2025 CVEs (page 387)
Page 387 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-20142 | High | 8.6 | 2025-03-12 | A vulnerability in the IPv4 access control list (ACL) feature and quality of service (QoS) policy feature of Cisco IOS XR Software for Cisco ASR 9000 Series Ag… |
CVE-2025-20141 | High | 7.4 | 2025-03-12 | A vulnerability in the handling of specific packets that are punted from a line card to a route processor in Cisco IOS XR Software Release 7.9.2 could allow an… |
CVE-2025-20138 | High | 8.8 | 2025-03-12 | A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operat… |
CVE-2025-20115 | High | 8.6 | 2025-03-12 | A vulnerability in confederation implementation for the Border Gateway Protocol (BGP) in Cisco IOS XR Software could allow an unauthenticated, remote atta… |
CVE-2025-1984 | Medium | 5.2 | 2025-03-12 | Xerox Desktop Print Experience application contains a Local Privilege Escalation (LPE) vulnerability, which allows a low-privileged user to gain SYSTEM-level a… |
CVE-2025-1960 | Critical | 9.8 | 2025-03-12 | CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an attacker to execute unauthorized commands when a syste… |
CVE-2025-1683 | High | 7.8 | 2025-03-12 | Improper link resolution before file access in the Nomad module of the 1E Client, in versions prior to 25.3, enables an attacker with local unprivileged access… |
CVE-2025-0884 | | 2025-03-12 | Unquoted Search Path or Element vulnerability in OpenText™ Service Manager. The vulnerability could allow a user to gain SYSTEM privileges through Privilege… | |
CVE-2025-0883 | | 2025-03-12 | Improper Neutralization of Script in an Error Message Web Page vulnerability in OpenText™ Service Manager. The vulnerability could reveal sensitive informati… | |
CVE-2025-0813 | Medium | 6.8 | 2025-03-12 | CWE-287: Improper Authentication vulnerability exists that could cause an Authentication Bypass when an unauthorized user without permission rights has physica… |
CVE-2025-2240 | High | 7.5 | 2025-03-12 | A flaw was found in Smallrye, where smallrye-fault-tolerance is vulnerable to an out-of-memory (OOM) issue. This vulnerability is externally triggered when cal… |
CVE-2025-29891 | Medium | 4.8 | 2025-03-12 | Bypass/Injection vulnerability in Apache Camel. This issue affects Apache Camel: from 4.10.0 before 4.10.2, from 4.8.0 before 4.8.5, from 3.10.0 before 3.22.4… |
CVE-2025-27915 | Medium | 5.4 | 2025-03-12 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A stored cross-site scripting (XSS) vulnerability exists in the Classic Web Client… |
CVE-2025-27914 | Medium | 5.4 | 2025-03-12 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1. A Reflected Cross-Site Scripting (XSS) vulnerability exists in the /h/rest endpoin… |
CVE-2025-22954 | Critical | 10.0 | 2025-03-12 | GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or serialid parameter. |
CVE-2025-27794 | Medium | 6.8 | 2025-03-12 | Flarum is open-source forum software. A session hijacking vulnerability exists in versions prior to 1.8.10 when an attacker-controlled authoritative subdomain… |
CVE-2025-27788 | High | 7.5 | 2025-03-12 | JSON is a JSON implementation for Ruby. Starting in version 2.10.0 and prior to version 2.10.2, a specially crafted document could cause an out of bound read… |
CVE-2025-25709 | High | 7.5 | 2025-03-12 | An issue in dtp.ae tNexus Airport View v.2.8 allows a remote attacker to escalate privileges via the addUser and updateUser endpoints |
CVE-2025-21590 | Medium | 4.4 | 2025-03-12 | An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high privileges to compromi… |
CVE-2025-29904 | Medium | 5.3 | 2025-03-12 | In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possible |
CVE-2025-29903 | Medium | 5.2 | 2025-03-12 | In JetBrains Runtime before 21.0.6b872.80 arbitrary dynamic library execution due to insecure macOS flags was possible |
CVE-2025-1527 | Medium | 6.4 | 2025-03-12 | The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to a S… |
CVE-2025-2239 | Medium | 5.3 | 2025-03-12 | Generation of Error Message Containing Sensitive Information vulnerability in Hillstone Networks Hillstone Next Generation FireWall.This issue affects Hillston… |
