2025 CVEs (page 370)
Page 370 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-24236 | Medium | 5.5 | 2025-03-31 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5. An app may be able to acces… |
CVE-2025-24235 | Medium | 5.5 | 2025-03-31 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5… |
CVE-2025-24234 | High | 7.8 | 2025-03-31 | This issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app… |
CVE-2025-24233 | Critical | 9.8 | 2025-03-31 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicio… |
CVE-2025-24232 | Critical | 9.8 | 2025-03-31 | This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious a… |
CVE-2025-24231 | Critical | 9.8 | 2025-03-31 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to modif… |
CVE-2025-24230 | Critical | 9.8 | 2025-03-31 | An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, m… |
CVE-2025-24229 | High | 7.4 | 2025-03-31 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A sandboxed app may be… |
CVE-2025-24228 | High | 7.8 | 2025-03-31 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An a… |
CVE-2025-24226 | Medium | 5.5 | 2025-03-31 | The issue was addressed with improved checks. This issue is fixed in Xcode 16.3. A malicious app may be able to access private information. |
CVE-2025-24221 | High | 7.5 | 2025-03-31 | This issue was addressed with improved data access restriction. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, visionOS 2.4. Sensitive keychai… |
CVE-2025-24218 | Medium | 5.5 | 2025-03-31 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoia 15.4. An app may be able to access inf… |
CVE-2025-24217 | Medium | 5.5 | 2025-03-31 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, tvOS 18.4, watc… |
CVE-2025-24216 | Medium | 4.3 | 2025-03-31 | The issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, tvOS 18… |
CVE-2025-24215 | Medium | 5.5 | 2025-03-31 | The issue was addressed with improved checks. This issue is fixed in iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious… |
CVE-2025-24214 | Medium | 5.5 | 2025-03-31 | A privacy issue was addressed by not logging contents of text fields. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, tvOS 18.4, visionOS… |
CVE-2025-24213 | High | 7.8 | 2025-03-31 | This issue was addressed with improved handling of floats. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, iPadOS 17.7.7, macOS Sequoia 15.5, tvO… |
CVE-2025-24212 | Medium | 6.3 | 2025-03-31 | This issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS V… |
CVE-2025-24211 | Critical | 9.8 | 2025-03-31 | This issue was addressed with improved memory handling. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5… |
CVE-2025-24210 | Medium | 5.5 | 2025-03-31 | A logic error was addressed with improved error handling. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7… |
CVE-2025-24209 | High | 7.0 | 2025-03-31 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia… |
CVE-2025-24208 | Medium | 6.1 | 2025-03-31 | A permissions issue was addressed with additional restrictions. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4. Loading a malicious iframe may le… |
CVE-2025-24207 | Critical | 9.8 | 2025-03-31 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app ma… |
CVE-2025-24205 | Medium | 5.5 | 2025-03-31 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS… |
CVE-2025-24204 | Critical | 9.8 | 2025-03-31 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protected user data. |
CVE-2025-24203 | Medium | 5.0 | 2025-03-31 | The issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ve… |
CVE-2025-24202 | Medium | 5.5 | 2025-03-31 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be able to access s… |
CVE-2025-24199 | Medium | 5.5 | 2025-03-31 | An uncontrolled format string issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura… |
CVE-2025-24198 | Medium | 6.6 | 2025-03-31 | This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4… |
CVE-2025-24196 | High | 8.8 | 2025-03-31 | A type confusion issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5. An attacker with user privi… |
CVE-2025-24195 | Critical | 9.8 | 2025-03-31 | An integer overflow was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A user… |
CVE-2025-24194 | Medium | 6.5 | 2025-03-31 | A logic issue was addressed with improved checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, tvOS 18.4, visionOS 2.4, watchOS 11.4. P… |
CVE-2025-24193 | Low | 2.4 | 2025-03-31 | This issue was addressed with improved authentication. This issue is fixed in iOS 18.4 and iPadOS 18.4. An attacker with a USB-C connection to an unlocked devi… |
CVE-2025-24192 | Medium | 6.5 | 2025-03-31 | A script imports issue was addressed with improved isolation. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4. V… |
CVE-2025-24191 | Medium | 5.5 | 2025-03-31 | The issue was addressed with improved validation of environment variables. This issue is fixed in macOS Sequoia 15.4. An app may be able to modify protected pa… |
CVE-2025-24190 | Critical | 9.8 | 2025-03-31 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14.7.5… |
CVE-2025-24182 | Medium | 5.5 | 2025-03-31 | An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, tvOS 18.4, visio… |
