2025 CVEs (page 39)
Page 39 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-8615 | Medium | 6.4 | 2026-01-17 | The CubeWP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cubewp_shortcode_taxonomy shortcode in all versions up to, and in… |
CVE-2025-14078 | Medium | 5.3 | 2026-01-17 | The PAYGENT for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.4.6. This is due to missing aut… |
CVE-2025-10484 | Critical | 9.8 | 2026-01-17 | The Registration & Login with Mobile Phone Number for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and includ… |
CVE-2025-14478 | High | 7.5 | 2026-01-17 | The Demo Importer Plus plugin for WordPress is vulnerable to XML External Entity Injection (XXE) in all versions up to, and including, 2.0.9 via the SVG file u… |
CVE-2025-12129 | Medium | 5.3 | 2026-01-17 | The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.1.27 via t… |
CVE-2025-12984 | Medium | 4.9 | 2026-01-17 | The Advanced Ads – Ad Manager & AdSense plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 2.0… |
CVE-2025-14029 | Medium | 5.3 | 2026-01-17 | The Community Events plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_admin_event_approval… |
CVE-2025-12825 | Medium | 5.3 | 2026-01-17 | The User Registration Using Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_cf7_… |
CVE-2025-12168 | Medium | 4.3 | 2026-01-17 | The Phrase TMS Integration for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wp_a… |
CVE-2025-14463 | Medium | 5.3 | 2026-01-17 | The Payment Button for PayPal plugin for WordPress is vulnerable to unauthorized order creation in all versions up to, and including, 1.2.3.41. This is due to… |
CVE-2025-13725 | Medium | 6.5 | 2026-01-17 | The Gutenberg Thim Blocks – Page Builder, Gutenberg Blocks for the Block Editor plugin for WordPress is vulnerable to arbitrary file reads in all versions up t… |
CVE-2025-15403 | Critical | 9.8 | 2026-01-17 | The RegistrationMagic plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.0.7.1. This is due to the 'add_menu' f… |
CVE-2025-14632 | Medium | 4.4 | 2026-01-17 | The Filr – Secure document library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via unrestricted file upload in all versions up to, and in… |
CVE-2025-14450 | Medium | 6.5 | 2026-01-17 | The Wallet System for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'change_wall… |
CVE-2025-14075 | Medium | 5.3 | 2026-01-17 | The WP Hotel Booking plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2.7. This is due to the plugi… |
CVE-2025-12718 | Medium | 5.8 | 2026-01-17 | The Quick Contact Form plugin for WordPress is vulnerable to Open Mail Relay in all versions up to, and including, 8.2.6. This is due to the 'qcf_validate_form… |
CVE-2025-12002 | Medium | 5.9 | 2026-01-17 | The Feeds for YouTube Pro plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 2.6.0 via the 'sby_check_wp_submit' A… |
CVE-2025-56451 | Medium | 6.1 | 2026-01-16 | Cross site scripting vulnerability in seeyon Zhiyuan A8+ Collaborative Management Software 7.0 via the topValue parameter to the seeyon/main.do endpoint. |
CVE-2025-15529 | Medium | 5.3 | 2026-01-16 | A vulnerability was found in Open5GS up to 2.7.6. Affected by this issue is the function sgwc_s5c_handle_create_session_response of the file src/sgwc/s5c-handl… |
CVE-2025-15528 | Medium | 5.3 | 2026-01-16 | A vulnerability has been found in Open5GS up to 2.7.6. Affected by this vulnerability is an unknown functionality of the component GTPv2 Bearer Response Handle… |
CVE-2025-69581 | Medium | 5.5 | 2026-01-16 | An issue was discovered in Chamillo LMS 1.11.2. The Social Network /personal_data endpoint exposes full sensitive user information even after logout because pr… |
CVE-2025-68924 | High | 7.5 | 2026-01-16 | In Umbraco UmbracoForms through 8.13.16, an authenticated attacker can supply a malicious WSDL (aka Webservice) URL as a data source for remote code execution. |
CVE-2025-62291 | High | 8.1 | 2026-01-16 | In the eap-mschapv2 plugin (client-side) in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted message of size 6 through 8, and cause… |
CVE-2025-61873 | Low | 2.6 | 2026-01-16 | Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and 6.0.2 allows CSV Injection via ticket values when TSV export is used. |
CVE-2025-48647 | High | 7.8 | 2026-01-16 | In cpm_fwtp_msg_handler of cpm/google/lib/tracepoint/cpm_fwtp_ipc.c, there is a possible memory overwrite due to improper input validation. This could lead to… |
