2025 CVEs (page 382)
Page 382 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-25758 | High | 7.5 | 2025-03-20 | An issue in KukuFM Android v1.12.7 (11207) allows attackers to access sensitive cleartext data via the android:allowBackup="true" in the ANdroidManifest.xml |
CVE-2025-26853 | Critical | 10.0 | 2025-03-20 | DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 has a broken authorization schema. |
CVE-2025-26852 | Critical | 10.0 | 2025-03-20 | DESCOR INFOCAD 3.5.1 and before and fixed in v.3.5.2.0 allows SQL Injection. |
CVE-2025-30160 | High | 7.5 | 2025-03-20 | Redlib is an alternative private front-end to Reddit. A vulnerability has been identified in Redlib where an attacker can cause a denial-of-service (DOS) condi… |
CVE-2025-2557 | Medium | 5.5 | 2025-03-20 | A vulnerability, which was classified as critical, has been found in Audi UTR Dashcam 2.0. Affected by this issue is some unknown functionality of the componen… |
CVE-2025-29980 | Critical | 9.8 | 2025-03-20 | A SQL injection issue has been discovered in eTRAKiT.net release 3.2.1.77. Due to improper input validation, a remote unauthenticated attacker can run arbitrar… |
CVE-2025-29218 | Medium | 6.5 | 2025-03-20 | Tenda W18E v2.0 v16.01.0.11 was discovered to contain a stack overflow in the wifiPwd parameter at /goform/setModules. This vulnerability allows attackers to c… |
CVE-2025-29217 | Medium | 6.5 | 2025-03-20 | Tenda W18E v2.0 v16.01.0.11 was discovered to contain a stack overflow in the wifiSSID parameter at /goform/setModules. This vulnerability allows attackers to… |
CVE-2025-2556 | Medium | 4.3 | 2025-03-20 | A vulnerability classified as problematic was found in Audi UTR Dashcam 2.0. Affected by this vulnerability is an unknown functionality of the component Video… |
CVE-2025-2555 | Low | 2.9 | 2025-03-20 | A vulnerability classified as problematic has been found in Audi Universal Traffic Recorder App 2.0. Affected is an unknown function of the component FTP Crede… |
CVE-2025-2553 | Medium | 4.3 | 2025-03-20 | A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been rated as problematic. This issue affects some unknown processing of the file /g… |
CVE-2025-29923 | Low | 3.7 | 2025-03-20 | go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.3, go-redis potentially responds out of order whe… |
CVE-2025-29922 | Critical | 9.6 | 2025-03-20 | kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability… |
CVE-2025-29914 | Medium | 5.4 | 2025-03-20 | OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.3.3, if a request is made on an URI starting with //, coraza w… |
CVE-2025-29215 | Medium | 6.5 | 2025-03-20 | Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_43fdcc function at /goform/SetNetControlList. |
CVE-2025-2565 | Medium | 4.3 | 2025-03-20 | The data exposure vulnerability in Liferay Portal 7.4.0 through 7.4.3.126, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.12, 2024.Q1.1 through 2024.Q1.1… |
CVE-2025-2552 | Medium | 4.3 | 2025-03-20 | A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been declared as problematic. This vulnerability affects unknown code of the file /g… |
CVE-2025-2551 | Medium | 4.3 | 2025-03-20 | A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02. It has been classified as problematic. This affects an unknown part of the file /goform/for… |
CVE-2025-2550 | Medium | 4.3 | 2025-03-20 | A vulnerability was found in D-Link DIR-618 and DIR-605L 2.02/3.02 and classified as problematic. Affected by this issue is some unknown functionality of the f… |
CVE-2025-2549 | Medium | 4.3 | 2025-03-20 | A vulnerability has been found in D-Link DIR-618 and DIR-605L 2.02/3.02 and classified as problematic. Affected by this vulnerability is an unknown functionali… |
CVE-2025-2480 | High | 7.8 | 2025-03-20 | Santesoft Sante DICOM Viewer Pro is vulnerable to an out-of-bounds write, which requires a user to open a malicious DCM file, resulting in execution of arbitra… |
CVE-2025-29149 | High | 7.5 | 2025-03-20 | Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the ping1 parameter in the formSetAutoPing function. |
CVE-2025-29121 | High | 7.5 | 2025-03-20 | A vulnerability was found in Tenda AC6 V15.03.05.16. The vulnerability affects the functionality of the /goform/fast_setting_wifi_set file form_fast_setting_wi… |
CVE-2025-2548 | Medium | 4.3 | 2025-03-20 | A vulnerability, which was classified as problematic, was found in D-Link DIR-618 and DIR-605L 2.02/3.02. Affected is an unknown function of the file /goform/f… |
