2025 CVEs (page 394)
Page 394 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-1953 | Low | 2.6 | 2025-03-04 | A vulnerability has been found in vLLM AIBrix 0.2.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file pkg/p… |
CVE-2025-1260 | Critical | 9.1 | 2025-03-04 | On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in unex… |
CVE-2025-1259 | High | 7.7 | 2025-03-04 | On affected platforms running Arista EOS with OpenConfig configured, a gNOI request can be run when it should have been rejected. This issue can result in user… |
CVE-2025-1080 | High | 7.8 | 2025-03-04 | LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command'… |
CVE-2025-26202 | Medium | 4.3 | 2025-03-04 | Cross-Site Scripting (XSS) vulnerability exists in the WPA/WAPI Passphrase field of the Wireless Security settings (2.4GHz & 5GHz bands) in DZS Router Web Inte… |
CVE-2025-1969 | Medium | 4.3 | 2025-03-04 | Improper request input validation in Temporary Elevated Access Management (TEAM) for AWS IAM Identity Center allows a user to modify a valid request and spoof… |
CVE-2025-1952 | High | 7.3 | 2025-03-04 | A vulnerability, which was classified as critical, was found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function of the file /ad… |
CVE-2025-1949 | Medium | 4.3 | 2025-03-04 | A vulnerability, which was classified as problematic, has been found in ZZCMS 2025. This issue affects some unknown processing of the file /3/ucenter_api/code/… |
CVE-2025-1947 | Medium | 6.3 | 2025-03-04 | A vulnerability classified as critical has been found in hzmanyun Education and Training System 2.1.3. This affects the function scorm of the file UploadImageC… |
CVE-2025-1946 | Medium | 6.3 | 2025-03-04 | A vulnerability was found in hzmanyun Education and Training System 2.1. It has been rated as critical. Affected by this issue is the function exportPDF of the… |
CVE-2025-27507 | Critical | 9.0 | 2025-03-04 | The open-source identity infrastructure software Zitadel allows administrators to disable the user self-registration. ZITADEL's Admin API contains Insecure Dir… |
CVE-2025-27402 | Medium | 4.6 | 2025-03-04 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap is missing CSRF protections on tracker fields administr… |
CVE-2025-27401 | Medium | 4.6 | 2025-03-04 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. In a standard usages of Tuleap, the issue has a limited impact… |
CVE-2025-27156 | Medium | 4.1 | 2025-03-04 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. The mass emailing features do not sanitize the content of the… |
CVE-2025-27155 | Medium | 6.1 | 2025-03-04 | Pinecone is an experimental overlay routing protocol suite which is the foundation of the current P2P Matrix demos. The Pinecone Simulator (pineconesim) includ… |
CVE-2025-27150 | Medium | 5.3 | 2025-03-04 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. The password to connect the Redis instance is not purged from… |
CVE-2025-26182 | Medium | 6.5 | 2025-03-04 | An issue in xxyopen novel plus v.4.4.0 and before allows a remote attacker to execute arbitrary code via the PageController.java file |
CVE-2025-26091 | Medium | 4.6 | 2025-03-04 | A Cross Site Scripting (XSS) vulnerability exists in TeamPasswordManager v12.162.284 and before that could allow a remote attacker to execute arbitrary JavaScr… |
CVE-2025-27111 | High | 7.5 | 2025-03-04 | Rack is a modular Ruby web server interface. The Rack::Sendfile middleware logs unsanitised header values from the X-Sendfile-Type header. An attacker can expl… |
CVE-2025-26320 | Medium | 6.5 | 2025-03-04 | t0mer BroadlinkManager v5.9.1 was discovered to contain an OS command injection vulnerability via the IP Address parameter at /device/ping. |
CVE-2025-23368 | High | 8.1 | 2025-03-04 | A flaw was found in Wildfly Elytron integration. The component does not implement sufficient measures to prevent multiple failed authentication attempts within… |
CVE-2025-1425 | | 2025-03-04 | A Sudo privilege misconfiguration vulnerability in PocketBook InkPad Color 3 on Linux, ARM allows attackers to read file contents on the device.This issue affe… | |
CVE-2025-1424 | | 2025-03-04 | A privilege escalation vulnerability in PocketBook InkPad Color 3 allows attackers to escalate to root privileges if they gain physical access to the device. T… | |
CVE-2025-27426 | Medium | 5.4 | 2025-03-04 | Malicious websites utilizing a server-side redirect to an internal error page could result in a spoofed website URL. This vulnerability was fixed in Firefox fo… |
CVE-2025-27425 | Medium | 4.3 | 2025-03-04 | Scanning certain QR codes that included text with a website URL could allow the URL to be opened without presenting the user with a confirmation alert first. T… |
CVE-2025-27424 | Medium | 4.3 | 2025-03-04 | Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page. This vulnerability was fixed in Firefox for iOS… |
CVE-2025-1943 | High | 8.2 | 2025-03-04 | Memory safety bugs present in Firefox 135 and Thunderbird 135. Some of these bugs showed evidence of memory corruption and we presume that with enough effort s… |
