2025 CVEs (page 366)
Page 366 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-21948 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: HID: appleir: Fix potential NULL dereference at raw event handle Syzkaller reports a NULL… |
CVE-2025-21947 | High | 8.1 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix type confusion via race condition when using ipc_msg_send_request req->handle… |
CVE-2025-21946 | High | 8.8 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bounds in parse_sec_desc() If osidoffset, gsidoffset and dacloffset cou… |
CVE-2025-21945 | High | 8.8 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in smb2_lock If smb_lock->zero_len has value, ->llist of smb_lo… |
CVE-2025-21944 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix bug on trap in smb2_lock If lock count is greater than 1, flags could be old v… |
CVE-2025-21943 | Medium | 4.7 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: gpio: aggregator: protect driver attr handlers against module unload Both new_device_stor… |
CVE-2025-21942 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: fix extent range end unlock in cow_file_range() Running generic/751 on the… |
CVE-2025-21941 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix null check for pipe_ctx->plane_state in resource_build_scaling_params… |
CVE-2025-21940 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix NULL Pointer Dereference in KFD queue Through KFD IOCTL Fuzzing we encoun… |
CVE-2025-21939 | High | 7.8 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/hmm: Don't dereference struct page pointers without notifier lock The pnfs that we… |
CVE-2025-21938 | High | 7.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr If multiple con… |
CVE-2025-21937 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name() Add check for the return… |
CVE-2025-21936 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected() Add check for the re… |
CVE-2025-21935 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: rapidio: add check for rio_add_net() in rio_scan_alloc_net() The return value of rio_add_… |
CVE-2025-21934 | High | 7.8 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: rapidio: fix an API misues when rio_add_net() fails rio_add_net() calls device_register()… |
CVE-2025-21933 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: arm: pgtable: fix NULL pointer dereference issue When update_mmu_cache_range() is called… |
CVE-2025-21932 | High | 7.0 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: mm: abort vma_modify() on merge out of memory failure The remainder of vma_modify() relie… |
CVE-2025-21931 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio Commit b15c87263a69 ("… |
CVE-2025-21930 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't try to talk to a dead firmware This fixes: bad state = 0 WAR… |
CVE-2025-21929 | High | 7.8 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() During the `rmmod`… |
CVE-2025-21928 | High | 7.8 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() The system can experie… |
CVE-2025-21927 | Critical | 9.8 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() nvme_tcp_recv_pdu() does… |
CVE-2025-21926 | High | 7.8 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: net: gso: fix ownership in __udp_gso_segment In __udp_gso_segment the skb destructor is r… |
CVE-2025-21925 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: llc: do not use skb_get() before dev_queue_xmit() syzbot is able to crash hosts [1], usin… |
CVE-2025-21924 | High | 7.8 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an e… |
CVE-2025-21923 | High | 7.8 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: HID: hid-steam: Fix use-after-free when detaching device When a hid-steam device is remov… |
CVE-2025-21922 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: ppp: Fix KMSAN uninit-value warning with bpf Syzbot caught an "KMSAN: uninit-value" warni… |
CVE-2025-21921 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: net: ethtool: netlink: Allow NULL nlattrs when getting a phy_device ethnl_req_get_phydev(… |
CVE-2025-21920 | High | 7.1 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: vlan: enforce underlying device type Currently, VLAN devices can be created on top of non… |
CVE-2025-21919 | High | 7.8 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: sched/fair: Fix potential memory corruption in child_cfs_rq_on_list child_cfs_rq_on_list… |
CVE-2025-21918 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Fix NULL pointer access Resources should be released only after all thr… |
CVE-2025-21917 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: usb: renesas_usbhs: Flush the notify_hotplug_work When performing continuous unbind/bind… |
CVE-2025-21916 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: usb: atm: cxacru: fix a flaw in existing endpoint checks Syzbot once again identified a f… |
CVE-2025-21915 | High | 7.0 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: cdx: Fix possible UAF error in driver_override_show() Fixed a possible UAF problem in dri… |
CVE-2025-21914 | High | 7.8 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: slimbus: messaging: Free transaction ID in delayed interrupt scenario In case of interrup… |