CVE-2025-21866 | Medium | 5.5 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOC Erhar… |
CVE-2025-21865 | Medium | 5.5 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl(). Brad Spengler reported… |
CVE-2025-21864 | High | 7.8 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: tcp: drop secpath at the same time as we currently drop dst Xiumei reported hitting the W… |
CVE-2025-21863 | High | 7.8 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: io_uring: prevent opcode speculation sqe->opcode is used for different tables, make sure… |
CVE-2025-21862 | Medium | 5.5 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: drop_monitor: fix incorrect initialization order Syzkaller reports the following bug: BU… |
CVE-2025-21861 | Medium | 5.5 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() If mig… |
CVE-2025-21860 | Low | 3.3 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: mm/zswap: fix inconsistency when zswap_store_page() fails Commit b7c0ccdfbafd ("mm: zswap… |
CVE-2025-21859 | Medium | 5.5 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: USB: gadget: f_midi: f_midi_complete to call queue_work When using USB MIDI, a lock is at… |
CVE-2025-21858 | High | 7.8 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: geneve: Fix use-after-free in geneve_find_dev(). syzkaller reported a use-after-free in g… |
CVE-2025-21857 | Medium | 5.5 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: fix error handling causing NULL dereference tcf_exts_miss_cookie_base… |
CVE-2025-21856 | High | 7.8 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: s390/ism: add release function for struct device According to device_release() in /driver… |
CVE-2025-21855 | High | 8.6 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: ibmvnic: Don't reference skb after sending to VIOS Previously, after successfully flushin… |
CVE-2025-21854 | Medium | 5.5 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: sockmap, vsock: For connectible sockets allow only connected sockmap expects all vsocks t… |
CVE-2025-21853 | Medium | 5.5 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: bpf: avoid holding freeze_mutex during mmap operation We use map->freeze_mutex to prevent… |
CVE-2025-21852 | Medium | 5.5 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: net: Add rx_skb of kfree_skb to raw_tp_null_args[]. Yan Zhai reported a BPF prog could tr… |
CVE-2025-21851 | High | 7.8 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: bpf: Fix softlockup in arena_map_free on 64k page kernel On an aarch64 kernel with CONFIG… |
CVE-2025-21850 | Critical | 9.8 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: nvmet: Fix crash when a namespace is disabled The namespace percpu counter protects pendi… |
CVE-2025-21849 | Medium | 5.5 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Use spin_lock_irqsave() in interruptible context spin_lock/unlock() function… |
CVE-2025-21848 | Medium | 5.5 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() Add check for the return value of nfp_ap… |
CVE-2025-21847 | Medium | 5.5 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data() The nullity of sps… |
CVE-2025-21846 | Medium | 5.5 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: acct: perform last write from workqueue In [1] it was reported that the acct(2) system ca… |
CVE-2025-21845 | Medium | 5.5 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: mtd: spi-nor: sst: Fix SST write failure 'commit 18bcb4aa54ea ("mtd: spi-nor: sst: Factor… |
CVE-2025-21844 | High | 7.5 | 2025-03-12 | In the Linux kernel, the following vulnerability has been resolved: smb: client: Add check for next_buffer in receive_encrypted_standard() Add check for the… |
CVE-2025-24912 | Low | 3.7 | 2025-03-12 | hostapd fails to process crafted RADIUS packets properly. When hostapd authenticates wi-fi devices with RADIUS authentication, an attacker in the position betw… |
CVE-2025-2205 | Medium | 4.4 | 2025-03-12 | The GDPR Cookie Compliance – Cookie Banner, Cookie Consent, Cookie Notice – CCPA, DSGVO, RGPD plugin for WordPress is vulnerable to Stored Cross-Site Scripting… |
CVE-2025-2078 | Medium | 4.4 | 2025-03-12 | The BlogBuzzTime for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1 due to i… |