CVE-2025-2547 | Medium | 4.3 | 2025-03-20 | A vulnerability, which was classified as problematic, has been found in D-Link DIR-618 and DIR-605L 2.02/3.02. This issue affects some unknown processing of th… |
CVE-2025-29214 | High | 7.5 | 2025-03-20 | Tenda AX12 v22.03.01.46_CN was discovered to contain a stack overflow via the sub_42F69C function at /goform/setMacFilterCfg. |
CVE-2025-23120 | High | 8.8 | 2025-03-20 | A vulnerability allowing remote code execution (RCE) for domain users. |
CVE-2025-2546 | Medium | 4.3 | 2025-03-20 | A vulnerability classified as problematic was found in D-Link DIR-618 and DIR-605L 2.02/3.02. This vulnerability affects unknown code of the file /goform/formA… |
CVE-2025-29411 | Critical | 9.8 | 2025-03-20 | An arbitrary file upload vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0 allows attackers to execute arbitrary code via u… |
CVE-2025-29412 | Medium | 4.8 | 2025-03-20 | A cross-site scripting (XSS) vulnerability in the Client Profile Update section of Mart Developers iBanking v2.0.0 allows attackers to execute arbitrary web sc… |
CVE-2025-29410 | Medium | 6.1 | 2025-03-20 | A cross-site scripting (XSS) vulnerability in the component /contact.php of Hospital Management System v1.0 allows attackers to execute arbitrary web scripts o… |
CVE-2025-1496 | Medium | 6.5 | 2025-03-20 | Improper Restriction of Excessive Authentication Attempts vulnerability in BG-TEK Coslat Hotspot allows Password Brute Forcing, Authentication Abuse. This iss… |
CVE-2025-0254 | Medium | 5.9 | 2025-03-20 | HCL Digital Experience components Ring API and dxclient may be vulnerable to man-in-the-middle (MitM) attacks prior to 9.5 CF226. An attacker could intercept… |
CVE-2025-29101 | High | 7.5 | 2025-03-20 | Tenda AC8V4.0 V16.03.34.06 was discovered to contain a stack overflow via the deviceid parameter in the get_parentControl_list_Info function. |
CVE-2025-2539 | High | 7.5 | 2025-03-20 | The File Away plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the ajax() function in all versions up to… |
CVE-2025-2311 | Critical | 9.0 | 2025-03-20 | Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information Te… |
CVE-2025-27888 | Medium | 5.4 | 2025-03-20 | Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), U… |
CVE-2025-1802 | Medium | 6.4 | 2025-03-20 | The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘marker_title’, 'notification_content', a… |
CVE-2025-1796 | High | 8.8 | 2025-03-20 | A vulnerability in langgenius/dify v0.10.1 allows an attacker to take over any account, including administrator accounts, by exploiting a weak pseudo-random nu… |
CVE-2025-1474 | Medium | 5.5 | 2025-03-20 | In mlflow/mlflow version 2.18, an admin is able to create a new user account without setting a password. This vulnerability could lead to security risks, as ac… |
CVE-2025-1473 | High | 7.1 | 2025-03-20 | A Cross-Site Request Forgery (CSRF) vulnerability exists in the Signup feature of mlflow/mlflow versions 2.17.0 to 2.20.1. This vulnerability allows an attacke… |
CVE-2025-1451 | High | 7.5 | 2025-03-20 | A vulnerability in parisneo/lollms-webui v13 arises from the server's handling of multipart boundaries in file uploads. The server does not limit or validate t… |
CVE-2025-1040 | High | 8.8 | 2025-03-20 | AutoGPT versions 0.3.4 and earlier are vulnerable to a Server-Side Template Injection (SSTI) that could lead to Remote Code Execution (RCE). The vulnerability… |
CVE-2025-0628 | High | 8.1 | 2025-03-20 | An improper authorization vulnerability exists in the main-latest version of BerriAI/litellm. When a user with the role 'internal_user_viewer' logs into the ap… |
CVE-2025-0508 | Medium | 5.9 | 2025-03-20 | A vulnerability in the SageMaker Workflow component of aws/sagemaker-python-sdk allows for the possibility of MD5 hash collisions in all versions. This can lea… |
CVE-2025-0454 | High | 7.5 | 2025-03-20 | A Server-Side Request Forgery (SSRF) vulnerability was identified in the Requests utility of significant-gravitas/autogpt versions prior to v0.4.0. The vulnera… |
CVE-2025-0453 | High | 7.5 | 2025-03-20 | In mlflow/mlflow version 2.17.2, the `/graphql` endpoint is vulnerable to a denial of service attack. An attacker can create large batches of queries that repe… |
CVE-2025-0452 | High | 8.2 | 2025-03-20 | eosphoros-ai/DB-GPT version latest is vulnerable to arbitrary file deletion on Windows systems via the '/v1/agent/hub/update' endpoint. The application fails t… |