CVE-2025-21913 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: x86/amd_nb: Use rdmsr_safe() in amd_get_mmconfig_range() Xen doesn't offer MSR_FAM10H_MMI… |
CVE-2025-21912 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: gpio: rcar: Use raw_spinlock to protect register access Use raw_spinlock in order to fix… |
CVE-2025-21911 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: drm/imagination: avoid deadlock on fence release Do scheduler queue fence release process… |
CVE-2025-21910 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: regulatory: improve invalid hints checking Syzbot keeps reporting an issu… |
CVE-2025-21909 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: reject cooked mode if it is set along with other flags It is possible to s… |
CVE-2025-21908 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: NFS: fix nfs_release_folio() to not deadlock via kcompactd writeback Add PF_KCOMPACTD fla… |
CVE-2025-21907 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: mm: memory-failure: update ttu flag inside unmap_poisoned_folio Patch series "mm: memory_… |
CVE-2025-21906 | High | 7.6 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: clean up ROC on failure If the firmware fails to start the session pr… |
CVE-2025-21905 | High | 7.1 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: limit printed string from FW file There's no guarantee here that the file… |
CVE-2025-21904 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: caif_virtio: fix wrong pointer check in cfv_probe() del_vqs() frees virtqueues, therefore… |
CVE-2025-21903 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: mctp i3c: handle NULL header address daddr can be NULL if there is no neighbour table ent… |
CVE-2025-21902 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: acpi: typec: ucsi: Introduce a ->poll_cci method For the ACPI backend of UCSI the UCSI "r… |
CVE-2025-21901 | High | 7.8 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: Add sanity checks on rdev validity There is a possibility that ulp_irq_stop… |
CVE-2025-21900 | High | 7.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: NFSv4: Fix a deadlock when recovering state on a sillyrenamed file If the file is sillyre… |
CVE-2025-21899 | High | 7.8 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix bad hist from corrupting named_triggers list The following commands causes a… |
CVE-2025-21898 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: ftrace: Avoid potential division by zero in function_stat_show() Check whether denominato… |
CVE-2025-21897 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix pick_task_scx() picking non-queued tasks when it's called without balance()… |
CVE-2025-21896 | High | 7.8 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: fuse: revert back to __readahead_folio() for readahead In commit 3eab9d7bc2f4 ("fuse: con… |
CVE-2025-21895 | Medium | 4.7 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: perf/core: Order the PMU list to fix warning about unordered pmu_ctx_list Syskaller trigg… |
CVE-2025-21894 | Medium | 5.5 | 2025-04-01 | In the Linux kernel, the following vulnerability has been resolved: net: enetc: VFs do not support HWTSTAMP_TX_ONESTEP_SYNC Actually ENETC VFs do not support… |
CVE-2025-31910 | High | 7.6 | 2025-04-01 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems BookingPress bookingpress-appointment-b… |
CVE-2025-31908 | High | 7.1 | 2025-04-01 | Cross-Site Request Forgery (CSRF) vulnerability in Sami Ahmed Siddiqui JSON Structuring Markup json-structuring-markup allows Stored XSS.This issue affects JSO… |
CVE-2025-31906 | High | 7.1 | 2025-04-01 | Cross-Site Request Forgery (CSRF) vulnerability in ProfitShare.ro WP Profitshare wp-profitshare allows Stored XSS.This issue affects WP Profitshare: from n/a t… |
CVE-2025-31904 | High | 7.1 | 2025-04-01 | Cross-Site Request Forgery (CSRF) vulnerability in Infoway LLC Ebook Downloader ebook-downloader allows Cross Site Request Forgery.This issue affects Ebook Dow… |
CVE-2025-31897 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arrow Plugins Arrow Custom Feed for Twitter arrow-twitter… |
CVE-2025-31895 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in paulrosen ABC Notation abc-notation allows Stored XSS.Thi… |
CVE-2025-31894 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infoway LLC Ebook Downloader ebook-downloader allows Stor… |
CVE-2025-31892 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfunding wp-crowdfunding allows Stored XSS… |
CVE-2025-31891 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gosign Gosign – Posts Slider Block gosign-posts-slider-bl… |
CVE-2025-31890 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mashi Simple Map No Api simple-map-no-api allows Stored X… |
CVE-2025-31888 | Medium | 4.3 | 2025-04-01 | Cross-Site Request Forgery (CSRF) vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows Cross Site Request Forgery.This issue affec… |
CVE-2025-31887 | Medium | 4.3 | 2025-04-01 | Missing Authorization vulnerability in zookatron MyBookProgress by Stormhill Media mybookprogress allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-31886 | Medium | 4.3 | 2025-04-01 | Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget allows Exploiting Incorrec… |
