2025 CVEs (page 38)
Page 38 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-36113 | Medium | 5.4 | 2026-01-20 | IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 is vulnerable to cross-site scripting. This vulnerability allo… |
CVE-2025-36066 | Medium | 6.1 | 2026-01-20 | IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 is vulnerable to cross-site scripting. This vulnerability allo… |
CVE-2025-36065 | Medium | 6.3 | 2026-01-20 | IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 does not invalidate session after a browser closure which coul… |
CVE-2025-36063 | Medium | 6.3 | 2026-01-20 | IBM Sterling Connect:Express Adapter for Sterling B2B Integrator 5.2.0 5.2.0.00 through 5.2.0.12 does not invalidate session after a logout which could allow a… |
CVE-2025-36059 | Medium | 4.7 | 2026-01-20 | IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix… |
CVE-2025-36058 | Medium | 5.5 | 2026-01-20 | IBM Business Automation Workflow containers 25.0.0 through 25.0.0 Interim Fix 002, 24.0.1 through 24.0.1 Interim Fix 005, and 24.0.0 through 24.0.0 Interim Fix… |
CVE-2025-33015 | High | 8.8 | 2026-01-20 | IBM Concert 1.0.0 through 2.1.0 is vulnerable to malicious file upload by not validating the content of the file uploaded to the web interface. |
CVE-2025-58095 | Medium | 6.1 | 2026-01-20 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malic… |
CVE-2025-58094 | Medium | 6.1 | 2026-01-20 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malic… |
CVE-2025-58093 | Medium | 6.1 | 2026-01-20 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malic… |
CVE-2025-58092 | Medium | 6.1 | 2026-01-20 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malic… |
CVE-2025-58091 | Medium | 6.1 | 2026-01-20 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malic… |
CVE-2025-58090 | Medium | 6.1 | 2026-01-20 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malic… |
CVE-2025-58089 | Medium | 6.1 | 2026-01-20 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malic… |
CVE-2025-58088 | Medium | 6.1 | 2026-01-20 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malic… |
CVE-2025-58087 | Medium | 6.1 | 2026-01-20 | Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malic… |
CVE-2025-58080 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the modifyHL7App functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious… |
CVE-2025-57881 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the modifyEmail functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious… |
CVE-2025-57787 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the modifyRoute functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious… |
CVE-2025-57786 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the notifynewstudy functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicio… |
CVE-2025-55071 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the modifyAnonymize functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malici… |
CVE-2025-54861 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the modifyCoercion functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicio… |
CVE-2025-54853 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the modifyUser functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious U… |
CVE-2025-54852 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the modifyAeTitle functionality of MedDream PACS Premium 7.3.6.870. A specially crafted maliciou… |
CVE-2025-54817 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the autoPurge functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious ur… |
CVE-2025-54814 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the modifyAutopurgeFilter functionality of MedDream PACS Premium 7.3.6.870. A specially crafted… |
CVE-2025-54778 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the existingUser functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious… |
CVE-2025-54495 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the emailfailedjob functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicio… |
CVE-2025-54157 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malici… |
CVE-2025-53912 | Critical | 9.6 | 2026-01-20 | An arbitrary file read vulnerability exists in the encapsulatedDoc functionality of MedDream PACS Premium 7.3.6.870. A specially crafted HTTP request can lead… |
CVE-2025-53854 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the modifyHL7Route functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicio… |
CVE-2025-53707 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the modifyTranscript functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malic… |
CVE-2025-53516 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the downloadZip functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious… |
CVE-2025-46270 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the fetchPriorStudies functionality of MedDream PACS Premium 7.3.6.870. A specially crafted mali… |
CVE-2025-44000 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the sendOruReport functionality of MedDream PACS Premium 7.3.6.870. A specially crafted maliciou… |
CVE-2025-36556 | Medium | 6.1 | 2026-01-20 | A reflected cross-site scripting (xss) vulnerability exists in the ldapUser functionality of MedDream PACS Premium 7.3.6.870. A specially crafted malicious URL… |
CVE-2025-1722 | Medium | 5.9 | 2026-01-20 | IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory. |