CVE-2025-0330 | High | 7.5 | 2025-03-20 | In berriai/litellm version v1.52.1, an issue in proxy_server.py causes the leakage of Langfuse API keys when an error occurs while parsing team settings. This… |
CVE-2025-0317 | High | 7.5 | 2025-03-20 | A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to upload and create a customized GGUF model file on the Ollama server. This can lea… |
CVE-2025-0315 | High | 7.5 | 2025-03-20 | A vulnerability in ollama/ollama <=0.3.14 allows a malicious user to create a customized GGUF model file, upload it to the Ollama server, and create it. This c… |
CVE-2025-0312 | High | 7.5 | 2025-03-20 | A vulnerability in ollama/ollama versions <=0.3.14 allows a malicious user to create a customized GGUF model file that, when uploaded and created on the Ollama… |
CVE-2025-0281 | Medium | 5.4 | 2025-03-20 | A stored cross-site scripting (XSS) vulnerability exists in lunary-ai/lunary versions 1.6.7 and earlier. An attacker can inject malicious JavaScript into the S… |
CVE-2025-0192 | Medium | 5.4 | 2025-03-20 | A stored Cross-site Scripting (XSS) vulnerability exists in the latest version of wandb/openui. The vulnerability is present in the edit HTML functionality, wh… |
CVE-2025-0191 | Medium | 6.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability exists in the file upload feature of gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability is due to improper… |
CVE-2025-0190 | High | 7.5 | 2025-03-20 | In version 3.25.0 of aimhubio/aim, a denial of service vulnerability exists. By tracking a large number of `Text` objects and then querying them simultaneously… |
CVE-2025-0189 | High | 7.5 | 2025-03-20 | In version 3.25.0 of aimhubio/aim, the tracking server is vulnerable to a denial of service attack. The server overrides the maximum size for websocket message… |
CVE-2025-0188 | Medium | 6.5 | 2025-03-20 | A Server-Side Request Forgery (SSRF) vulnerability was discovered in gaizhenbiao/chuanhuchatgpt version 20240914. The vulnerability allows an attacker to const… |
CVE-2025-0187 | High | 7.5 | 2025-03-20 | A Denial of Service (DoS) vulnerability was discovered in the file upload feature of gradio-app/gradio version 0.39.1. The vulnerability is due to improper han… |
CVE-2025-0185 | High | 8.8 | 2025-03-20 | A vulnerability in the Dify Tools' Vanna module of the langgenius/dify repository allows for a Pandas Query Injection in the latest version. The vulnerability… |
CVE-2025-0184 | Medium | 6.5 | 2025-03-20 | A Server-Side Request Forgery (SSRF) vulnerability was identified in langgenius/dify version 0.10.2. The vulnerability occurs in the 'Create Knowledge' section… |
CVE-2025-0183 | Medium | 5.4 | 2025-03-20 | A stored cross-site scripting (XSS) vulnerability exists in the Latex Proof-Reading Module of binary-husky/gpt_academic version 3.9.0. This vulnerability allow… |
CVE-2025-0182 | High | 7.5 | 2025-03-20 | A vulnerability in danswer-ai/danswer version 0.9.0 allows for denial of service through memory exhaustion. The issue arises from the use of a vulnerable versi… |
CVE-2025-2505 | Critical | 9.8 | 2025-03-20 | The Age Gate plugin for WordPress is vulnerable to Local PHP File Inclusion in all versions up to, and including, 3.5.3 via the 'lang' parameter. This makes it… |
CVE-2025-1385 | | 2025-03-20 | When the library bridge feature is enabled, the clickhouse-library-bridge exposes an HTTP API on localhost. This allows clickhouse-server to dynamically load a… | |
CVE-2025-2108 | Medium | 6.4 | 2025-03-20 | The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Site Title’ widget's 'title_tag'… |
CVE-2025-22228 | High | 7.4 | 2025-03-20 | BCryptPasswordEncoder.matches(CharSequence,String) will incorrectly return true for passwords larger than 72 characters as long as the first 72 characters are… |
CVE-2025-1770 | High | 8.8 | 2025-03-20 | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and incl… |
CVE-2025-1766 | Medium | 5.3 | 2025-03-20 | The Event Manager, Events Calendar, Tickets, Registrations – Eventin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing c… |
CVE-2025-1314 | Medium | 4.3 | 2025-03-20 | The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi… |
CVE-2025-30259 | Low | 3.5 | 2025-03-20 | The WhatsApp cloud service before late 2024 did not block certain crafted PDF content that can defeat a sandbox protection mechanism and consequently allow rem… |
CVE-2025-30092 | Medium | 6.1 | 2025-03-19 | Intrexx Portal Server 12.x <= 12.0.2 and 11.x <= 11.9.2 allows XSS in multiple Velocity scripts. |
