2025 CVEs (page 390)
Page 390 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-28866 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in smerriman Login Logger login-logger allows Cross Site Request Forgery.This issue affects Login Logger: from… |
CVE-2025-28864 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in planetstudio Builder for Contact Form 7 by Webconstruct cf7-builder allows Cross Site Request Forgery.This i… |
CVE-2025-28863 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Carlos Minatti Delete Original Image delete-original-image allows Cross Site Request Forgery.This issue affe… |
CVE-2025-28862 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Comment Date and Gravatar remover remove-date-and-gravatar-under-comment allows Cross Site Request… |
CVE-2025-28861 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in bhzad WP jQuery Persian Datepicker wpjqp-datepicker allows Stored XSS.This issue affects WP jQuery Persian D… |
CVE-2025-28860 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in PPDPurveyor Google News Editors Picks Feed Generator google-news-editors-picks-news-feeds allows Stored XSS… |
CVE-2025-28859 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in CodeVibrant Maintenance Notice maintenance-notice allows Cross Site Request Forgery.This issue affects Maint… |
CVE-2025-28857 | High | 7.1 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in rankchecker Rankchecker.io Integration rankchecker-io-integration allows Stored XSS.This issue affects Rankc… |
CVE-2025-28856 | Medium | 4.3 | 2025-03-11 | Cross-Site Request Forgery (CSRF) vulnerability in dangrossman W3Counter Free Real-Time Web Stats blog-stats-by-w3counter allows Cross Site Request Forgery.Thi… |
CVE-2025-27181 | High | 7.8 | 2025-03-11 | Substance3D - Modeler versions 1.15.0 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context o… |
CVE-2025-27180 | Medium | 5.5 | 2025-03-11 | Substance3D - Modeler versions 1.15.0 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An att… |
CVE-2025-27173 | High | 7.8 | 2025-03-11 | Substance3D - Modeler versions 1.15.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in t… |
CVE-2025-21170 | Medium | 5.5 | 2025-03-11 | Substance3D - Modeler versions 1.15.0 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-servic… |
CVE-2025-0900 | Low | 3.3 | 2025-03-11 | PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive i… |
CVE-2025-2207 | Low | 2.4 | 2025-03-11 | A vulnerability classified as problematic was found in aitangbao springboot-manager 3.0. This vulnerability affects unknown code of the file /sys/dept. The man… |
CVE-2025-2206 | Low | 2.4 | 2025-03-11 | A vulnerability classified as problematic has been found in aitangbao springboot-manager 3.0. This affects an unknown part of the file /sys/permission. The man… |
CVE-2025-27789 | Medium | 6.2 | 2025-03-11 | Babel is a compiler for writing next generation JavaScript. When using versions of Babel prior to 7.26.10 and 8.0.0-alpha.17 to compile regular expression name… |
CVE-2025-25929 | Medium | 5.4 | 2025-03-11 | A reflected cross-site scripting (XSS) vulnerability in the component /legacyui/quickReportServlet of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute ar… |
CVE-2025-25928 | High | 8.0 | 2025-03-11 | A Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via… |
CVE-2025-25927 | Medium | 6.8 | 2025-03-11 | A Cross-Site Request Forgery (CSRF) in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request. |
CVE-2025-25925 | Medium | 4.8 | 2025-03-11 | A stored cross-scripting (XSS) vulnerability in Openmrs v2.4.3 Build 0ff0ed allows attackers to execute arbitrary web scripts or HTML via injecting a crafted p… |
CVE-2025-23360 | High | 7.1 | 2025-03-11 | NVIDIA Nemo Framework contains a vulnerability where a user could cause a relative path traversal issue by arbitrary file write. A successful exploit of this v… |
CVE-2025-23243 | Medium | 6.5 | 2025-03-11 | NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. A successful exploit of this vulnerability might lead to data t… |
CVE-2025-23242 | High | 7.3 | 2025-03-11 | NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. A successful exploit of this vulnerability might lead to escala… |
CVE-2025-27773 | High | 8.6 | 2025-03-11 | The SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. Prior to versions 4.17.0 and 5.0.0-alpha.20, there is a signature confusion a… |
CVE-2025-27591 | Medium | 6.8 | 2025-03-11 | A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/log/below. This cou… |
CVE-2025-27440 | High | 8.5 | 2025-03-11 | Heap overflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access. |
CVE-2025-27439 | High | 8.5 | 2025-03-11 | Buffer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access. |
CVE-2025-27179 | Medium | 5.5 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-s… |
CVE-2025-27178 | High | 7.8 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in th… |
CVE-2025-27177 | High | 7.8 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution… |
CVE-2025-27176 | Medium | 5.5 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-s… |
CVE-2025-27175 | High | 7.8 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in th… |
CVE-2025-27174 | High | 7.8 | 2025-03-11 | Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code… |
CVE-2025-27171 | High | 7.8 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution… |
CVE-2025-27170 | Medium | 5.5 | 2025-03-11 | Illustrator versions 29.2.1, 28.7.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service… |
CVE-2025-27169 | High | 7.8 | 2025-03-11 | Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2025-27168 | High | 7.8 | 2025-03-11 | Illustrator versions 29.2.1, 28.7.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in th… |
CVE-2025-27167 | High | 7.8 | 2025-03-11 | Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute their own programs… |
CVE-2025-27166 | High | 7.8 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in th… |
CVE-2025-27164 | Medium | 5.5 | 2025-03-11 | Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure… |
CVE-2025-27163 | Medium | 5.5 | 2025-03-11 | Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure… |
CVE-2025-27162 | High | 7.8 | 2025-03-11 | Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result… |
CVE-2025-27161 | High | 7.8 | 2025-03-11 | Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, w… |
CVE-2025-27160 | High | 7.8 | 2025-03-11 | Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code… |