CVE-2025-15032 | High | 7.4 | 2026-01-16 | Missing about:blank indicator in custom-sized new windows in Dia before 1.9.0 on macOS could allow an attacker to spoof a trusted domain in the window title an… |
CVE-2025-51602 | Medium | 4.8 | 2026-01-16 | mmstu.c in VideoLAN VLC media player before 3.0.22 allows an out-of-bounds read and denial of service via a crafted 0x01 response from an MMS server. |
CVE-2025-43904 | Medium | 4.2 | 2026-01-16 | In SchedMD Slurm before 24.11.5, 24.05.8, and 23.11.11, the accounting system can allow a Coordinator to promote a user to Administrator. |
CVE-2025-43508 | Medium | 5.5 | 2026-01-16 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data. |
CVE-2025-31510 | High | 7.2 | 2026-01-16 | In the portal in LemonLDAP::NG before 2.21.0, cross-site scripting (XSS) allows remote attackers to inject arbitrary web script or HTML (into the login page) v… |
CVE-2025-31186 | Low | 3.3 | 2026-01-16 | A permissions issue was addressed with additional restrictions. This issue is fixed in Xcode 16.3. An app may be able to bypass Privacy preferences. |
CVE-2025-24531 | Medium | 6.7 | 2026-01-16 | In OpenSC pam_pkcs11 before 0.6.13, pam_sm_authenticate() wrongly returns PAM_IGNORE in many error situations (such as an error triggered by a smartcard before… |
CVE-2025-24528 | High | 7.1 | 2026-01-16 | In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An auth… |
CVE-2025-24090 | Low | 3.3 | 2026-01-16 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app may be able to enumerate a user's insta… |
CVE-2025-24089 | Medium | 5.3 | 2026-01-16 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.3 and iPadOS 18.3. An app may be able to enumerate a user's insta… |
CVE-2025-71020 | High | 7.5 | 2026-01-16 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the security parameter of the sub_4C408 function. This vulnerability allows attackers to c… |
CVE-2025-70746 | High | 7.5 | 2026-01-16 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the timeZone parameter of the fromSetSysTime function. This vulnerability allows attackers… |
CVE-2025-29943 | | 2026-01-16 | Write what were condition within AMD CPUs may allow an admin-privileged attacker to modify the configuration of the CPU pipeline potentially resulting in the c… | |
CVE-2025-68921 | High | 7.8 | 2026-01-16 | SteelSeries Nahimic 3 1.10.7 allows Directory traversal. |
CVE-2025-15104 | Medium | 5.3 | 2026-01-16 | Nu Html Checker (validator.nu) contains a restriction bypass that allows remote attackers to make the server perform arbitrary HTTP/HTTPS requests to internal… |
CVE-2025-14894 | Critical | 9.8 | 2026-01-16 | Livewire Filemanager, commonly used in Laravel applications, contains LivewireFilemanagerComponent.php, which does not perform file type and MIME validation, a… |
CVE-2025-14510 | High | 8.1 | 2026-01-16 | Incorrect Implementation of Authentication Algorithm vulnerability in ABB ABB Ability OPTIMAX.This issue affects ABB Ability OPTIMAX: 6.1, 6.2, from 6.3.0 befo… |
CVE-2025-14435 | Medium | 6.8 | 2026-01-16 | Mattermost versions 10.11.x <= 10.11.8, 11.1.x <= 11.1.1, 11.0.x <= 11.0.6 fail to prevent infinite re-renders on API errors which allows authenticated users t… |
CVE-2025-68675 | High | 7.5 | 2026-01-16 | In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication… |
CVE-2025-68438 | High | 7.5 | 2026-01-16 | In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in… |
CVE-2025-59870 | High | 7.4 | 2026-01-16 | HCL MyXalytics is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a secur… |
CVE-2025-14844 | High | 8.2 | 2026-01-16 | The Membership Plugin – Restrict Content plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 3.2.16 via the 'rcp… |
CVE-2025-60021 | Critical | 9.8 | 2026-01-16 | Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject rem… |
CVE-2025-14822 | Low | 3.1 | 2026-01-16 | Mattermost versions 10.11.x <= 10.11.8 fail to validate input size before processing hashtags which allows an authenticated attacker to exhaust CPU resources v… |
CVE-2025-14757 | Medium | 5.3 | 2026-01-16 | The Cost Calculator Builder plugin for WordPress is vulnerable to Unauthenticated Payment Status Bypass in all versions up to, and including, 3.6.9 only when u… |