CVE-2025-27787 | High | 7.5 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to denial of service (DoS) in restart.py. `model_name` in train.py takes user… |
CVE-2025-27786 | Critical | 9.1 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file removal in core.py. `output_tts_path` in tts.py takes arbit… |
CVE-2025-27785 | High | 7.5 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's `export_index` function. This issue may… |
CVE-2025-27784 | High | 7.5 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file read in train.py's `export_pth` function. This issue may le… |
CVE-2025-27783 | Critical | 9.8 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in train.py. This issue may lead to writing arbitrary… |
CVE-2025-27782 | Critical | 9.8 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to arbitrary file write in inference.py. This issue may lead to writing arbit… |
CVE-2025-27781 | Critical | 9.8 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in inference.py. `model_file` in inference.py as we… |
CVE-2025-27780 | Critical | 9.8 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in model_information.py. `model_name` in model_info… |
CVE-2025-27779 | Critical | 9.8 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in `model_blender.py` lines 20 and 21. `model_fusio… |
CVE-2025-27778 | Critical | 9.8 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.8-bugfix and prior are vulnerable to unsafe deserialization in `infer.py`. The issue can lead to remote code ex… |
CVE-2025-27777 | High | 7.5 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery (SSRF) in `model_download.py` (line 195 in 3.2.7). Th… |
CVE-2025-27776 | Medium | 5.3 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery (SSRF) and file write in `model_download.py` (line 24… |
CVE-2025-27775 | Medium | 5.3 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery (SSRF) and file write in `model_download.py` (line 14… |
CVE-2025-27774 | Medium | 5.3 | 2025-03-19 | Applio is a voice conversion tool. Versions 3.2.7 and prior are vulnerable to server-side request forgery (SSRF) and file write in `model_download.py` (line 15… |
CVE-2025-26816 | Medium | 6.5 | 2025-03-19 | A vulnerability in Intrexx Portal Server 12.0.2 and earlier which was classified as problematic potentially allows users with particular permissions under cert… |
CVE-2025-30258 | Low | 2.7 | 2025-03-19 | In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incorrect usage flags… |
CVE-2025-27705 | | 2025-03-19 | There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.53. Attackers with syst… | |
CVE-2025-2536 | Medium | 6.1 | 2025-03-19 | Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 throu… |
CVE-2025-2476 | High | 8.8 | 2025-03-19 | Use after free in Lens in Google Chrome prior to 134.0.6998.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2025-27704 | | 2025-03-19 | There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.53. Attackers with syst… | |
CVE-2025-27415 | High | 7.5 | 2025-03-19 | Nuxt is an open-source web development framework for Vue.js. Prior to 3.16.0, by sending a crafted HTTP request to a server behind an CDN, it is possible in so… |
CVE-2025-29926 | Critical | 9.8 | 2025-03-19 | XWiki Platform is a generic wiki platform. Prior to 15.10.15, 16.4.6, and 16.10.0, any user can exploit the WikiManager REST API to create a new wiki, where th… |
CVE-2025-29925 | Medium | 5.3 | 2025-03-19 | XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, protected pages are listed when requesting the REST endpoints /rest/wik… |
CVE-2025-29924 | High | 7.5 | 2025-03-19 | XWiki Platform is a generic wiki platform. Prior to 15.10.14, 16.4.6, and 16.10.0-rc-1, it's possible for an user to get access to private information through… |
CVE-2025-29405 | Medium | 6.3 | 2025-03-19 | An arbitrary file upload vulnerability in the component /admin/template.php of emlog pro 2.5.0 and pro 2.5.* allows attackers to execute arbitrary code via upl… |
CVE-2025-29118 | Medium | 6.5 | 2025-03-19 | Tenda AC8 V16.03.34.06 was discovered to contain a stack overflow via the src parameter in the function sub_47D878. |
CVE-2025-0431 | Medium | 5.8 | 2025-03-19 | Enterprise Protection contains a vulnerability in URL rewriting that allows an unauthenticated remote attacker to send an email which bypasses URL protections… |
CVE-2025-30197 | Low | 3.1 | 2025-03-19 | Jenkins Zoho QEngine Plugin 1.0.29.vfa_cc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attackers to observe a… |