2025 CVEs (page 392)
Page 392 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-2049 | Low | 3.5 | 2025-03-06 | A vulnerability classified as problematic has been found in code-projects Blood Bank System 1.0. Affected is an unknown function of the file AB+.php. The manip… |
CVE-2025-2047 | Low | 3.5 | 2025-03-06 | A vulnerability was found in PHPGurukul Art Gallery Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /sea… |
CVE-2025-27598 | High | 7.5 | 2025-03-06 | ImageSharp is a 2D graphics API. An Out-of-bounds Write vulnerability has been found in the ImageSharp gif decoder, allowing attackers to cause a crash using a… |
CVE-2025-2046 | Medium | 6.3 | 2025-03-06 | A vulnerability was found in SourceCodester Best Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionalit… |
CVE-2025-2044 | Medium | 4.7 | 2025-03-06 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown fun… |
CVE-2025-2043 | Medium | 4.7 | 2025-03-06 | A vulnerability was found in LinZhaoguan pb-cms 1.0.0 and classified as critical. This issue affects some unknown processing of the file /admin#themes of the c… |
CVE-2025-2042 | Medium | 4.3 | 2025-03-06 | A vulnerability has been found in huang-yk student-manage 1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to… |
CVE-2025-2041 | Medium | 6.3 | 2025-03-06 | A vulnerability, which was classified as critical, has been found in s-a-zhd Ecommerce-Website-using-PHP 1.0. Affected by this issue is some unknown functional… |
CVE-2025-25763 | Critical | 9.8 | 2025-03-06 | crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php |
CVE-2025-2040 | Medium | 6.3 | 2025-03-06 | A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this vulnerability is an unknown functionality of the file /… |
CVE-2025-2039 | Medium | 4.7 | 2025-03-06 | A vulnerability classified as critical has been found in code-projects Blood Bank Management System 1.0. Affected is an unknown function of the file /admin/del… |
CVE-2025-2038 | High | 7.3 | 2025-03-06 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the f… |
CVE-2025-25497 | High | 8.1 | 2025-03-06 | An issue in account management interface in Netsweeper Server v.8.2.6 and earlier (fixed in v.8.2.7) allows unauthorized changes to the "Account Owner" field d… |
CVE-2025-2037 | Medium | 6.3 | 2025-03-06 | A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the f… |
CVE-2025-2036 | Medium | 6.3 | 2025-03-06 | A vulnerability was found in s-a-zhd Ecommerce-Website-using-PHP 1.0. It has been classified as critical. This affects an unknown part of the file details.php… |
CVE-2025-27600 | Medium | 6.5 | 2025-03-06 | FastGPT is a knowledge-based platform built on the LLMs. Since the web crawling plug-in does not perform intranet IP verification, an attacker can initiate an… |
CVE-2025-27509 | | 2025-03-06 | fleetdm/fleet is an open source device management, built on osquery. In vulnerable versions of Fleet, an attacker could craft a specially-formed SAML response… | |
CVE-2025-27506 | Medium | 5.4 | 2025-03-06 | NocoDB is software for building databases as spreadsheets. The API endpoint related to the password reset function is vulnerable to Reflected Cross-Site-Script… |
CVE-2025-26699 | Medium | 5.0 | 2025-03-06 | An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. The django.utils.text.wrap() method and wordwrap template filter… |
CVE-2025-26167 | High | 7.5 | 2025-03-06 | Buffalo LS520D 4.53 is vulnerable to Arbitrary file read, which allows unauthenticated attackers to access the NAS web UI and read arbitrary internal files. |
CVE-2025-25381 | High | 7.5 | 2025-03-06 | Incorrect access control in the KSRTC AWATAR app of Karnataka State Road Transport Corporation v1.3.0 allows to view sensitive information such as usernames an… |
CVE-2025-25361 | Critical | 9.8 | 2025-03-06 | An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to execute arbitrary code… |
CVE-2025-25294 | Medium | 5.3 | 2025-03-06 | Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. In all Envoy Gateway versions prior t… |
CVE-2025-25191 | Medium | 5.4 | 2025-03-06 | Group-Office is an enterprise CRM and groupware tool. This Stored XSS vulnerability exists where user input in the Name field is not properly sanitized before… |
CVE-2025-24796 | | 2025-03-06 | Collabora Online is a collaborative online office suite based on LibreOffice. Macro support is disabled by default in Collabora Online, but can be enabled by a… | |