CVE-2025-31885 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Daniel Floeter Hyperlink Group Block hyperlink-group-bloc… |
CVE-2025-31884 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP CMS Ninja Norse Rune Oracle Plugin norse-runes-oracle… |
CVE-2025-31883 | Medium | 5.9 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Stor… |
CVE-2025-31882 | Medium | 4.3 | 2025-04-01 | Missing Authorization vulnerability in WPWebinarSystem WebinarPress wp-webinarsystem allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-31881 | Medium | 5.4 | 2025-04-01 | Missing Authorization vulnerability in Stylemix Pearl pearl-header-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-31880 | Medium | 4.3 | 2025-04-01 | Cross-Site Request Forgery (CSRF) vulnerability in Stylemix Pearl pearl-header-builder allows Cross Site Request Forgery.This issue affects Pearl: from n/a thr… |
CVE-2025-31879 | Medium | 5.4 | 2025-04-01 | Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Generator for WooCommerce embedding-barcodes-into-product-pages-and-orders all… |
CVE-2025-31878 | Medium | 5.4 | 2025-04-01 | Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") UPC/EAN/GTIN Code Generator upc-ean-barcode-generator allows Exploiting Incorrectly Co… |
CVE-2025-31877 | Medium | 4.3 | 2025-04-01 | Missing Authorization vulnerability in Magnigenie RestroPress restropress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-31875 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pluginic FancyPost post-block allows DOM-Based XSS.This i… |
CVE-2025-31874 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ajay WebberZone Snippetz add-to-all allows Stored XSS.Thi… |
CVE-2025-31873 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sheetdb SheetDB sheetdb allows Stored XSS.This issue affe… |
CVE-2025-31872 | Medium | 5.3 | 2025-04-01 | Missing Authorization vulnerability in Galaxy Weblinks WP Clone any post type wp-clone-any-post-type allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-31871 | Medium | 4.7 | 2025-04-01 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Galaxy Weblinks WP Clone any post type wp-clone-any-post-type allows Phishing.This issue a… |
CVE-2025-31870 | Medium | 5.4 | 2025-04-01 | Missing Authorization vulnerability in EXEIdeas International WP AutoKeyword wp-autokeyword allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-31869 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Modernaweb Studio Black Widgets For Elementor black-widge… |
CVE-2025-31868 | Medium | 5.3 | 2025-04-01 | Missing Authorization vulnerability in JoomSky JS Job Manager js-jobs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-31867 | Medium | 5.4 | 2025-04-01 | Authorization Bypass Through User-Controlled Key vulnerability in JoomSky JS Job Manager js-jobs allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-31866 | Medium | 4.3 | 2025-04-01 | Missing Authorization vulnerability in Ship Depot ShipDepot for WooCommerce ship-depot allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-31865 | Medium | 4.3 | 2025-04-01 | Missing Authorization vulnerability in CartBoss CartBoss cartboss allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ca… |
CVE-2025-31864 | Medium | 5.9 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Out the Box Beam me up Scotty beam-me-up-scotty allows St… |
CVE-2025-31863 | Medium | 5.3 | 2025-04-01 | Missing Authorization vulnerability in inspry Agency Toolkit agency-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-31862 | Medium | 5.3 | 2025-04-01 | Missing Authorization vulnerability in PickPlugins Job Board Manager job-board-manager allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-31861 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPOrbit Support Perfect Font Awesome Integration perfect-… |
CVE-2025-31860 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPeka WP AdCenter wpadcenter allows Stored XSS.This issue… |
CVE-2025-31859 | Medium | 5.4 | 2025-04-01 | Cross-Site Request Forgery (CSRF) vulnerability in Feedbucket Feedbucket – Website Feedback Tool feedbucket allows Cross Site Request Forgery.This issue affect… |
CVE-2025-31857 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist AddonsKit for Elementor addonskit-for-e… |
CVE-2025-31856 | Medium | 4.3 | 2025-04-01 | Missing Authorization vulnerability in brainvireinfo Export All Post Meta export-all-post-meta allows Accessing Functionality Not Properly Constrained by ACLs… |
CVE-2025-31855 | Medium | 6.5 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in softnwords SMM API smm-api allows Stored XSS.This issue a… |
CVE-2025-31854 | Medium | 4.3 | 2025-04-01 | Missing Authorization vulnerability in Sharaz Shahid Simple Sticky Add To Cart For WooCommerce sticky-add-to-cart-woo allows Exploiting Incorrectly Configured… |
CVE-2025-31853 | Medium | 5.9 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Erez Hadas-Sonnenschein Smartarget Popup smartarget-popup… |
CVE-2025-31852 | Medium | 4.3 | 2025-04-01 | Cross-Site Request Forgery (CSRF) vulnerability in N-Media Bulk Product Sync sync-wc-google allows Cross Site Request Forgery.This issue affects Bulk Product S… |