2025 CVEs (page 364)
Page 364 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-3135 | Medium | 6.3 | 2025-04-03 | A vulnerability classified as critical was found in fcba_zzm ics-park Smart Park Management System 2.1. This vulnerability affects unknown code of the file /ap… |
CVE-2025-3134 | Medium | 6.3 | 2025-04-03 | A vulnerability classified as critical has been found in code-projects Payroll Management System 1.0. This affects an unknown part of the file /add_overtime.ph… |
CVE-2025-3154 | | 2025-04-02 | Out-of-bounds array write in Xpdf 4.05 and earlier, triggered by an invalid VerticesPerRow value in a PDF shading dictionary. | |
CVE-2025-3123 | Medium | 4.7 | 2025-04-02 | A vulnerability, which was classified as critical, has been found in WonderCMS 3.5.0. Affected by this issue is the function installUpdateModuleAction of the c… |
CVE-2025-3130 | Medium | 5.4 | 2025-04-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Obfuscate allows Stored XSS.This issue affects Obf… |
CVE-2025-3129 | Medium | 4.8 | 2025-04-02 | Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Access code allows Brute Force.This issue affects Access code: from 0.0.0 bef… |
CVE-2025-3122 | Low | 3.1 | 2025-04-02 | A vulnerability classified as problematic was found in WebAssembly wabt 1.0.36. Affected by this vulnerability is the function BinaryReaderInterp::BeginFunctio… |
CVE-2025-3121 | Low | 3.3 | 2025-04-02 | A vulnerability classified as problematic has been found in PyTorch 2.6.0. Affected is the function torch.jit.jit_module_from_flatbuffer. The manipulation lead… |
CVE-2025-3120 | Medium | 6.3 | 2025-04-02 | A vulnerability was found in SourceCodester Apartment Visitors Management System 1.0. It has been rated as critical. This issue affects some unknown processing… |
CVE-2025-3119 | Medium | 6.3 | 2025-04-02 | A vulnerability was found in SourceCodester Online Tutor Portal 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /tut… |
CVE-2025-31484 | | 2025-04-02 | conda-forge infrastructure holds common configurations and settings for key pieces of the conda-forge infrastructure. Between 2025-02-10 and 2025-04-01, conda-… | |
CVE-2025-31479 | High | 8.2 | 2025-04-02 | canonical/get-workflow-version-action is a GitHub composite action to get commit SHA that GitHub Actions reusable workflow was called with. Prior to 1.0.1, if… |
CVE-2025-31477 | Critical | 9.8 | 2025-04-02 | The Tauri shell plugin allows access to the system shell. Prior to 2.2.1, the Tauri shell plugin exposes functionality to execute code and open programs on the… |
CVE-2025-30218 | Medium | 5.9 | 2025-04-02 | Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persi… |
CVE-2025-27608 | | 2025-04-02 | Arduino IDE 2.x is an IDE based on the Theia IDE framework and built with Electron. A Self Cross-Site Scripting (XSS) vulnerability has been identified within… | |
CVE-2025-0257 | Medium | 6.3 | 2025-04-02 | HCL DevOps Deploy / HCL Launch could allow unauthorized access to other services or potential exposure of sensitive data due to missing authentication in its A… |
CVE-2025-3118 | Medium | 6.3 | 2025-04-02 | A vulnerability was found in SourceCodester Online Tutor Portal 1.0. It has been classified as critical. This affects an unknown part of the file /tutor/course… |
CVE-2025-30080 | High | 7.5 | 2025-04-02 | Signalling in Pexip Infinity 29 through 36.2 before 37.0 has improper input validation that allows remote attackers to trigger a temporary denial of service (s… |
CVE-2025-2704 | High | 7.5 | 2025-04-02 | OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting and replaying netwo… |
CVE-2025-29719 | Medium | 6.1 | 2025-04-02 | SourceCodester (rems) Employee Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in add_employee.php via the First Name and Address text fields. |
CVE-2025-29085 | Critical | 9.8 | 2025-04-02 | SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/executorCount?zkClus… |
CVE-2025-29063 | Critical | 9.8 | 2025-04-02 | An issue in BL-AC2100 V1.0.4 and before allows a remote attacker to execute arbitrary code via the enable parameter passed to /goform/set_hidessid_cfg is not h… |
CVE-2025-29062 | Critical | 9.8 | 2025-04-02 | An issue in BL-AC2100 <=V1.0.4 allows a remote attacker to execute arbitrary code via the time1 and time2 parameters in the set_LimitClient_cfg of the goahead… |