CVE-2025-2035 | Medium | 6.3 | 2025-03-06 | A vulnerability was found in s-a-zhd Ecommerce-Website-using-PHP 1.0 and classified as critical. Affected by this issue is some unknown functionality of the fi… |
CVE-2025-2034 | High | 7.3 | 2025-03-06 | A vulnerability has been found in PHPGurukul Pre-School Enrollment System 1.0 and classified as critical. Affected by this vulnerability is an unknown function… |
CVE-2025-2033 | Medium | 6.3 | 2025-03-06 | A vulnerability, which was classified as critical, was found in code-projects Blood Bank Management System 1.0. Affected is an unknown function of the file /us… |
CVE-2025-2032 | Low | 3.5 | 2025-03-06 | A vulnerability classified as problematic was found in ChestnutCMS 1.5.2. This vulnerability affects the function renameFile of the file /cms/file/rename. The… |
CVE-2025-21834 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: seccomp: passthrough uretprobe systemcall without filtering When attaching uretprobes to… |
CVE-2025-21833 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE There is a WARN_ON_ONCE to catch an unli… |
CVE-2025-21832 | High | 7.8 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: block: don't revert iter for -EIOCBQUEUED blkdev_read_iter() has a few odd checks, like g… |
CVE-2025-21831 | Medium | 5.5 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 commit 9d26d3a8f1b0 ("PC… |
CVE-2025-21830 | High | 7.3 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: landlock: Handle weird files A corrupted filesystem (e.g. bcachefs) might return weird fi… |
CVE-2025-21829 | Critical | 9.8 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]" The Call Trace is as bel… |
CVE-2025-0337 | Medium | 6.5 | 2025-03-06 | ServiceNow has addressed an authorization bypass vulnerability that was identified in the Washington release of the Now Platform. This vulnerability, if exploi… |
CVE-2025-2031 | Medium | 6.3 | 2025-03-06 | A vulnerability classified as critical has been found in ChestnutCMS up to 1.5.2. This affects the function uploadFile of the file /dev-api/cms/file/upload. Th… |
CVE-2025-21828 | High | 8.8 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't flush non-uploaded STAs If STA state is pre-moved to AUTHORIZED (su… |
CVE-2025-21827 | High | 7.8 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface() The documentation… |
CVE-2025-21826 | High | 7.8 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: reject mismatching sum of field_len with set key length The field l… |
CVE-2025-21825 | High | 7.8 | 2025-03-06 | In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel the running bpf_timer through kworker for PREEMPT_RT During the update proced… |
CVE-2025-2030 | High | 7.3 | 2025-03-06 | A vulnerability was found in Seeyon Zhiyuan Interconnect FE Collaborative Office Platform up to 20250224. It has been rated as critical. Affected by this issue… |
CVE-2025-2029 | Medium | 5.3 | 2025-03-06 | A vulnerability was found in MicroDicom DICOM Viewer 2025.1 Build 3321. It has been classified as critical. Affected is an unknown function of the file mDicom… |
CVE-2025-25452 | Medium | 5.1 | 2025-03-06 | An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a remote attacker to escalate privileges via the "/user" endpoint |
CVE-2025-25451 | Medium | 5.1 | 2025-03-06 | An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a physically proximate attacker to escalate privileges via the "2fa_authorized" Local Stor… |
CVE-2025-25450 | Medium | 5.1 | 2025-03-06 | An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a remote attacker to escalate privileges via the deactivation of the activated second fact… |
CVE-2025-0877 | Medium | 4.7 | 2025-03-06 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in AtaksAPP Reservation Management System allows Cros… |
CVE-2025-2045 | Medium | 4.3 | 2025-03-06 | Improper authorization in GitLab EE affecting all versions from 17.7 prior to 17.7.6, 17.8 prior to 17.8.4, 17.9 prior to 17.9.1 allow users with limited perm… |
CVE-2025-1696 | | 2025-03-06 | A vulnerability exists in Docker Desktop prior to version 4.39.0 that could lead to the unintentional disclosure of sensitive information via application logs… | |
CVE-2025-1666 | Medium | 4.3 | 2025-03-06 | The Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing… |
CVE-2025-1383 | Medium | 4.3 | 2025-03-06 | The Podlove Podcast Publisher plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.2. This is due to miss… |
