2025 CVEs (page 390)
Page 390 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-23396 | High | 7.8 | 2025-03-11 | A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions < V14.3.0.13), Teamcenter Visualization V2312 (All versions < V2312.0009)… |
CVE-2025-23384 | Low | 3.7 | 2025-03-11 | A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2.1), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2D… |
CVE-2025-27893 | Low | 1.8 | 2025-03-11 | In Archer Platform 6 through 6.14.00202.10024, an authenticated user with record creation privileges can manipulate immutable fields, such as the creation date… |
CVE-2025-1550 | Critical | 9.8 | 2025-03-11 | The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. By al… |
CVE-2025-2177 | High | 7.3 | 2025-03-11 | A vulnerability classified as critical was found in libzvbi up to 0.2.43. This vulnerability affects the function vbi_search_new of the file src/search.c. The… |
CVE-2025-2176 | High | 7.3 | 2025-03-11 | A vulnerability classified as critical has been found in libzvbi up to 0.2.43. This affects the function vbi_capture_sim_load_caption of the file src/io-sim.c… |
CVE-2025-27912 | High | 8.8 | 2025-03-11 | An issue was discovered in Datalust Seq before 2024.3.13545. Missing Content-Type validation can lead to CSRF when (1) Entra ID or OpenID Connect authenticatio… |
CVE-2025-27911 | Medium | 6.5 | 2025-03-11 | An issue was discovered in Datalust Seq before 2024.3.13545. Expansion of identifiers in message templates can be used to bypass the system "Event body limit b… |
CVE-2025-1434 | Medium | 6.1 | 2025-03-11 | The Spreadsheet view is vulnerable to a XSS attack, where a remote unauthorised attacker can read a limited amount of values or DoS the affected spreadsheet. D… |
CVE-2025-2190 | High | 8.1 | 2025-03-11 | The mobile application (com.transsnet.store) has a man-in-the-middle attack vulnerability, which may lead to code injection risks. |
CVE-2025-2175 | Medium | 4.3 | 2025-03-11 | A vulnerability was found in libzvbi up to 0.2.43. It has been rated as problematic. Affected by this issue is the function _vbi_strndup_iconv. The manipulatio… |
CVE-2025-2174 | Medium | 5.3 | 2025-03-11 | A vulnerability was found in libzvbi up to 0.2.43. It has been declared as problematic. Affected by this vulnerability is the function vbi_strndup_iconv_ucs2 o… |
CVE-2025-2173 | Medium | 5.3 | 2025-03-11 | A vulnerability was found in libzvbi up to 0.2.43. It has been classified as problematic. Affected is the function vbi_strndup_iconv_ucs2 of the file src/conv… |
CVE-2025-26706 | Medium | 5.4 | 2025-03-11 | Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.07. |
CVE-2025-26705 | Medium | 5.3 | 2025-03-11 | Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05. |
CVE-2025-26704 | Medium | 6.4 | 2025-03-11 | Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05. |
CVE-2025-26703 | Medium | 4.3 | 2025-03-11 | Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.04. |
CVE-2025-26702 | Medium | 4.9 | 2025-03-11 | Improper Input Validation vulnerability in ZTE GoldenDB allows Input Data Manipulation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.04. |
CVE-2025-0629 | Medium | 4.8 | 2025-03-11 | The Coronavirus (COVID-19) Notice Message WordPress plugin through 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege us… |
CVE-2025-2169 | High | 7.3 | 2025-03-11 | The The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and includin… |
CVE-2025-26707 | Medium | 5.3 | 2025-03-11 | Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1.03.05. |
CVE-2025-1661 | Critical | 9.8 | 2025-03-11 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6… |
CVE-2025-27436 | Medium | 4.3 | 2025-03-11 | The Manage Bank Statements in SAP S/4HANA does not perform required access control checks for an authenticated user to confirm whether a request to interact wi… |
CVE-2025-27434 | High | 8.8 | 2025-03-11 | Due to insufficient input validation, SAP Commerce (Swagger UI) allows an unauthenticated attacker to inject the malicious code from remote sources, which can… |
CVE-2025-27433 | Medium | 4.3 | 2025-03-11 | The Manage Bank Statements in SAP S/4HANA allows authenticated attacker to bypass certain functionality restrictions of the application and upload files to a r… |
CVE-2025-27432 | Low | 2.4 | 2025-03-11 | The eDocument Cockpit (Inbound NF-e) in SAP Electronic Invoicing for Brazil allows an authenticated attacker with certain privileges to gain unauthorized acces… |