CVE-2025-22925 | High | 7.5 | 2025-04-02 | OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the table parameter at /attendance/AttendanceCodes.php. The remote, auth… |
CVE-2025-22924 | High | 8.8 | 2025-04-02 | OS4ED openSIS v7.0 through v9.1 contains a SQL injection vulnerability via the stu_id parameter at /modules/students/Student.php. |
CVE-2025-22923 | High | 8.8 | 2025-04-02 | An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST request to /Modules.ph… |
CVE-2025-31286 | Medium | 4.6 | 2025-04-02 | An HTML injection vulnerability previously discovered in Trend Vision One could have allowed a malicious user to execute arbitrary code. Please note: this i… |
CVE-2025-31285 | Medium | 4.6 | 2025-04-02 | A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator to create users who… |
CVE-2025-31284 | Medium | 4.6 | 2025-04-02 | A broken access control vulnerability previously discovered in the Trend Vision One Status component could have allowed an administrator to create users who co… |
CVE-2025-31283 | Medium | 4.6 | 2025-04-02 | A broken access control vulnerability previously discovered in the Trend Vision One User Roles component could have allowed an administrator to create users wh… |
CVE-2025-31282 | Medium | 4.6 | 2025-04-02 | A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have allowed an administrator to create users… |
CVE-2025-20212 | High | 7.7 | 2025-04-02 | A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series devices could allow an authenticated, remote attacker to cause… |
CVE-2025-20203 | Medium | 4.8 | 2025-04-02 | A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an authen… |
CVE-2025-20139 | High | 7.5 | 2025-04-02 | A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to cause a denial of servic… |
CVE-2025-20120 | Medium | 6.1 | 2025-04-02 | A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure could allow an unauth… |
CVE-2025-0014 | High | 7.3 | 2025-04-02 | Incorrect default permissions on the AMD Ryzen(TM) AI installation folder could allow an attacker to achieve privilege escalation, potentially resulting in arb… |
CVE-2025-0154 | Medium | 5.3 | 2025-04-02 | IBM TXSeries for Multiplatforms 9.1 and 11.1 could disclose sensitive information to a remote attacker due to improper neutralization of HTTP headers. |
CVE-2025-31728 | Medium | 5.5 | 2025-04-02 | Jenkins AsakusaSatellite Plugin 0.1.1 and earlier does not mask AsakusaSatellite API keys displayed on the job configuration form, increasing the potential for… |
CVE-2025-31727 | Medium | 5.5 | 2025-04-02 | Jenkins AsakusaSatellite Plugin 0.1.1 and earlier stores AsakusaSatellite API keys unencrypted in job config.xml files on the Jenkins controller where they can… |
CVE-2025-31726 | Medium | 5.5 | 2025-04-02 | Jenkins Stack Hammer Plugin 1.0.6 and earlier stores Stack Hammer API keys unencrypted in job config.xml files on the Jenkins controller where they can be view… |
CVE-2025-31725 | Medium | 5.5 | 2025-04-02 | Jenkins monitor-remote-job Plugin 1.0 stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Ext… |
CVE-2025-31724 | Medium | 4.3 | 2025-04-02 | Jenkins Cadence vManager Plugin 4.0.0-282.v5096a_c2db_275 and earlier stores Verisium Manager vAPI keys unencrypted in job config.xml files on the Jenkins cont… |
CVE-2025-31723 | Medium | 4.3 | 2025-04-02 | A cross-site request forgery (CSRF) vulnerability in Jenkins Simple Queue Plugin 1.4.6 and earlier allows attackers to change and reset the build queue order. |
CVE-2025-31722 | High | 8.8 | 2025-04-02 | In Jenkins Templating Engine Plugin 2.5.3 and earlier, libraries defined in folders are not subject to sandbox protection, allowing attackers with Item/Configu… |
CVE-2025-31721 | Medium | 4.3 | 2025-04-02 | A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Configur… |
CVE-2025-31720 | Medium | 4.3 | 2025-04-02 | A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but without Computer/Extended… |
CVE-2025-21994 | High | 7.6 | 2025-04-02 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix incorrect validation for num_aces field of smb_acl parse_dcal() validate num_a… |
CVE-2025-30090 | High | 7.2 | 2025-04-02 | mime.php in SquirrelMail through 1.4.23-svn-20250401 and 1.5.x through 1.5.2-svn-20250401 allows XSS via e-mail headers, because JavaScript payloads are mishan… |