CVE-2025-12007 | High | 8.4 | 2026-01-16 | There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X13SEM-F . An attacker can update the system firmware with a special… |
CVE-2025-12006 | High | 7.2 | 2026-01-16 | There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X12STW-F . An attacker can update the system firmware with a special… |
CVE-2025-14375 | Medium | 6.1 | 2026-01-16 | The RSS Aggregator – RSS Import, News Feeds, Feed to Post, and Autoblogging plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘class… |
CVE-2025-14853 | Medium | 4.3 | 2026-01-16 | The LEAV Last Email Address Validator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions <= 1.7.1. This is due to missing or incorrec… |
CVE-2025-14793 | Medium | 5.0 | 2026-01-16 | The DK PDF – WordPress PDF Generator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.3.0 via the 'add… |
CVE-2025-15527 | Medium | 4.3 | 2026-01-16 | The WP Recipe Maker plugin for WordPress is vulnerable to Information Exposure in versions up to, and including, 10.2.2 via the api_get_post_summary function d… |
CVE-2025-15526 | Medium | 5.3 | 2026-01-16 | The Fancy Product Designer plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 6.4.8. This is due to improper erro… |
CVE-2025-15370 | Medium | 4.3 | 2026-01-16 | The Shield: Blocks Bots, Protects Users, and Prevents Security Breaches plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions… |
CVE-2025-14982 | Medium | 4.3 | 2026-01-16 | The Booking Calendar plugin for WordPress is vulnerable to Missing Authorization leading to Sensitive Information Exposure in all versions up to, and including… |
CVE-2025-14384 | Medium | 4.3 | 2026-01-16 | The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to unauthorized access of data due to a mi… |
CVE-2025-12957 | High | 8.8 | 2026-01-16 | The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.5.7. This is due to insufficie… |
CVE-2025-12641 | Medium | 6.5 | 2026-01-16 | The Awesome Support - WordPress HelpDesk & Support Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in all versions… |
CVE-2025-62582 | Critical | 9.8 | 2026-01-16 | Delta Electronics DIAView has multiple vulnerabilities. |
CVE-2025-62581 | Critical | 9.8 | 2026-01-16 | Delta Electronics DIAView has multiple vulnerabilities. |
CVE-2025-65118 | High | 8.8 | 2026-01-16 | The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to trick Process Optimization services into loading arbitrary code… |
CVE-2025-65117 | High | 7.4 | 2026-01-16 | The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Designer User) to embed OLE objects into graphics, and escalate… |
CVE-2025-64769 | High | 7.1 | 2026-01-16 | The Process Optimization application suite leverages connection channels/protocols that by-default are not encrypted and could become subject to hijacking or… |
CVE-2025-64729 | High | 8.1 | 2026-01-16 | The vulnerability, if exploited, could allow an authenticated miscreant (OS Standard User) to tamper with Process Optimization project files, embed code, and… |
CVE-2025-64691 | High | 8.8 | 2026-01-16 | The vulnerability, if exploited, could allow an authenticated miscreant (OS standard user) to tamper with TCL Macro scripts and escalate privileges to OS sys… |
CVE-2025-61943 | High | 8.4 | 2026-01-16 | The vulnerability, if exploited, could allow an authenticated miscreant (Process Optimization Standard User) to tamper with queries in Captive Historian and… |
CVE-2025-61937 | Critical | 10.0 | 2026-01-16 | The vulnerability, if exploited, could allow an unauthenticated miscreant to achieve remote code execution under OS system privileges of “taoimr” service, po… |
CVE-2025-14237 | Critical | 9.8 | 2026-01-16 | Buffer overflow in XPS font parse processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to… |
CVE-2025-14236 | Critical | 9.8 | 2026-01-16 | Buffer overflow in Address Book attribute tag processing on Small Office Multifunction Printers(*) which may allow an attacker on the network segment to trigge… |
CVE-2025-14235 | Critical | 9.8 | 2026-01-16 | Buffer overflow in XPS font fpgm data processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segmen… |
CVE-2025-14234 | Critical | 9.8 | 2026-01-16 | Buffer overflow in CPCA list processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment to trig… |
CVE-2025-14233 | Critical | 9.8 | 2026-01-16 | Invalid free in CPCA file deletion processing on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment t… |
