2025 CVEs (page 389)
Page 389 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-0150 | High | 7.1 | 2025-03-11 | Incorrect behavior order in some Zoom Workplace Apps for iOS before version 6.3.0 may allow an authenticated user to conduct a denial of service via network ac… |
CVE-2025-27172 | High | 7.8 | 2025-03-11 | Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-26645 | High | 8.8 | 2025-03-11 | Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
CVE-2025-26634 | High | 7.5 | 2025-03-11 | Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges over a network. |
CVE-2025-26633 | High | 7.0 | 2025-03-11 | Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally. |
CVE-2025-26631 | High | 7.3 | 2025-03-11 | Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally. |
CVE-2025-26630 | High | 7.8 | 2025-03-11 | Use after free in Microsoft Office Access allows an unauthorized attacker to execute code locally. |
CVE-2025-26629 | High | 7.8 | 2025-03-11 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-26627 | High | 7.0 | 2025-03-11 | Improper neutralization of special elements used in a command ('command injection') in Azure Arc allows an authorized attacker to elevate privileges locally. |
CVE-2025-25008 | High | 7.1 | 2025-03-11 | Improper link resolution before file access ('link following') in Microsoft Windows allows an authorized attacker to elevate privileges locally. |
CVE-2025-25003 | High | 7.3 | 2025-03-11 | Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally. |
CVE-2025-24998 | High | 7.3 | 2025-03-11 | Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally. |
CVE-2025-24997 | Medium | 4.4 | 2025-03-11 | Null pointer dereference in Windows Kernel Memory allows an authorized attacker to deny service locally. |
CVE-2025-24996 | Medium | 6.5 | 2025-03-11 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-24995 | High | 7.8 | 2025-03-11 | Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-24994 | High | 7.3 | 2025-03-11 | Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-24993 | High | 7.8 | 2025-03-11 | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. |
CVE-2025-24992 | Medium | 5.5 | 2025-03-11 | Buffer over-read in Windows NTFS allows an unauthorized attacker to disclose information locally. |
CVE-2025-24991 | Medium | 5.5 | 2025-03-11 | Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. |
CVE-2025-24988 | Medium | 6.6 | 2025-03-11 | Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack. |
CVE-2025-24987 | Medium | 6.6 | 2025-03-11 | Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack. |
CVE-2025-24986 | Medium | 6.5 | 2025-03-11 | Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network. |
CVE-2025-24985 | High | 7.8 | 2025-03-11 | Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally. |
CVE-2025-24984 | Medium | 4.6 | 2025-03-11 | Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack. |
CVE-2025-24983 | High | 7.0 | 2025-03-11 | Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. |
CVE-2025-24084 | High | 8.4 | 2025-03-11 | Untrusted pointer dereference in Windows Subsystem for Linux allows an unauthorized attacker to execute code locally. |
CVE-2025-24083 | High | 7.8 | 2025-03-11 | Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-24082 | High | 7.8 | 2025-03-11 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-24081 | High | 7.8 | 2025-03-11 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-24080 | High | 7.8 | 2025-03-11 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-24079 | High | 7.8 | 2025-03-11 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-24078 | High | 7.0 | 2025-03-11 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-24077 | High | 7.8 | 2025-03-11 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-24076 | High | 7.3 | 2025-03-11 | Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-24075 | High | 7.8 | 2025-03-11 | Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-24072 | High | 7.8 | 2025-03-11 | Use after free in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally. |
CVE-2025-24071 | Medium | 6.5 | 2025-03-11 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-24070 | High | 7.0 | 2025-03-11 | Weak authentication in ASP.NET Core & Visual Studio allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-24067 | High | 7.8 | 2025-03-11 | Heap-based buffer overflow in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-24066 | High | 7.8 | 2025-03-11 | Heap-based buffer overflow in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. |
CVE-2025-24064 | High | 8.1 | 2025-03-11 | Use after free in DNS Server allows an unauthorized attacker to execute code over a network. |