CVE-2025-27556 | Medium | 5.8 | 2025-04-02 | An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14. The NFKC normalization is slow on Windows. As a consequence, django.contrib.auth.view… |
CVE-2025-21993 | High | 7.1 | 2025-04-02 | In the Linux kernel, the following vulnerability has been resolved: iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() When performing… |
CVE-2025-21992 | Medium | 5.5 | 2025-04-02 | In the Linux kernel, the following vulnerability has been resolved: HID: ignore non-functional sensor in HP 5MP Camera The HP 5MP Camera (USB ID 0408:5473) r… |
CVE-2025-21991 | High | 7.8 | 2025-04-02 | In the Linux kernel, the following vulnerability has been resolved: x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes Currently, load_… |
CVE-2025-21990 | Medium | 5.5 | 2025-04-02 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: NULL-check BO's backing store when determining GFX12 PTE flags PRT BOs may no… |
CVE-2025-21989 | Medium | 5.5 | 2025-04-02 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix missing .is_two_pixels_per_container Starting from 6.11, AMDGPU driv… |
CVE-2025-21988 | Critical | 9.8 | 2025-04-02 | In the Linux kernel, the following vulnerability has been resolved: fs/netfs/read_collect: add to next->prev_donated If multiple subrequests donate data to t… |
CVE-2025-21987 | Medium | 5.5 | 2025-04-02 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: init return value in amdgpu_ttm_clear_buffer Otherwise an uninitialized value… |
CVE-2025-1805 | Medium | 5.3 | 2025-04-02 | Crypt::Salt for Perl version 0.01 uses insecure rand() function when generating salts for cryptographic purposes. |
CVE-2025-2842 | Medium | 4.3 | 2025-04-02 | A flaw was found in the Tempo Operator. When the Jaeger UI Monitor Tab functionality is enabled in a Tempo instance managed by the Tempo Operator, the Operator… |
CVE-2025-2786 | Medium | 4.3 | 2025-04-02 | A flaw was found in Tempo Operator, where it creates a ServiceAccount, ClusterRole, and ClusterRoleBinding when a user deploys a TempoStack or TempoMonolithic… |
CVE-2025-3099 | Medium | 6.1 | 2025-04-02 | The Advanced Search by My Solr Server plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.5. This is due… |
CVE-2025-3098 | Medium | 6.1 | 2025-04-02 | The Video Url plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.0.0.3 due to… |
CVE-2025-3097 | Medium | 6.1 | 2025-04-02 | The wp Time Machine plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.0. This is due to missing or inc… |
CVE-2025-3063 | High | 8.8 | 2025-04-02 | The Shopper Approved Reviews plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing cap… |
CVE-2025-2513 | Medium | 6.4 | 2025-04-02 | The Smart Icons For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0… |
CVE-2025-2483 | Medium | 6.1 | 2025-04-02 | The Gift Certificate Creator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘receip_address’ parameter in all versions up to, and… |
CVE-2025-2005 | Critical | 9.8 | 2025-04-02 | The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads field of the registrat… |
CVE-2025-0676 | | 2025-04-02 | This vulnerability involves command injection in tcpdump within Moxa products, enabling an authenticated attacker with console access to exploit improper input… | |
CVE-2025-0415 | | 2025-04-02 | A remote attacker with web administrator privileges can exploit the device’s web interface to execute arbitrary system commands through the NTP settings. Succe… | |
CVE-2025-27244 | Medium | 5.9 | 2025-04-02 | AssetView and AssetView CLOUD contain an issue with acquiring sensitive information from sent data to the developer. If exploited, sensitive information may be… |
CVE-2025-25060 | High | 8.2 | 2025-04-02 | Missing authentication for critical function vulnerability exists in AssetView and AssetView CLOUD. If exploited, the files on the server where the product is… |
CVE-2025-2779 | Medium | 6.5 | 2025-04-02 | The Insert Headers and Footers Code – HT Script plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on th… |
CVE-2025-3074 | Medium | 5.4 | 2025-04-02 | Inappropriate implementation in Downloads in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Ch… |