CVE-2025-14232 | Critical | 9.8 | 2026-01-16 | Buffer overflow in XML processing of XPS file in Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment t… |
CVE-2025-14231 | Critical | 9.8 | 2026-01-16 | Buffer overflow in print job processing by WSD on Small Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the network segment… |
CVE-2025-68671 | Medium | 6.5 | 2026-01-15 | lakeFS is an open-source tool that transforms object storage into a Git-like repositories. LakeFS's S3 gateway does not validate timestamps in authenticated re… |
CVE-2025-67823 | High | 8.2 | 2026-01-15 | A vulnerability in the Multimedia Email component of Mitel MiContact Center Business through 10.2.0.10 and Mitel CX through 1.1.0.1 could allow an unauthentica… |
CVE-2025-67822 | Critical | 9.4 | 2026-01-15 | A vulnerability in the Provisioning Manager component of Mitel MiVoice MX-ONE 7.3 (7.3.0.0.50) through 7.8 SP1 (7.8.1.0.14) could allow an unauthenticated atta… |
CVE-2025-70893 | High | 8.8 | 2026-01-15 | A time-based blind SQL Injection vulnerability exists in PHPGurukul Cyber Cafe Management System v1.0 within the adminprofile.php endpoint. The application fai… |
CVE-2025-70892 | Critical | 9.8 | 2026-01-15 | Phpgurukul Cyber Cafe Management System v1.0 contains a SQL Injection vulnerability in the user management module. The application fails to properly validate u… |
CVE-2025-70891 | Medium | 6.1 | 2026-01-15 | A stored cross-site scripting (XSS) vulnerability exists in Phpgurukul Cyber Cafe Management System v1.0 within the user management module. The application doe… |
CVE-2025-70890 | Medium | 6.1 | 2026-01-15 | A stored cross-site scripting (XSS) vulnerability exists in Cyber Cafe Management System v1.0. An authenticated attacker can inject arbitrary JavaScript code i… |
CVE-2025-67025 | Medium | 6.1 | 2026-01-15 | Cross Site Scripting vulnerability in Anycomment anycomment.io 0.4.4 allows a remote attacker to execute arbitrary code via the Anycomment comment section |
CVE-2025-65368 | Medium | 6.1 | 2026-01-15 | SparkyFitness v0.15.8.2 is vulnerable to Cross Site Scripting (XSS) via user input and LLM output. |
CVE-2025-60011 | Medium | 5.8 | 2026-01-15 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved al… |
CVE-2025-60007 | Medium | 5.5 | 2026-01-15 | A NULL Pointer Dereference vulnerability in the chassis daemon (chassisd) of Juniper Networks Junos OS on MX, SRX and EX Series allows a local attacker with lo… |
CVE-2025-60003 | High | 7.5 | 2026-01-15 | A Buffer Over-read vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-base… |
CVE-2025-59961 | Medium | 5.5 | 2026-01-15 | An Incorrect Permission Assignment for Critical Resource vulnerability in the Juniper DHCP daemon (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved al… |
CVE-2025-59960 | High | 7.4 | 2026-01-15 | An Improper Check for Unusual or Exceptional Conditions vulnerability in the Juniper DHCP service (jdhcpd) of Juniper Networks Junos OS and Junos OS Evolved al… |
CVE-2025-59959 | Medium | 5.5 | 2026-01-15 | An Untrusted Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a local, authentic… |
CVE-2025-52987 | Medium | 6.1 | 2026-01-15 | A clickjacking vulnerability exists in the web portal of Juniper Networks Paragon Automation (Pathfinder, Planner, Insights) due to the application's failure t… |
CVE-2025-65349 | Medium | 5.4 | 2026-01-15 | A Stored Cross-Site Scripting (XSS) vulnerability in Web management interface in Each Italy Wireless Mini Router WIRELESS-N 300M v28K.MiniRouter.20190211 allow… |
CVE-2025-15265 | Medium | 6.1 | 2026-01-15 | An SSR XSS exists in async hydration when attacker‑controlled keys are passed to hydratable. The key is embedded inside a <script> block without HTML‑safe esca… |
CVE-2025-70303 | Medium | 5.5 | 2026-01-15 | A heap overflow in the uncv_parse_config() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file. |
CVE-2025-70302 | Medium | 5.5 | 2026-01-15 | A heap overflow in the ghi_dmx_declare_opid_bin() function of GPAC v2.4.0 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2025-67647 | Critical | 9.1 | 2026-01-15 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side req… |
CVE-2025-13845 | High | 7.8 | 2026-01-15 | CWE-416: Use After Free vulnerability that could cause remote code execution when the end user imports the malicious project file (SSD file) into Rapsody. |