CVE-2025-2077 | Medium | 6.1 | 2025-03-12 | The Simple Amazon Affiliate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'msg' parameter in all versions up to, and including… |
CVE-2025-2076 | Medium | 4.4 | 2025-03-12 | The binlayerpress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.1 due to insuffi… |
CVE-2025-1508 | Medium | 5.3 | 2025-03-12 | The WP Crowdfunding plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the download_data action in all vers… |
CVE-2025-2220 | Low | 3.3 | 2025-03-12 | A vulnerability was found in Odyssey CMS up to 10.34. It has been classified as problematic. Affected is an unknown function of the file /modules/odyssey_conta… |
CVE-2025-2219 | High | 7.3 | 2025-03-12 | A vulnerability was found in LoveCards LoveCardsV2 up to 2.3.2 and classified as critical. This issue affects some unknown processing of the file /api/upload/i… |
CVE-2025-2218 | Medium | 5.3 | 2025-03-12 | A vulnerability has been found in LoveCards LoveCardsV2 up to 2.3.2 and classified as critical. This vulnerability affects unknown code of the file /api/system… |
CVE-2025-2217 | Medium | 6.3 | 2025-03-12 | A vulnerability, which was classified as critical, was found in zzskzy Warehouse Refinement Management System 1.3. This affects the function ProcessRequest of… |
CVE-2025-2216 | Medium | 6.3 | 2025-03-12 | A vulnerability, which was classified as critical, has been found in zzskzy Warehouse Refinement Management System 1.3. Affected by this issue is the function… |
CVE-2025-2215 | Medium | 4.7 | 2025-03-12 | A vulnerability classified as critical was found in Doufox up to 0.2.0. Affected by this vulnerability is an unknown functionality of the file /?s=doudou&c=fil… |
CVE-2025-2214 | Low | 3.5 | 2025-03-12 | A vulnerability was found in Microweber 2.0.19. It has been rated as problematic. This issue affects some unknown processing of the file userfiles/modules/sett… |
CVE-2025-2233 | High | 8.8 | 2025-03-11 | Samsung SmartThings Improper Verification of Cryptographic Signature Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers… |
CVE-2025-2213 | Low | 2.4 | 2025-03-11 | A vulnerability was found in Castlenet CBW383G2N up to 20250301. It has been declared as problematic. This vulnerability affects unknown code of the file /wlan… |
CVE-2025-2212 | Low | 2.4 | 2025-03-11 | A vulnerability was found in Castlenet CBW383G2N up to 20250301. It has been classified as problematic. This affects an unknown part of the file /RgSwInfo.asp… |
CVE-2025-2211 | Low | 2.4 | 2025-03-11 | A vulnerability was found in aitangbao springboot-manager 3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /… |
CVE-2025-2210 | Low | 2.4 | 2025-03-11 | A vulnerability has been found in aitangbao springboot-manager 3.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-2209 | Low | 2.4 | 2025-03-11 | A vulnerability, which was classified as problematic, was found in aitangbao springboot-manager 3.0. Affected is an unknown function of the file /sysDict/add… |
CVE-2025-27792 | | 2025-03-11 | Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, the protections against cross-site request forgery (… | |
CVE-2025-27101 | | 2025-03-11 | Opal is OBiBa’s core database application for biobanks or epidemiological studies. Prior to version 5.1.1, when copying any parent directory to a folder in the… | |
CVE-2025-1707 | High | 8.8 | 2025-03-11 | The Review Schema plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.4 via post meta. This makes it possible… |
CVE-2025-2208 | Low | 2.4 | 2025-03-11 | A vulnerability, which was classified as problematic, has been found in aitangbao springboot-manager 3.0. This issue affects some unknown processing of the fil… |
CVE-2025-2023 | High | 7.8 | 2025-03-11 | Ashlar-Vellum Cobalt LI File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2025-2022 | High | 7.8 | 2025-03-11 | Ashlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2025-2021 | High | 7.8 | 2025-03-11 | Ashlar-Vellum Cobalt XE File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2025-2020 | High | 7.8 | 2025-03-11 | Ashlar-Vellum Cobalt VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary… |