CVE-2025-3073 | Medium | 5.4 | 2025-04-02 | Inappropriate implementation in Autofill in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2025-3072 | Medium | 5.4 | 2025-04-02 | Inappropriate implementation in Custom Tabs in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI ges… |
CVE-2025-3071 | Medium | 5.4 | 2025-04-02 | Inappropriate implementation in Navigations in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI ges… |
CVE-2025-3070 | Medium | 6.5 | 2025-04-02 | Insufficient validation of untrusted input in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via… |
CVE-2025-3069 | High | 8.8 | 2025-04-02 | Inappropriate implementation in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a crafted HTML… |
CVE-2025-3068 | High | 8.8 | 2025-04-02 | Inappropriate implementation in Intents in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a craf… |
CVE-2025-3067 | High | 8.8 | 2025-04-02 | Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in spec… |
CVE-2025-3066 | High | 8.8 | 2025-04-02 | Use after free in Site Isolation in Google Chrome prior to 135.0.7049.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2025-29982 | Medium | 6.8 | 2025-04-02 | Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insecure Inherited Permissions vulnerability. A low privileged attacker with local access co… |
CVE-2025-29981 | High | 7.5 | 2025-04-02 | Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Exposure of Sensitive Information Through Data Queries vulnerability. An unauthenticated att… |
CVE-2025-27694 | Medium | 5.3 | 2025-04-02 | Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insufficient Resource Pool vulnerability. An unauthenticated attacker with remote access co… |
CVE-2025-27693 | Medium | 4.9 | 2025-04-02 | Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnera… |
CVE-2025-27692 | Medium | 4.7 | 2025-04-02 | Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Unrestricted Upload of File with Dangerous Type vulnerability. A high privileged attacker wi… |
CVE-2025-31135 | Medium | 5.3 | 2025-04-01 | Go-Guerrilla SMTP Daemon is a lightweight SMTP server written in Go. Prior to 1.6.7, when ProxyOn is enabled, the PROXY command will be accepted multiple times… |
CVE-2025-30356 | Critical | 9.8 | 2025-04-01 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications between… |
CVE-2025-31889 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in petesheppard84 Extensions for Elementor. This issue affec… |
CVE-2025-31819 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in pixelgrade Nova Blocks nova-blocks.This issue affects Nov… |
CVE-2025-31753 | Medium | 4.3 | 2025-04-01 | Cross-Site Request Forgery (CSRF) vulnerability in Animesh Kumar Advanced Speed Increaser advanced-speed-increaser.This issue affects Advanced Speed Increaser… |
CVE-2025-31628 | Medium | 5.3 | 2025-04-01 | Missing Authorization vulnerability in SlicedInvoices Sliced Invoices sliced-invoices allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-31619 | High | 8.5 | 2025-04-01 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in marcoingraiti Actionwear products sync actionwear-product… |
CVE-2025-31612 | Critical | 9.8 | 2025-04-01 | Deserialization of Untrusted Data vulnerability in Sabuj Kundu CBX Poll cbxpoll allows Object Injection.This issue affects CBX Poll: from n/a through <= 2.0.4. |
CVE-2025-31594 | High | 7.1 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPglob Auto scroll for reading auto-scroll-for-reading al… |
CVE-2025-31580 | High | 7.5 | 2025-04-01 | Missing Authorization vulnerability in Anzar Ahmed Ni WooCommerce Product Enquiry ni-woocommerce-product-enquiry allows Accessing Functionality Not Properly Co… |
CVE-2025-31579 | Critical | 9.3 | 2025-04-01 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in EXEIdeas International WP AutoKeyword wp-autokeyword allo… |
CVE-2025-31578 | High | 7.1 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wisdomlogix Solutions Pvt. Ltd. Fonts Manager | Custom Fo… |
CVE-2025-31571 | High | 7.1 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cynob IT Consultancy The Logo Slider the-logo-slider allo… |
CVE-2025-31568 | High | 7.1 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wiredmindshelp LeadLab by wiredminds wiredminds-leadlab a… |
CVE-2025-31564 | High | 8.5 | 2025-04-01 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in aitool Ai Auto Tool Content Writing Assistant (Gemini Wri… |