CVE-2025-27431 | Medium | 5.4 | 2025-03-11 | User management functionality in SAP NetWeaver Application Server Java is vulnerable to Stored Cross-Site Scripting (XSS). This could enable an attacker to inj… |
CVE-2025-27430 | Low | 3.5 | 2025-03-11 | Under certain conditions, an SSRF vulnerability in SAP CRM and SAP S/4HANA (Interaction Center) allows an attacker with low privileges to access restricted inf… |
CVE-2025-26661 | High | 8.8 | 2025-03-11 | Due to missing authorization check, SAP NetWeaver (ABAP Class Builder) allows an attacker to gain higher access levels than they should have, resulting in esca… |
CVE-2025-26660 | Medium | 4.3 | 2025-03-11 | SAP Fiori applications using the posting library fail to properly configure security settings during the setup process, leaving them at default or inadequately… |
CVE-2025-26659 | Medium | 6.1 | 2025-03-11 | SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to DOM-basedCross-Site Scripting (XSS) vulnerability. This a… |
CVE-2025-26658 | Medium | 6.8 | 2025-03-11 | The Service Layer in SAP Business One, allows attackers to potentially gain unauthorized access and impersonate other users in the application to perform unaut… |
CVE-2025-26656 | Medium | 4.3 | 2025-03-11 | OData Service in Manage Purchasing Info Records does not perform necessary authorization checks for an authenticated user, allowing an attacker to escalate pri… |
CVE-2025-26655 | Low | 3.1 | 2025-03-11 | SAP Just In Time(JIT) does not perform necessary authorization checks for an authenticated user, allowing attacker to escalate privileges that would otherwise… |
CVE-2025-25245 | Medium | 5.4 | 2025-03-11 | SAP BusinessObjects Business Intelligence Platform (Web Intelligence) contains a deprecated web application endpoint that is not properly secured. An attacker… |
CVE-2025-25244 | Medium | 5.7 | 2025-03-11 | SAP Business Warehouse (Process Chains) allows an attacker to manipulate the process execution due to missing authorization check. An attacker with display aut… |
CVE-2025-25242 | Medium | 6.1 | 2025-03-11 | SAP NetWeaver Application Server ABAP allows malicious scripts to be executed in the application, potentially leading to a Cross-Site Scripting (XSS) vulnerabi… |
CVE-2025-23194 | Medium | 5.3 | 2025-03-11 | SAP NetWeaver Enterprise Portal OBN does not perform proper authentication check for a particular configuration setting. As result, a non-authenticated user ca… |
CVE-2025-23188 | Medium | 4.3 | 2025-03-11 | An authenticated user with low privileges can exploit a missing authorization check in an IBS module of FS-RBD, allowing unauthorized access to perform actions… |
CVE-2025-23185 | Medium | 4.1 | 2025-03-11 | Due to improper error handling in SAP Business Objects Business Intelligence Platform, technical details of the application are revealed in exceptions thrown t… |
CVE-2025-0071 | Medium | 4.9 | 2025-03-11 | SAP Web Dispatcher and Internet Communication Manager allow an attacker with administrative privileges to enable debugging trace mode with a specific parameter… |
CVE-2025-0062 | Medium | 4.7 | 2025-03-11 | SAP BusinessObjects Business Intelligence Platform allows an attacker to inject JavaScript code in Web Intelligence reports. This code is then executed in the… |
CVE-2025-1828 | High | 8.8 | 2025-03-11 | Crypt::Random Perl package 1.05 through 1.55 may use rand() function, which is not cryptographically strong, for cryptographic functions. If the Provider is n… |
CVE-2025-27926 | Medium | 4.3 | 2025-03-10 | In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) containing passwords that are readable by u… |
CVE-2025-27925 | High | 8.5 | 2025-03-10 | Nintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input. |
CVE-2025-27924 | Medium | 5.4 | 2025-03-10 | Nintex Automation 5.6 and 5.7 before 5.8 has a stored XSS issue associated with the "Navigate to a URL" action. |
CVE-2025-27610 | High | 7.5 | 2025-03-10 | Rack provides an interface for developing web applications in Ruby. Prior to versions 2.2.13, 3.0.14, and 3.1.12, `Rack::Static` can serve files under the spec… |
CVE-2025-27910 | High | 8.0 | 2025-03-10 | tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/upd/status. This vulnerability allows attackers to execu… |