CVE-2025-24061 | High | 7.8 | 2025-03-11 | Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature locally. |
CVE-2025-24059 | High | 7.8 | 2025-03-11 | Incorrect conversion between numeric types in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-24057 | High | 7.8 | 2025-03-11 | Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-24056 | High | 8.8 | 2025-03-11 | Heap-based buffer overflow in Windows Telephony Server allows an unauthorized attacker to execute code over a network. |
CVE-2025-24055 | Medium | 4.3 | 2025-03-11 | Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to disclose information with a physical attack. |
CVE-2025-24054 | Medium | 6.5 | 2025-03-11 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-24051 | High | 8.8 | 2025-03-11 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
CVE-2025-24050 | High | 7.8 | 2025-03-11 | Heap-based buffer overflow in Role: Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
CVE-2025-24049 | High | 8.4 | 2025-03-11 | Improper neutralization of special elements used in a command ('command injection') in Azure Command Line Integration (CLI) allows an unauthorized attacker to… |
CVE-2025-24048 | High | 7.8 | 2025-03-11 | Heap-based buffer overflow in Role: Windows Hyper-V allows an authorized attacker to elevate privileges locally. |
CVE-2025-24046 | High | 7.8 | 2025-03-11 | Use after free in Microsoft Streaming Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-24045 | High | 8.1 | 2025-03-11 | Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network. |
CVE-2025-24044 | High | 7.8 | 2025-03-11 | Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. |
CVE-2025-24043 | High | 7.5 | 2025-03-11 | Improper verification of cryptographic signature in .NET allows an authorized attacker to execute code over a network. |
CVE-2025-24035 | High | 8.1 | 2025-03-11 | Sensitive data storage in improperly locked memory in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network. |
CVE-2025-22213 | | 2025-03-11 | Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php and other potential… | |
CVE-2025-21247 | Medium | 4.3 | 2025-03-11 | Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network. |
CVE-2025-21199 | Medium | 6.7 | 2025-03-11 | Improper privilege management in Azure Agent Installer allows an authorized attacker to elevate privileges locally. |
CVE-2025-21180 | High | 7.8 | 2025-03-11 | Heap-based buffer overflow in Windows exFAT File System allows an unauthorized attacker to execute code locally. |
CVE-2025-21169 | High | 7.8 | 2025-03-11 | Substance3D - Designer versions 14.1 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in th… |
CVE-2025-0149 | Medium | 6.5 | 2025-03-11 | Insufficient verification of data authenticity in some Zoom Workplace Apps may allow an unprivileged user to conduct a denial of service via network access. |
CVE-2025-27617 | High | 8.8 | 2025-03-11 | Pimcore is an open source data and experience management platform. Prior to version 11.5.4, authenticated users can craft a filter string used to cause a SQL i… |
CVE-2025-27602 | Medium | 4.9 | 2025-03-11 | Umbraco is a free and open source .NET content management system. In versions of Umbraco's web backoffice program prior to versions 10.8.9 and 13.7.1, via mani… |
CVE-2025-27601 | Medium | 4.3 | 2025-03-11 | Umbraco is a free and open source .NET content management system. An improper API access control issue has been identified Umbraco's API management package pri… |
CVE-2025-25747 | Medium | 5.4 | 2025-03-11 | Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive information via the rip… |
CVE-2025-25680 | High | 7.7 | 2025-03-11 | LSC Smart Connect LSC Indoor PTZ Camera 7.6.32 is contains a RCE vulnerability in the tuya_ipc_direct_connect function of the anyka_ipc process. The vulnerabil… |
CVE-2025-27403 | | 2025-03-11 | Ratify is a verification engine as a binary executable and on Kubernetes which enables verification of artifact security metadata and admits for deployment onl… | |
CVE-2025-22454 | High | 7.8 | 2025-03-11 | Insufficiently restrictive permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges. |
CVE-2025-2196 | Low | 3.5 | 2025-03-11 | A vulnerability was found in MRCMS 3.1.2. It has been declared as problematic. Affected by this vulnerability is the function upload of the file /admin/file/up… |
CVE-2025-2195 | Low | 3.5 | 2025-03-11 | A vulnerability was found in MRCMS 3.1.2. It has been classified as problematic. Affected is the function rename of the file /admin/file/rename.do of the compo… |