CVE-2025-2019 | High | 7.8 | 2025-03-11 | Ashlar-Vellum Cobalt VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arb… |
CVE-2025-2018 | High | 7.8 | 2025-03-11 | Ashlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2025-2017 | High | 7.8 | 2025-03-11 | Ashlar-Vellum Cobalt CO File Parsing Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2025-2016 | High | 7.8 | 2025-03-11 | Ashlar-Vellum Cobalt VC6 File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2025-2015 | High | 7.8 | 2025-03-11 | Ashlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2025-2014 | High | 7.8 | 2025-03-11 | Ashlar-Vellum Cobalt VS File Parsing Use of Uninitialized Variable Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a… |
CVE-2025-2013 | High | 7.8 | 2025-03-11 | Ashlar-Vellum Cobalt CO File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code o… |
CVE-2025-2012 | High | 7.8 | 2025-03-11 | Ashlar-Vellum Cobalt VS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary co… |
CVE-2025-28943 | Medium | 5.9 | 2025-03-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in mylo2h2s DP ALTerminator - Missing ALT manager dp-altermi… |
CVE-2025-28941 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in ohtan Spam Byebye spam-byebye allows Cross Site Request Forgery.This issue affects Spam Byebye: from n/a thr… |
CVE-2025-28940 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in arkapravamajumder Back To Top backtotop allows Cross Site Request Forgery.This issue affects Back To Top: fr… |
CVE-2025-28938 | Medium | 4.3 | 2025-03-11 | Missing Authorization vulnerability in Bjoern WP Performance Pack wp-performance-pack allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-28937 | Medium | 5.9 | 2025-03-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lavacode Lava Ajax Search lava-ajax-search allows Stored… |
CVE-2025-28936 | Medium | 5.9 | 2025-03-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sakurapixel Lunar lunar-sell-photos-online allows Stored… |
CVE-2025-28933 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in maxfoundry MaxA/B maxab allows Stored XSS.This issue affects MaxA/B: from n/a through <= 2.2.2. |
CVE-2025-28932 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in BCS Website Solutions Insert Code insert-code allows Stored XSS.This issue affects Insert Code: from n/a thr… |
CVE-2025-28931 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in DevriX Hashtags wp-hashtags allows Stored XSS.This issue affects Hashtags: from n/a through <= 0.3.2. |
CVE-2025-28930 | Medium | 6.5 | 2025-03-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rodolphe MOULIN List Mixcloud list-mixcloud allows Stored… |
CVE-2025-28929 | Medium | 6.5 | 2025-03-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vivek Marakana Tabbed Login Widget tabbed-login allows St… |
CVE-2025-28927 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in A. Chappard Display Template Name display-template-name allows Cross Site Request Forgery.This issue affects… |
CVE-2025-28926 | Medium | 5.9 | 2025-03-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in popeating Post Read Time post-read-time allows Stored XSS… |
CVE-2025-28925 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Hieu Nguyen WATI Chat and Notification wati-chat-and-notification allows Stored XSS.This issue affects WATI… |
CVE-2025-28923 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in philippe No Disposable Email no-disposable-email allows Stored XSS.This issue affects No Disposable Email: f… |
CVE-2025-28922 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Terence D. Go To Top go-to-top allows Stored XSS.This issue affects Go To Top: from n/a through <= 0.0.8. |
CVE-2025-28920 | Medium | 5.3 | 2025-03-11 | Missing Authorization vulnerability in Jogesh Responsive Google Map responsive-google-map allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-28919 | Medium | 6.5 | 2025-03-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shellbot Easy Image Display easy-image-display allows Sto… |
CVE-2025-28918 | Medium | 6.5 | 2025-03-11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in A. Jones Featured Image Thumbnail Grid thumbnail-grid all… |