CVE-2025-1719 | Medium | 5.9 | 2026-01-20 | IBM Concert 1.0.0 through 2.1.0 could allow a remote attacker to obtain sensitive information from allocated memory due to improper clearing of heap memory. |
CVE-2025-15380 | High | 7.2 | 2026-01-20 | The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for Word… |
CVE-2025-15347 | High | 8.8 | 2026-01-20 | The Creator LMS – The LMS for Creators, Coaches, and Trainers plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privileg… |
CVE-2025-15043 | Medium | 5.4 | 2026-01-20 | The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'start_migration', 'cancel_migration… |
CVE-2025-14115 | High | 8.4 | 2026-01-20 | IBM Sterling Connect:Direct for UNIX Container 6.3.0.0 through 6.3.0.6 Interim Fix 016, and 6.4.0.0 through 6.4.0.3 Interim Fix 019 IBM® Sterling Connect:Direc… |
CVE-2025-13925 | Medium | 4.9 | 2026-01-20 | IBM Aspera Console 3.4.7 stores potentially sensitive information in log files that could be read by a local privileged user. |
CVE-2025-12985 | High | 8.4 | 2026-01-20 | IBM Licensing Operator incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM L… |
CVE-2025-9466 | High | 7.5 | 2026-01-20 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP and CIP grammar te… |
CVE-2025-9465 | High | 7.5 | 2026-01-20 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive grammar tests, t… |
CVE-2025-9464 | High | 7.5 | 2026-01-20 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. This vulnerability is triggered during fuzzing of multiple CIP… |
CVE-2025-9283 | High | 7.5 | 2026-01-20 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP Step Limits Storms… |
CVE-2025-9282 | High | 7.5 | 2026-01-20 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive limited storm te… |
CVE-2025-9281 | High | 7.5 | 2026-01-20 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles Comprehensive step limit storm… |
CVE-2025-9280 | High | 7.5 | 2026-01-20 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. Fuzzing performed using Defensics causes the device to become u… |
CVE-2025-9279 | High | 7.5 | 2026-01-20 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. During execution of the Achilles EtherNet/IP Step Limit Storm t… |
CVE-2025-9278 | High | 7.5 | 2026-01-20 | A security issue exists within ArmorStart® LT that can result in a denial-of-service condition. After running a Burp Suite active scan, the device loses ICMP c… |
CVE-2025-15281 | High | 7.5 | 2026-01-20 | Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialize… |
CVE-2025-14377 | | 2026-01-20 | A security issue was discovered within the legacy Ansible playbook component of Verve Asset Manager, caused by plaintext secrets incorrectly stored when a play… | |
CVE-2025-14376 | | 2026-01-20 | A security issue was discovered within the legacy ADI server component of Verve Asset Manager, caused by plaintext secrets stored in environment variables on t… | |
CVE-2025-14027 | | 2026-01-20 | Multiple denial-of-service vulnerabilities exist in the affected product. These issues can be triggered through various crafted inputs, including malformed Cla… | |
CVE-2025-11743 | | 2026-01-20 | A denial-of-service security issue in the affected product. The security issue occurs when a malformed CIP forward open message is sent. This could result in a… | |
CVE-2025-41081 | | 2026-01-20 | Reflected Cross-Site Scripting (XSS) vulnerability in IsMyGym by Zuinq Studio. This vulnerability allows an attacker to execute JavaScript code in the victim's… | |
CVE-2025-41025 | Medium | 5.4 | 2026-01-20 | Stored Cross-Site Scripting (XSS) in Poultry Farm Management System v1.0 due to the lack of proper validation of user input by sending a POST request. The rela… |
CVE-2025-41024 | Medium | 5.4 | 2026-01-20 | Stored Cross-Site Scripting (XSS) in Poultry Farm Management System v1.0 due to the lack of proper validation of user input by sending a POST request. The rela… |
CVE-2025-40679 | | 2026-01-20 | HTML Injection vulnerability in Isshue by Bdtask, consisting os an HTML injection due to a lack os proper validation of user input by sending a POST request… | |
CVE-2025-40644 | | 2026-01-20 | Reflected Cross-Site Scripting (XSS) vulnerability in Riftzilla's QRGen. This vulnerability allows an attavker to execute JavaScript code in the victim's brows… | |
CVE-2025-14369 | Medium | 5.5 | 2026-01-20 | dr_flac, an audio decoder within the dr_libs toolset, contains an integer overflow vulnerability flaw due to trusting the totalPCMFrameCount field from FLAC me… |
CVE-2025-41084 | | 2026-01-20 | Stored Cross-Site Scripting (XSS) vulnerability in Sesame web application, due to the fact that uploaded SVG images are not properly sanitized. This allows att… | |
CVE-2025-14533 | Critical | 9.8 | 2026-01-20 | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 0.9.2.1. This is due to t… |
CVE-2025-41768 | Medium | 5.5 | 2026-01-20 | An high privileged remote attacker can inject arbitrary content into the custom CSS field on the affected devices due to improper neutralization of input durin… |
CVE-2025-66523 | Medium | 6.1 | 2026-01-20 | URL parameters are directly embedded into JavaScript code or HTML attributes without proper encoding or sanitization. This allows attackers to inject arbitrary… |
CVE-2025-12573 | Medium | 6.5 | 2026-01-20 | The Bookingor WordPress plugin through 1.0.12 exposes authenticated AJAX actions without capability or nonce checks, allowing low-privileged users to delete B… |