CVE-2025-24181 | Critical | 9.8 | 2025-03-31 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app ma… |
CVE-2025-24180 | High | 8.1 | 2025-03-31 | The issue was addressed with improved input validation. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, visionOS 2.4, watchOS… |
CVE-2025-24178 | Critical | 9.8 | 2025-03-31 | This issue was addressed through improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 14… |
CVE-2025-24173 | High | 7.8 | 2025-03-31 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.6, macOS Sequoia 15.4, macOS Sonoma 1… |
CVE-2025-24172 | Critical | 9.8 | 2025-03-31 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. "… |
CVE-2025-24170 | High | 7.8 | 2025-03-31 | A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be ab… |
CVE-2025-24167 | Critical | 9.8 | 2025-03-31 | This issue was addressed through improved state management. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4, watchOS 11.4. A d… |
CVE-2025-24164 | Medium | 5.5 | 2025-03-31 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app may be able to m… |
CVE-2025-24157 | Medium | 5.6 | 2025-03-31 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An a… |
CVE-2025-24148 | Medium | 5.5 | 2025-03-31 | This issue was addressed with improved handling of executable types. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A ma… |
CVE-2025-24097 | Medium | 5.0 | 2025-03-31 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.4 and iPadOS 18.4, iPadOS 17.7.7, macOS Sequoia 15.4, macOS Sonom… |
CVE-2025-24095 | High | 7.6 | 2025-03-31 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.4 and iPadOS 18.4, visionOS 2.4. An app may be able to bypass Privac… |
CVE-2025-3057 | Medium | 6.1 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This… |
CVE-2025-3036 | Low | 2.4 | 2025-03-31 | A vulnerability, which was classified as problematic, was found in yzk2356911358 StudentServlet-JSP cc0cdce25fbe43b6c58b60a77a2c85f52d2102f5/d4d7a0643f1dae908a… |
CVE-2025-3018 | Medium | 6.3 | 2025-03-31 | A vulnerability, which was classified as critical, was found in SourceCodester Online Eyewear Shop 1.0. Affected is an unknown function of the file /classes/Us… |
CVE-2025-3017 | Medium | 5.3 | 2025-03-31 | A vulnerability, which was classified as critical, has been found in TA-Lib up to 0.6.4. This issue affects the function setInputBuffer of the file src/tools/t… |
CVE-2025-31697 | Medium | 6.1 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Formatter Suite allows Cross-Site Scripting (XSS)… |
CVE-2025-31696 | Medium | 6.1 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal RapiDoc OAS Field Formatter allows Cross-Site Scri… |
CVE-2025-31695 | Medium | 6.1 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Link field display mode formatter allows Cross-Sit… |
CVE-2025-31694 | High | 8.1 | 2025-03-31 | Incorrect Authorization vulnerability in Drupal Two-factor Authentication (TFA) allows Forceful Browsing.This issue affects Two-factor Authentication (TFA): fr… |
CVE-2025-31693 | Medium | 6.6 | 2025-03-31 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Comma… |
CVE-2025-31692 | High | 7.5 | 2025-03-31 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Drupal AI (Artificial Intelligence) allows OS Comma… |
CVE-2025-31691 | Critical | 9.8 | 2025-03-31 | Missing Authorization vulnerability in Drupal OAuth2 Server allows Forceful Browsing.This issue affects OAuth2 Server: from 0.0.0 before 2.1.0. |
CVE-2025-31690 | High | 8.8 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Cache Utility allows Cross Site Request Forgery.This issue affects Cache Utility: from 0.0.0 before 1… |
CVE-2025-31689 | High | 8.1 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal General Data Protection Regulation allows Cross Site Request Forgery.This issue affects General Data… |
CVE-2025-31688 | Medium | 6.8 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Configuration Split allows Cross Site Request Forgery.This issue affects Configuration Split: from 0… |
CVE-2025-31687 | Medium | 6.1 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal SpamSpan filter allows Cross-Site Scripting (XSS)… |
CVE-2025-31686 | High | 8.1 | 2025-03-31 | Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 befor… |
CVE-2025-31685 | Critical | 9.1 | 2025-03-31 | Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 befor… |
CVE-2025-31684 | Medium | 6.8 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal OAuth2 Client allows Cross Site Request Forgery.This issue affects OAuth2 Client: from 0.0.0 before 4… |
CVE-2025-31683 | Medium | 6.8 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Google Tag allows Cross Site Request Forgery.This issue affects Google Tag: from 0.0.0 before 1.8.0… |
CVE-2025-31682 | Medium | 4.8 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Google Tag allows Cross-Site Scripting (XSS).This… |
CVE-2025-31681 | Critical | 9.8 | 2025-03-31 | Missing Authorization vulnerability in Drupal Authenticator Login allows Forceful Browsing.This issue affects Authenticator Login: from 0.0.0 before 2.0.6. |
CVE-2025-31680 | Medium | 6.8 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Matomo Analytics allows Cross Site Request Forgery.This issue affects Matomo Analytics: from 0.0.0 be… |