CVE-2025-2194 | Low | 3.5 | 2025-03-11 | A vulnerability was found in MRCMS 3.1.2 and classified as problematic. This issue affects the function list of the file /admin/file/list.do of the component o… |
CVE-2025-27363 | High | 8.1 | 2025-03-11 | An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph stru… |
CVE-2025-22370 | | 2025-03-11 | Many fields for the web configuration interface of the firmware for Mennekes Smart / Premium Chargingpoints can be abused to execute arbitrary SQL commands bec… | |
CVE-2025-22369 | | 2025-03-11 | The ReadFile endpoint of the firmware for Mennekes Smart / Premium Chargingpoints can be abused to read arbitrary files from the underlying OS. | |
CVE-2025-22368 | | 2025-03-11 | The authenticated SCU firmware command of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS commands are… | |
CVE-2025-22367 | | 2025-03-11 | The authenticated time setting capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS command ar… | |
CVE-2025-22366 | | 2025-03-11 | The authenticated firmware update capability of the firmware for Mennekes Smart / Premium Chargingpoints can be abused for command execution because OS command… | |
CVE-2025-2193 | Medium | 5.4 | 2025-03-11 | A vulnerability has been found in MRCMS 3.1.2 and classified as critical. This vulnerability affects the function delete of the file /admin/file/delete.do of t… |
CVE-2025-2192 | Medium | 4.3 | 2025-03-11 | A vulnerability, which was classified as problematic, was found in Stoque Zeev.it 4.24. This affects an unknown part of the file /Login?inpLostSession=1 of the… |
CVE-2025-2191 | Low | 2.4 | 2025-03-11 | A vulnerability, which was classified as problematic, has been found in Claro A7600-A1 RNR4-A72T-2x16_v2110403_CLA_32_160817. Affected by this issue is some un… |
CVE-2025-2189 | | 2025-03-11 | This vulnerability exists in the Tinxy smart devices due to storage of credentials in plaintext within the device firmware. An attacker with physical access co… | |
CVE-2025-27494 | Critical | 9.1 | 2025-03-11 | A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected de… |
CVE-2025-27493 | High | 8.2 | 2025-03-11 | A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V6.4.9), SiPass integrated ACC-AP (All versions < V6.4.9). Affected de… |
CVE-2025-27438 | High | 7.8 | 2025-03-11 | A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.13), Teamcenter Visualization V2312 (All versions < V2312.0009)… |
CVE-2025-27398 | Low | 2.7 | 2025-03-11 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly neutralize special charact… |
CVE-2025-27397 | Low | 3.8 | 2025-03-11 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly limit user controlled path… |
CVE-2025-27396 | High | 8.8 | 2025-03-11 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly limit the elevation of pri… |
CVE-2025-27395 | High | 7.2 | 2025-03-11 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly limit the scope of files a… |
CVE-2025-27394 | High | 7.2 | 2025-03-11 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly sanitize user input when c… |
CVE-2025-27393 | High | 7.2 | 2025-03-11 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly sanitize user input when c… |
CVE-2025-27392 | High | 7.2 | 2025-03-11 | A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions < V4.0). Affected devices do not properly sanitize user input when c… |
CVE-2025-25267 | Medium | 6.2 | 2025-03-11 | A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0… |
CVE-2025-25266 | Medium | 6.8 | 2025-03-11 | A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions < V2302.0021), Tecnomatix Plant Simulation V2404 (All versions < V2404.0… |
CVE-2025-23402 | High | 7.8 | 2025-03-11 | A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.13), Teamcenter Visualization V2312 (All versions < V2312.0009)… |
CVE-2025-23401 | High | 7.8 | 2025-03-11 | A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.13), Teamcenter Visualization V2312 (All versions < V2312.0009)… |
CVE-2025-23400 | High | 7.8 | 2025-03-11 | A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.13), Teamcenter Visualization V2312 (All versions < V2312.0009)… |
CVE-2025-23399 | High | 7.8 | 2025-03-11 | A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.13), Teamcenter Visualization V2312 (All versions < V2312.0009)… |
CVE-2025-23398 | High | 7.8 | 2025-03-11 | A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.13), Teamcenter Visualization V2312 (All versions < V2312.0009)… |
CVE-2025-23397 | High | 7.8 | 2025-03-11 | A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.13), Teamcenter Visualization V2312 (All versions < V2312.0009)… |