CVE-2025-1672 | Medium | 5.5 | 2025-03-06 | The Notibar – Notification Bar for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and in… |
CVE-2025-1540 | Low | 3.1 | 2025-03-06 | An issue has been discovered in GitLab CE/EE for Self-Managed and Dedicated instances affecting all versions from 17.5 prior to 17.6.5, 17.7 prior to 17.7.4, a… |
CVE-2025-22623 | | 2025-03-06 | Ad Inserter - Ad Manager and AdSense Ads 2.8.0 was found to be vulnerable. The web application dynamically generates web content without validating the source… | |
CVE-2025-20933 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in parsing bmp image in Samsung Notes prior to version 4.4.26.71 allows local attackers to read out-of-bounds memory. |
CVE-2025-20932 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in parsing rle of bmp image in Samsung Notes prior to version 4.4.26.71 allows local attackers to혻read out-of-bounds memory. |
CVE-2025-20931 | High | 7.3 | 2025-03-06 | Out-of-bounds write in parsing bmp image in Samsung Notes prior to version 4.4.26.71 allows local attackers to execute arbitrary code. |
CVE-2025-20930 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in parsing jpeg image in Samsung Notes prior to version 4.4.26.71 allows local attackers to read out-of-bounds memory. |
CVE-2025-20929 | High | 7.3 | 2025-03-06 | Out-of-bounds write in parsing jpeg image in Samsung Notes prior to version 4.4.26.71 allows local attackers to execute arbitrary code. |
CVE-2025-20928 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in parsing wbmp image in Samsung Notes prior to vaersion 4.4.26.71 allows local attackers to access out-of-bounds memory. |
CVE-2025-20927 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in parsing image data in Samsung Notes prior to vaersion 4.4.26.71 allows local attackers to access out-of-bounds memory. |
CVE-2025-20926 | Medium | 5.5 | 2025-03-06 | Improper export of Android application components in My Files prior to version 15.0.07.5 in Android 14 allows local attackers to access files with My Files' pr… |
CVE-2025-20925 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in applying binary of text data in Samsung Notes prior to version 4.4.26.71 allows local attackers to potentially read memory. |
CVE-2025-20924 | Medium | 4.6 | 2025-03-06 | Improper access control in Samsung Notes prior to version 4.4.26.71 allows physical attackers to access data across multiple user profiles. |
CVE-2025-20923 | Medium | 4.0 | 2025-03-06 | Improper access control in Galaxy Wearable prior to version 2.2.61.24112961 allows local attackers to launch arbitrary activity with Galaxy Wearable privilege. |
CVE-2025-20922 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in appending text paragraph in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. |
CVE-2025-20921 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in applying binary of text content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. |
CVE-2025-20920 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in action link data in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. |
CVE-2025-20919 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in applying binary of video content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. |
CVE-2025-20918 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in applying extra data of base content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. |
CVE-2025-20917 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in applying binary of pdf content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. |
CVE-2025-20916 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in reading string of SPen in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. |
CVE-2025-20915 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in applying binary of voice content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. |
CVE-2025-20914 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in applying binary of hand writing content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. |
CVE-2025-20913 | Medium | 5.5 | 2025-03-06 | Out-of-bounds read in applying binary of drawing content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. |
CVE-2025-20912 | Medium | 6.2 | 2025-03-06 | Incorrect default permission in DiagMonAgent prior to SMR Mar-2025 Release 1 allows local attackers to access data within Galaxy Watch. |