CVE-2025-31679 | Medium | 6.1 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Ignition Error Pages allows Cross-Site Scripting (… |
CVE-2025-31678 | High | 8.2 | 2025-03-31 | Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing.This issue affects AI (Artificial Intelligence): from 0.0.0… |
CVE-2025-31677 | High | 8.8 | 2025-03-31 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal AI (Artificial Intelligence) allows Cross Site Request Forgery.This issue affects AI (Artificial Inte… |
CVE-2025-31676 | High | 8.8 | 2025-03-31 | Weak Authentication vulnerability in Drupal Email TFA allows Brute Force.This issue affects Email TFA: from 0.0.0 before 2.0.3. |
CVE-2025-31675 | Medium | 5.4 | 2025-03-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS).This… |
CVE-2025-31674 | High | 7.5 | 2025-03-31 | Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Drupal core allows Object Injection.This issue affects D… |
CVE-2025-31673 | Medium | 4.6 | 2025-03-31 | Incorrect Authorization vulnerability in Drupal Drupal core allows Forceful Browsing.This issue affects Drupal core: from 8.0.0 before 10.3.13, from 10.4.0 bef… |
CVE-2025-26683 | High | 8.1 | 2025-03-31 | Improper authorization in Azure Playwright allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-3016 | Medium | 4.3 | 2025-03-31 | A vulnerability classified as problematic was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::MDLImporter::Par… |
CVE-2025-3015 | Medium | 6.3 | 2025-03-31 | A vulnerability classified as critical has been found in Open Asset Import Library Assimp 5.4.3. This affects the function Assimp::ASEImporter::BuildUniqueRepr… |
CVE-2025-3010 | Low | 3.3 | 2025-03-31 | A vulnerability, which was classified as problematic, has been found in Khronos Group glslang 15.1.0. Affected by this issue is the function glslang::TIntermed… |
CVE-2025-3009 | Medium | 6.3 | 2025-03-31 | A vulnerability classified as critical was found in Jinher Network OA C6. Affected by this vulnerability is an unknown functionality of the file /C6/JHSoft.Web… |
CVE-2025-31124 | Medium | 5.3 | 2025-03-31 | Zitadel is open-source identity infrastructure software. ZITADEL administrators can enable a setting called "Ignoring unknown usernames" which helps mitigate a… |
CVE-2025-31123 | High | 8.7 | 2025-03-31 | Zitadel is open-source identity infrastructure software. A vulnerability existed where expired keys can be used to retrieve tokens. Specifically, ZITADEL fails… |
CVE-2025-21893 | High | 7.8 | 2025-03-31 | In the Linux kernel, the following vulnerability has been resolved: keys: Fix UAF in key_put() Once a key's reference count has been reduced to 0, the garbag… |
CVE-2025-3008 | Medium | 5.5 | 2025-03-31 | A vulnerability classified as critical has been found in Novastar CX40 up to 2.44.0. Affected is the function system/popen of the file /usr/nova/bin/netconfig… |
CVE-2025-3007 | Medium | 5.5 | 2025-03-31 | A vulnerability was found in Novastar CX40 up to 2.44.0. It has been rated as critical. This issue affects the function getopt of the file /usr/nova/bin/netcon… |
CVE-2025-31129 | High | 8.8 | 2025-03-31 | Jooby is a web framework for Java and Kotlin. The pac4j io.jooby.internal.pac4j.SessionStoreImpl#get module deserializes untrusted data. This vulnerability is… |
CVE-2025-31128 | | 2025-03-31 | gifplayer is a customizable jquery plugin to play and stop animated gifs. gifplayer contains a cross-site scripting (XSS) vulnerability. This vulnerability is… | |
CVE-2025-29908 | Medium | 5.3 | 2025-03-31 | Netty QUIC codec is a QUIC codec for netty which makes use of quiche. An issue was discovered in the codec. A hash collision vulnerability (in the hash map use… |
CVE-2025-3006 | High | 7.3 | 2025-03-31 | A vulnerability was found in PHPGurukul e-Diary Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /e… |
CVE-2025-3005 | Low | 3.5 | 2025-03-31 | A vulnerability was found in Sayski ForestBlog up to 20250321 and classified as problematic. Affected by this issue is some unknown functionality of the compon… |
CVE-2025-3004 | Low | 3.5 | 2025-03-31 | A vulnerability has been found in Sayski ForestBlog up to 20250321 and classified as problematic. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-3003 | Medium | 6.3 | 2025-03-31 | A vulnerability, which was classified as critical, was found in ESAFENET CDG 3. Affected is an unknown function of the file /CDGServer3/UserAjax. The manipulat… |
CVE-2025-31125 | Medium | 5.3 | 2025-03-31 | Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposi… |
CVE-2025-31122 | | 2025-03-31 | scratch-coding-hut.github.io is the website for Coding Hut. In 1.0-beta3 and earlier, the login link can be used to login to any account by changing the userna… | |
CVE-2025-31117 | High | 7.5 | 2025-03-31 | OpenEMR is a free and open source electronic health records and medical practice management application. An Out-of-Band Server-Side Request Forgery (OOB SSRF)… |
CVE-2025-31116 | Medium | 4.4 | 2025-03-31 | Mobile Security Framework (MobSF) is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The m… |
CVE-2025-30369 | Low | 2.7 | 2025-03-31 | Zulip is an open-source team collaboration tool. The API for deleting an organization custom profile field is supposed to be restricted to organization adminis… |