CVE-2025-25908 | Medium | 5.4 | 2025-03-10 | A stored cross-site scripting (XSS) vulnerability in tianti v2.3 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into… |
CVE-2025-25907 | High | 8.8 | 2025-03-10 | tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/save. This vulnerability allows attackers to execute arb… |
CVE-2025-2137 | High | 8.8 | 2025-03-10 | Out of bounds read in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chr… |
CVE-2025-2136 | High | 8.8 | 2025-03-10 | Use after free in Inspector in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2025-2135 | High | 8.8 | 2025-03-10 | Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-1920 | High | 8.8 | 2025-03-10 | Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-0660 | Medium | 4.8 | 2025-03-10 | Concrete CMS versions 9.0.0 through 9.3.9 are affected by a stored XSS in Folder Function.The "Add Folder" functionality lacks input sanitization, allowing a r… |
CVE-2025-27913 | High | 7.5 | 2025-03-10 | Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can send email message… |
CVE-2025-27616 | High | 8.5 | 2025-03-10 | Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webho… |
CVE-2025-27615 | High | 8.2 | 2025-03-10 | umatiGateway is software for connecting OPC Unified Architecture servers with an MQTT broker utilizing JSON messages. The user interface may possibly be public… |
CVE-2025-27136 | | 2025-03-10 | LocalS3 is an Amazon S3 mock service for testing and local development. Prior to version 1.21, the LocalS3 service's bucket creation endpoint is vulnerable to… | |
CVE-2025-26696 | High | 7.0 | 2025-03-10 | Certain crafted MIME email messages that claimed to contain an encrypted OpenPGP message, which instead contained an OpenPGP signed message, were wrongly shown… |
CVE-2025-26695 | Medium | 5.3 | 2025-03-10 | When requesting an OpenPGP key from a WKD server, an incorrect padding size was used and a network observer could have learned the length of the requested emai… |
CVE-2025-25306 | Critical | 9.3 | 2025-03-10 | Misskey is an open source, federated social media platform. The patch for CVE-2024-52591 did not sufficiently validate the relation between the `id` and `url`… |
CVE-2025-22603 | High | 8.1 | 2025-03-10 | AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Versions prior… |
CVE-2025-1296 | Medium | 6.5 | 2025-03-10 | Nomad Community and Nomad Enterprise (“Nomad”) are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. T… |
CVE-2025-24813 | Critical | 9.8 | 2025-03-10 | Path Equivalence: 'file.Name' (Internal Dot) leading to Remote Code Execution and/or Information disclosure and/or malicious content added to uploaded files vi… |
CVE-2025-25977 | Critical | 9.8 | 2025-03-10 | An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement. |
CVE-2025-25940 | Critical | 9.8 | 2025-03-10 | VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java. |
CVE-2025-25382 | High | 7.5 | 2025-03-10 | An issue in the Property Tax Payment Portal in Information Kerala Mission SANCHAYA v3.0.4 allows attackers to arbitrarily modify payment amounts via a crafted… |
CVE-2025-26936 | Critical | 10.0 | 2025-03-10 | Improper Control of Generation of Code ('Code Injection') vulnerability in FRESHFACE Fresh Framework fresh-framework allows Code Injection.This issue affects F… |
CVE-2025-26933 | High | 7.5 | 2025-03-10 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nitin Prakash WC Place Order Without P… |
CVE-2025-26916 | Critical | 9.0 | 2025-03-10 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Pixflow Massive Dynamic massive-dynami… |
CVE-2025-26910 | High | 7.1 | 2025-03-10 | Cross-Site Request Forgery (CSRF) vulnerability in Iqonic Design WPBookit wpbookit allows Stored XSS.This issue affects WPBookit: from n/a through <= 1.0.1. |
CVE-2025-25620 | Medium | 5.4 | 2025-03-10 | Unifiedtransform 2.0 is vulnerable to Cross Site Scripting (XSS) in the Create assignment function. |
CVE-2025-25614 | High | 8.8 | 2025-03-10 | Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to update the personal data of fellow teachers. |
CVE-2025-2153 | Medium | 5.0 | 2025-03-10 | A vulnerability, which was classified as critical, was found in HDF5 1.14.6. Affected is the function H5SM_delete of the file H5SM.c of the component h5 File H… |
CVE-2025-2152 | Medium | 6.3 | 2025-03-10 | A vulnerability, which was classified as critical, has been found in Open Asset Import Library Assimp 5.4.3. This issue affects the function Assimp::BaseImport… |
