CDUP Command Handler. Th… |
CVE-2025-3425 | | 2025-04-07 | The IntelliSpace portal application utilizes .NET Remoting for its functionality. The vulnerability arises from the exploitation of port 755 through the deseri… | |
CVE-2025-3424 | | 2025-04-07 | The IntelliSpace portal application utilizes .NET Remoting for its functionality. The vulnerability arises from the exploitation of port 755 through the "Objec… | |
CVE-2025-3374 | High | 7.3 | 2025-04-07 | A vulnerability was found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this issue is some unknown functionality of the component CCC Comma… |
CVE-2025-3373 | High | 7.3 | 2025-04-07 | A vulnerability has been found in PCMan FTP Server 2.0.7 and classified as critical. Affected by this vulnerability is an unknown functionality of the componen… |
CVE-2025-28413 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component |
CVE-2025-28412 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeController |
CVE-2025-28411 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave |
CVE-2025-28410 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate whether the requesting us… |
CVE-2025-28409 | High | 8.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/{parentId} endpoint does not properly validate whether… |
CVE-2025-28408 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId} endpoint does not prope… |
CVE-2025-28407 | High | 8.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not properly validate whether… |
CVE-2025-28406 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameter |
CVE-2025-28405 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus method |
CVE-2025-28403 | High | 7.2 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the requesting user has ad… |
CVE-2025-28402 | Critical | 9.8 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter |
CVE-2025-28401 | Medium | 6.7 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the menuId parameter |
CVE-2025-28400 | Medium | 6.7 | 2025-04-07 | An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the postID parameter in the edit method |
CVE-2025-3372 | High | 7.3 | 2025-04-07 | A vulnerability, which was classified as critical, was found in PCMan FTP Server 2.0.7. Affected is an unknown function of the component MKDIR Command Handler… |
CVE-2025-3371 | High | 7.3 | 2025-04-07 | A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component DELETE… |
CVE-2025-3248 | Critical | 9.8 | 2025-04-07 | Langflow versions prior to 1.3.0 are susceptible to code injection in the /api/v1/validate/code endpoint. A remote and unauthenticated attacker can send craft… |
CVE-2025-32014 | | 2025-04-07 | estree-util-value-to-estree converts a JavaScript value to an ESTree expression. When generating an ESTree from a value with a property named __proto__, valueT… | |
CVE-2025-31476 | Medium | 4.8 | 2025-04-07 | tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js, allowing a user with high privileges (access… |
CVE-2025-31475 | Medium | 5.5 | 2025-04-07 | tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where the addOrUpdate functio… |
CVE-2025-31138 | Medium | 5.5 | 2025-04-07 | tarteaucitron.js is a compliant and accessible cookie banner. A vulnerability was identified in tarteaucitron.js prior to 1.20.1, where user-controlled inputs… |
CVE-2025-30373 | Medium | 6.5 | 2025-04-07 | Graylog is a free and open log management platform. Starting with 6.1, HTTP Inputs can be configured to check if a specified header is present and has a specif… |
CVE-2025-3370 | High | 7.3 | 2025-04-07 | A vulnerability classified as critical has been found in PHPGurukul Men Salon Management System 1.0. This affects an unknown part of the file /admin/admin-prof… |
CVE-2025-3369 | Medium | 6.3 | 2025-04-07 | A vulnerability was found in xxyopen Novel-Plus 5.1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /novel/f… |
CVE-2025-30195 | High | 7.5 | 2025-04-07 | An attacker can publish a zone containing specific Resource Record Sets. Processing and caching results for these sets can lead to an illegal memory accesses a… |
CVE-2025-2251 | Medium | 6.2 | 2025-04-07 | A security flaw exists in WildFly and JBoss Enterprise Application Platform (EAP) within the Enterprise JavaBeans (EJB) remote invocation mechanism. This vulne… |
CVE-2025-27686 | Low | 2.7 | 2025-04-07 | Dell Unisphere for PowerMax, version(s) prior to 10.2.0.9 and PowerMax version(s) prior to PowerMax 9.2.4.15, contain an Improper Neutralization of Special Ele… |
CVE-2025-3360 | Low | 3.7 | 2025-04-07 | A flaw was found in GLib. An integer overflow and buffer under-read occur when parsing a long invalid ISO 8601 timestamp with the g_date_time_new_from_iso8601(… |
CVE-2025-3359 | Medium | 6.2 | 2025-04-07 | A flaw was found in GNUPlot. A segmentation fault via IO_str_init_static_internal may jeopardize the environment. |
CVE-2025-3353 | High | 7.3 | 2025-04-07 | A vulnerability was found in PHPGurukul Men Salon Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/ad… |
CVE-2025-3352 | High | 7.3 | 2025-04-07 | A vulnerability was found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-3351 | High | 7.3 | 2025-04-07 | A vulnerability has been found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functi… |
CVE-2025-3350 | High | 7.3 | 2025-04-07 | A vulnerability, which was classified as critical, was found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /adm… |
CVE-2025-0050 | Medium | 5.9 | 2025-04-07 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Arm Ltd Bifrost GPU Userspace Driver, Arm Ltd Valhall GPU Userspace Dr… |
CVE-2025-3349 | High | 7.3 | 2025-04-07 | A vulnerability, which was classified as critical, has been found in PCMan FTP Server 2.0.7. This issue affects some unknown processing of the component SYST C… |