CVE-2025-14977 | High | 8.1 | 2026-01-20 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Ob… |
CVE-2025-14348 | Medium | 5.3 | 2026-01-20 | The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to authorization… |
CVE-2025-14798 | Medium | 5.3 | 2026-01-20 | The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.3.2.4 via the get_item_… |
CVE-2025-14351 | Medium | 5.3 | 2026-01-20 | The Custom Fonts – Host Your Fonts Locally plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'BCF_Google… |
CVE-2025-14978 | Medium | 5.3 | 2026-01-20 | The PeachPay — Payments & Express Checkout for WooCommerce (supports Stripe, PayPal, Square, Authorize.net) plugin for WordPress is vulnerable to unauthorized… |
CVE-2025-15466 | Medium | 5.4 | 2026-01-20 | The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on… |
CVE-2025-69199 | Medium | 6.5 | 2026-01-19 | Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.0, websockets within wings lack prop… |
CVE-2025-69198 | Medium | 6.5 | 2026-01-19 | Pterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to the total number of resources (e.g. dat… |
CVE-2025-55252 | Low | 3.1 | 2026-01-19 | HCL AION version 2 is affected by a Weak Password Policy vulnerability. This can allow the use of easily guessable passwords, potentially resulting in unauth… |
CVE-2025-55250 | Low | 1.8 | 2026-01-19 | HCL AION version 2 is affected by a Technical Error Disclosure vulnerability. This can expose sensitive technical details, potentially resulting in information… |
CVE-2025-55251 | Low | 3.1 | 2026-01-19 | HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution… |
CVE-2025-55249 | Low | 3.5 | 2026-01-19 | HCL AION is affected by a Missing Security Response Headers vulnerability. The absence of standard security headers may weaken the application’s overall securi… |
CVE-2025-52661 | Low | 2.4 | 2026-01-19 | HCL AION version 2 is affected by a JWT Token Expiry Too Long vulnerability. This may increase the risk of token misuse, potentially resulting in unauthorized… |
CVE-2025-52660 | Low | 2.7 | 2026-01-19 | HCL AION is affected by an Unrestricted File Upload vulnerability. This can allow malicious file uploads, potentially resulting in unauthorized code execution… |
CVE-2025-52659 | Low | 2.8 | 2026-01-19 | HCL AION version 2 is affected by a Cacheable HTTP Response vulnerability. This may lead to unintended storage of sensitive or dynamic content, potentially res… |
CVE-2025-68616 | High | 7.5 | 2026-01-19 | WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `… |
CVE-2025-61684 | High | 7.5 | 2026-01-19 | Quicly, an IETF QUIC protocol implementation, is susceptible to a denial-of-service attack prior to commit d9d3df6a8530a102b57d840e39b0311ce5c9e14e. A remote a… |
CVE-2025-11044 | Medium | 6.8 | 2026-01-19 | An Allocation of Resources Without Limits or Throttling vulnerability in the ANSL-Server component of B&R Automation Runtime versions prior to 6.5 and prior to… |
CVE-2025-11043 | High | 7.4 | 2026-01-19 | An Improper Certificate Validation vulnerability in the OPC-UA client and ANSL over TLS client used in Automation Studio versions before 6.5 could allow an una… |
CVE-2025-59355 | Medium | 6.5 | 2026-01-19 | A vulnerability. When org.apache.linkis.metadata.util.HiveUtils.decode() fails to perform Base64 decoding, it records the complete input parameter string in t… |
CVE-2025-29847 | High | 7.5 | 2026-01-19 | A vulnerability in Apache Linkis. Problem Description When using the JDBC engine and da When using the JDBC engine and data source functionality, if the URL p… |
CVE-2025-15539 | Medium | 5.3 | 2026-01-19 | A vulnerability was determined in Open5GS up to 2.7.6. Impacted is the function sgwc_s11_handle_downlink_data_notification_ack of the file src/sgwc/s11-handler… |
CVE-2025-15538 | Medium | 5.3 | 2026-01-18 | A security vulnerability has been detected in Open Asset Import Library Assimp up to 6.0.2. Affected by this vulnerability is the function Assimp::LWOImporter… |
CVE-2025-15537 | Medium | 5.3 | 2026-01-18 | A security vulnerability has been detected in Mapnik up to 4.2.0. This issue affects the function mapnik::dbf_file::string_value of the file plugins/input/shap… |
CVE-2025-15536 | Medium | 5.3 | 2026-01-18 | A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegme… |
CVE-2025-15535 | Low | 3.3 | 2026-01-18 | A security flaw has been discovered in nicbarker clay up to 0.14. This affects the function Clay__MeasureTextCached in the library clay.h. The manipulation res… |
CVE-2025-15534 | Medium | 5.3 | 2026-01-18 | A vulnerability was identified in raysan5 raylib up to 909f040. Affected by this issue is the function LoadFontData of the file src/rtext.c. The manipulation l… |
CVE-2025-15533 | Medium | 5.3 | 2026-01-18 | A vulnerability was determined in raysan5 raylib up to 909f040. Affected by this vulnerability is the function GenImageFontAtlas of the file src/rtext.c. Execu… |
CVE-2025-15532 | Medium | 5.3 | 2026-01-17 | A security flaw has been discovered in Open5GS up to 2.7.5. This issue affects some unknown processing of the component Timer Handler. The manipulation results… |
CVE-2025-15531 | Medium | 5.3 | 2026-01-17 | A vulnerability was identified in Open5GS up to 2.7.5. This vulnerability affects the function sgwc_bearer_add of the file src/sgwc/context.c. The manipulation… |
CVE-2025-15530 | Medium | 5.3 | 2026-01-17 | A vulnerability was determined in Open5GS up to 2.7.6. This affects the function sgwc_s11_handle_create_indirect_data_forwarding_tunnel_request of the file /sr… |