CVE-2025-26865 | Low | 3.5 | 2025-03-10 | Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: from 18.12.17 before 18… |
CVE-2025-25616 | Medium | 4.3 | 2025-03-10 | Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams. The affected endpoint is /exams/edit-rule?exam… |
CVE-2025-25615 | Low | 2.7 | 2025-03-10 | Unifiedtransform 2.0 is vulnerable to Incorrect Access Control which allows viewing attendance list for all class sections. |
CVE-2025-1497 | Critical | 9.8 | 2025-03-10 | A vulnerability, that could result in Remote Code Execution (RCE), has been found in PlotAI. Lack of validation of LLM-generated output allows attacker to exec… |
CVE-2025-2151 | Medium | 6.3 | 2025-03-10 | A vulnerability classified as critical was found in Open Asset Import Library Assimp 5.4.3. This vulnerability affects the function Assimp::GetNextLine in the… |
CVE-2025-2149 | Low | 2.5 | 2025-03-10 | A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function nnq_Sigmoid of the component Quantiz… |
CVE-2025-2148 | Medium | 5.0 | 2025-03-10 | A vulnerability was found in PyTorch 2.6.0+cu124. It has been declared as critical. Affected by this vulnerability is the function torch.ops.profiler._call_end… |
CVE-2025-1945 | Critical | 9.8 | 2025-03-10 | picklescan before 0.0.23 fails to detect malicious pickle files inside PyTorch model archives when certain ZIP file flag bits are modified. By flipping specifi… |
CVE-2025-1944 | Medium | 6.5 | 2025-03-10 | picklescan before 0.0.23 is vulnerable to a ZIP archive manipulation attack that causes it to crash when attempting to extract and scan PyTorch model archives… |
CVE-2025-2147 | Medium | 5.3 | 2025-03-10 | A vulnerability was found in Beijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System 1.0. It has been classified as prob… |
CVE-2025-24387 | Medium | 4.8 | 2025-03-10 | A vulnerability in OTRS Application Server allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS sessions. A request to an… |
CVE-2025-27257 | Medium | 6.1 | 2025-03-10 | Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a modified firmware. T… |
CVE-2025-27256 | High | 8.3 | 2025-03-10 | Missing Authentication for Critical Function vulnerability in GE Vernova Enervista UR Setup application allows Authentication Bypass due to a missing SSH serve… |
CVE-2025-27255 | High | 8.0 | 2025-03-10 | Use of Hard-coded Credentials vulnerability in GE Vernova EnerVista UR Setup allows Privilege Escalation. The local user database is encrypted using an hardcod… |
CVE-2025-27254 | High | 8.0 | 2025-03-10 | CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass. The software's startup authentication can be disabled b… |
CVE-2025-27253 | Medium | 6.1 | 2025-03-10 | A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attacker to provide in… |
CVE-2025-2150 | Medium | 5.4 | 2025-03-10 | The C&Cm@il from HGiga has a Stored Cross-Site Scripting (XSS) vulnerability, allowing remote attackers with regular privileges to send emails containing malic… |
CVE-2025-1926 | Medium | 4.3 | 2025-03-10 | The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi… |
CVE-2025-2133 | Low | 2.4 | 2025-03-10 | A vulnerability classified as problematic was found in ftcms 2.1. Affected by this vulnerability is an unknown functionality of the file /admin/index.php/news/… |
CVE-2025-2132 | Medium | 4.7 | 2025-03-09 | A vulnerability classified as critical has been found in ftcms 2.1. Affected is an unknown function of the file /admin/index.php/web/ajax_all_lists of the comp… |
CVE-2025-2131 | Low | 2.4 | 2025-03-09 | A vulnerability was found in dayrui XunRuiCMS up to 4.6.3. It has been rated as problematic. This issue affects some unknown processing of the component Friend… |
CVE-2025-2130 | Low | 3.5 | 2025-03-09 | A vulnerability was found in OpenXE up to 1.12. It has been declared as problematic. This vulnerability affects unknown code of the component Ticket Bearbeiten… |
CVE-2025-2129 | Medium | 5.6 | 2025-03-09 | A vulnerability was found in Mage AI 0.9.75. It has been classified as problematic. This affects an unknown part. The manipulation leads to insecure default in… |
CVE-2025-2127 | Medium | 4.3 | 2025-03-09 | A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla. It has been classified as problematic. Affected is an unknown function of the file /exte… |