CVE-2025-20911 | Medium | 4.4 | 2025-03-06 | Improper access control in sem_wifi service prior to SMR Mar-2025 Release 1 allows privileged local attackers to update MAC address of Galaxy Watch. |
CVE-2025-20910 | Medium | 6.2 | 2025-03-06 | Incorrect default permission in Galaxy Watch Gallery prior to SMR Mar-2025 Release 1 allows local attackers to access data in Galaxy Watch Gallery. |
CVE-2025-20909 | Medium | 4.0 | 2025-03-06 | Use of implicit intent for sensitive communication in Settings prior to SMR Mar-2025 Release 1 allows local attackers to access sensitive information. |
CVE-2025-20908 | Medium | 6.5 | 2025-03-06 | Use of insufficiently random values in Auracast prior to SMR Mar-2025 Release 1 allows adjacent attackers to access Auracast broadcasting. |
CVE-2025-20903 | High | 7.3 | 2025-03-06 | Improper access control in SecSettingsIntelligence prior to SMR Mar-2025 Release 1 allows local attackers to launch privileged activities. User interaction is… |
CVE-2025-1979 | Medium | 6.4 | 2025-03-06 | Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is being logged in the st… |
CVE-2025-24864 | High | 7.8 | 2025-03-06 | Incorrect access permission of a specific folder issue exists in RemoteView Agent (for Windows) versions prior to v8.1.5.2. If this vulnerability is exploited… |
CVE-2025-22447 | High | 7.8 | 2025-03-06 | Incorrect access permission of a specific service issue exists in RemoteView Agent (for Windows) versions prior to v8.1.5.2. If this vulnerability is exploited… |
CVE-2025-27625 | Medium | 4.3 | 2025-03-05 | In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier, redirects starting with backslash (`\`) characters are considered safe, allowing attackers to perform ph… |
CVE-2025-27624 | Medium | 5.4 | 2025-03-05 | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.499 and earlier, LTS 2.492.1 and earlier allows attackers to have users toggle their collapsed/e… |
CVE-2025-27623 | Medium | 4.3 | 2025-03-05 | Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of views via REST API or CLI, allowi… |
CVE-2025-27622 | Medium | 4.3 | 2025-03-05 | Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing `config.xml` of agents via REST API or CLI, allow… |
CVE-2025-27508 | High | 7.5 | 2025-03-05 | Emissary is a P2P based data-driven workflow engine. The ChecksumCalculator class within allows for hashing and checksum generation, but it includes or default… |
CVE-2025-27516 | High | 8.8 | 2025-03-05 | Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how the Jinja sandboxed environment interacts with the |attr filter allows an attacke… |
CVE-2025-25634 | Medium | 6.5 | 2025-03-05 | A vulnerability has been found in Tenda AC15 15.03.05.19 in the function GetParentControlInfo of the file /goform/GetParentControlInfo. The manipulation of the… |
CVE-2025-25632 | Critical | 9.8 | 2025-03-05 | Tenda AC15 v15.03.05.19 is vulnerable to Command Injection via the handler function in /goform/telnet. |
CVE-2025-25362 | Critical | 9.8 | 2025-03-05 | A Server-Side Template Injection (SSTI) vulnerability in Spacy-LLM v0.7.2 allows attackers to execute arbitrary code via injecting a crafted payload into the t… |
CVE-2025-27517 | | 2025-03-05 | Volt is an elegantly crafted functional API for Livewire. Malicious, user-crafted request payloads could potentially lead to remote code execution within Volt… | |
CVE-2025-2003 | High | 7.1 | 2025-03-05 | Incorrect authorization in PAM vaults in Devolutions Server 2024.3.12 and earlier allows an authenticated user to bypass the 'add in root' permission. |
CVE-2025-27515 | Critical | 9.8 | 2025-03-05 | Laravel is a web application framework. When using wildcard validation to validate a given file or image field (`files.*`), a user-crafted malicious request co… |
CVE-2025-27513 | High | 7.5 | 2025-03-05 | OpenTelemetry dotnet is a dotnet telemetry framework. A vulnerability in OpenTelemetry.Api package 1.10.0 to 1.11.1 could cause a Denial of Service (DoS) when… |
CVE-2025-20208 | Medium | 4.6 | 2025-03-05 | A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) could allow a low-privileged, remote attacker to conduct a c… |
CVE-2025-20206 | High | 7.1 | 2025-03-05 | A vulnerability in the interprocess communication (IPC) channel of Cisco Secure Client for Windows could allow an authenticated, local attacker to perform a DL… |
CVE-2025-27497 | | 2025-03-05 | OpenDJ is an LDAPv3 compliant directory service. OpenDJ prior to 4.9.3 contains a denial-of-service (DoS) vulnerability that causes the server to become unresp… |