CVE-2025-27159 | High | 7.8 | 2025-03-11 | Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by a Use After Free vulnerability that could result in arbitrary code… |
CVE-2025-27158 | High | 7.8 | 2025-03-11 | Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result… |
CVE-2025-26701 | Critical | 10.0 | 2025-03-11 | An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lead to SSH access, use of Sudo to root, an… |
CVE-2025-25749 | High | 7.1 | 2025-03-11 | An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength policies. |
CVE-2025-25748 | High | 7.3 | 2025-03-11 | A CSRF vulnerability in the gestione_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions (e.g., modifying user passwords)… |
CVE-2025-24453 | High | 7.8 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution… |
CVE-2025-24452 | High | 7.8 | 2025-03-11 | InDesign Desktop versions ID20.1, ID19.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in th… |
CVE-2025-24451 | High | 7.8 | 2025-03-11 | Substance3D - Painter versions 10.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the con… |
CVE-2025-24450 | High | 7.8 | 2025-03-11 | Substance3D - Painter versions 10.1.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the con… |
CVE-2025-24449 | Medium | 5.5 | 2025-03-11 | Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2025-24448 | Medium | 5.5 | 2025-03-11 | Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attac… |
CVE-2025-24445 | High | 7.8 | 2025-03-11 | Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-24444 | High | 7.8 | 2025-03-11 | Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-24443 | High | 7.8 | 2025-03-11 | Substance3D - Sampler versions 4.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in th… |
CVE-2025-24442 | High | 7.8 | 2025-03-11 | Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-24441 | High | 7.8 | 2025-03-11 | Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-24440 | High | 7.8 | 2025-03-11 | Substance3D - Sampler versions 4.5.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-24439 | High | 7.8 | 2025-03-11 | Substance3D - Sampler versions 4.5.2 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in th… |
CVE-2025-24431 | Medium | 5.5 | 2025-03-11 | Acrobat Reader versions 24.001.30225, 20.005.30748, 25.001.20428 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure… |
CVE-2025-24201 | Critical | 10.0 | 2025-03-11 | An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in Safari 18.3.1, iOS 15.8.4 and iPadOS 15… |
CVE-2025-0151 | High | 8.5 | 2025-03-11 | Use after free in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via network access. |
CVE-2025-0150 | High | 7.1 | 2025-03-11 | Incorrect behavior order in some Zoom Workplace Apps for iOS before version 6.3.0 may allow an authenticated user to conduct a denial of service via network ac… |
CVE-2025-27172 | High | 7.8 | 2025-03-11 | Substance3D - Designer versions 14.1 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-26645 | High | 8.8 | 2025-03-11 | Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network. |
CVE-2025-26634 | High | 7.5 | 2025-03-11 | Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges over a network. |
CVE-2025-26633 | High | 7.0 | 2025-03-11 | Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally. |
CVE-2025-26631 | High | 7.3 | 2025-03-11 | Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally. |
CVE-2025-26630 | High | 7.8 | 2025-03-11 | Use after free in Microsoft Office Access allows an unauthorized attacker to execute code locally. |
CVE-2025-26629 | High | 7.8 | 2025-03-11 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-26627 | High | 7.0 | 2025-03-11 | Improper neutralization of special elements used in a command ('command injection') in Azure Arc allows an authorized attacker to elevate privileges locally. |
CVE-2025-25008 | High | 7.1 | 2025-03-11 | Improper link resolution before file access ('link following') in Microsoft Windows allows an authorized attacker to elevate privileges locally. |
CVE-2025-25003 | High | 7.3 | 2025-03-11 | Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally. |
CVE-2025-24998 | High | 7.3 | 2025-03-11 | Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally. |
CVE-2025-24997 | Medium | 4.4 | 2025-03-11 | Null pointer dereference in Windows Kernel Memory allows an authorized attacker to deny service locally. |
CVE-2025-24996 | Medium | 6.5 | 2025-03-11 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-24995 | High | 7.8 | 2025-03-11 | Heap-based buffer overflow in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-24994 | High | 7.3 | 2025-03-11 | Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-24993 | High | 7.8 | 2025-03-11 | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. |
CVE-2025-24992 | Medium | 5.5 | 2025-03-11 | Buffer over-read in Windows NTFS allows an unauthorized attacker to disclose information locally. |
CVE-2025-24991 | Medium | 5.5 | 2025-03-11 | Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. |
CVE-2025-24988 | Medium | 6.6 | 2025-03-11 | Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack. |
CVE-2025-24987 | Medium | 6.6 | 2025-03-11 | Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack. |
CVE-2025-24986 | Medium | 6.5 | 2025-03-11 | Improper isolation or compartmentalization in Azure PromptFlow allows an unauthorized attacker to execute code over a network. |
CVE-2025-24985 | High | 7.8 | 2025-03-11 | Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally. |
CVE-2025-24984 | Medium | 4.6 | 2025-03-11 | Insertion of sensitive information into log file in Windows NTFS allows an unauthorized attacker to disclose information with a physical attack. |
CVE-2025-24983 | High | 7.0 | 2025-03-11 | Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. |
CVE-2025-24084 | High | 8.4 | 2025-03-11 | Untrusted pointer dereference in Windows Subsystem for Linux allows an unauthorized attacker to execute code locally. |
CVE-2025-24083 | High | 7.8 | 2025-03-11 | Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-24082 | High | 7.8 | 2025-03-11 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-24081 | High | 7.8 | 2025-03-11 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-24080 | High | 7.8 | 2025-03-11 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-24079 | High | 7.8 | 2025-03-11 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-24078 | High | 7.0 | 2025-03-11 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-24077 | High | 7.8 | 2025-03-11 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-24076 | High | 7.3 | 2025-03-11 | Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally. |