CVE-2025-1942 | Critical | 9.8 | 2025-03-04 | When String.toUpperCase() caused a string to get longer it was possible for uninitialized memory to be incorporated into the result string. This vulnerability… |
CVE-2025-1941 | Critical | 9.1 | 2025-03-04 | Under certain circumstances, a user opt-in setting that Focus should require authentication before use could have been be bypassed (distinct from CVE-2025-0245… |
CVE-2025-1940 | High | 7.1 | 2025-03-04 | A select option could partially obscure the confirmation prompt shown before launching external apps. This could be used to trick a user in to launching an ext… |
CVE-2025-1939 | Low | 3.9 | 2025-03-04 | Android apps can load web pages using the Custom Tabs feature. This feature supports a transition animation that could have been used to trick a user into gran… |
CVE-2025-1938 | Medium | 6.5 | 2025-03-04 | Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of memory corruption a… |
CVE-2025-1937 | High | 7.5 | 2025-03-04 | Memory safety bugs present in Firefox 135, Thunderbird 135, Firefox ESR 115.20, Firefox ESR 128.7, and Thunderbird 128.7. Some of these bugs showed evidence of… |
CVE-2025-1936 | High | 7.3 | 2025-03-04 | jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but… |
CVE-2025-1935 | Medium | 4.3 | 2025-03-04 | A web page could trick a user into setting that site as the default handler for a custom URL protocol. This vulnerability was fixed in Firefox 136, Firefox ESR… |
CVE-2025-1934 | Medium | 6.5 | 2025-03-04 | It was possible to interrupt the processing of a RegExp bailout and run additional JavaScript, potentially triggering garbage collection when the engine was no… |
CVE-2025-1933 | High | 7.6 | 2025-03-04 | On 64-bit CPUs, when the JIT compiles WASM i32 return values they can pick up bits from left over memory. This can potentially cause them to be treated as a di… |
CVE-2025-1932 | High | 8.1 | 2025-03-04 | An inconsistent comparator in xslt/txNodeSorter could have resulted in potentially exploitable out-of-bounds access. Only affected version 122 and later. This… |
CVE-2025-1931 | High | 7.5 | 2025-03-04 | It was possible to cause a use-after-free in the content process side of a WebTransport connection, leading to a potentially exploitable crash. This vulnerabil… |
CVE-2025-1930 | High | 8.8 | 2025-03-04 | On Windows, a compromised content process could use bad StreamData sent over AudioIPC to trigger a use-after-free in the Browser process. This could have led t… |
CVE-2025-1925 | Medium | 5.3 | 2025-03-04 | A vulnerability classified as problematic was found in Open5GS up to 2.7.2. Affected by this vulnerability is the function amf_nsmf_pdusession_handle_update_sm… |
CVE-2025-22226 | High | 7.1 | 2025-03-04 | VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with administrativ… |
CVE-2025-22225 | High | 8.2 | 2025-03-04 | VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading t… |
CVE-2025-22224 | Critical | 9.3 | 2025-03-04 | VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with local admi… |
CVE-2025-0958 | Medium | 5.4 | 2025-03-04 | The Ultimate WordPress Auction Plugin plugin for WordPress is vulnerable to unauthorized access to functionality in all versions up to, and including, 4.2.9. T… |
CVE-2025-0370 | Medium | 6.4 | 2025-03-04 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘src’ parameter in all versions up to… |
CVE-2025-26849 | Medium | 4.3 | 2025-03-04 | There is a Hard-coded Cryptographic Key in Docusnap 13.0.1440.24261, and earlier and later versions. This key can be used to decrypt inventory files that conta… |
CVE-2025-0512 | Medium | 6.4 | 2025-03-04 | The Structured Content (JSON-LD) #wpsc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sc_fs_local_business shortcode in all… |
CVE-2025-0433 | Medium | 6.4 | 2025-03-04 | The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross… |
CVE-2025-27521 | Medium | 6.8 | 2025-03-04 | Vulnerability of improper access permission in the process management module Impact: Successful exploitation of this vulnerability may affect service confident… |
CVE-2025-0360 | High | 7.8 | 2025-03-04 | During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the VAPIX Device Configuration framework that could l… |
CVE-2025-0359 | High | 8.5 | 2025-03-04 | During an annual penetration test conducted on behalf of Axis Communication, Truesec discovered a flaw in the ACAP Application framework that allowed applicati… |
CVE-2025-1906 | Medium | 4.7 | 2025-03-04 | A vulnerability has been found in PHPGurukul Restaurant Table Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the fil… |
CVE-2025-1905 | Low | 3.5 | 2025-03-04 | A vulnerability, which was classified as problematic, was found in SourceCodester Employee Management System 1.0. This affects an unknown part of the file empl… |
CVE-2025-1904 | Low | 3.5 | 2025-03-04 | A vulnerability, which was classified as problematic, has been found in code-projects Blood Bank System 1.0. Affected by this issue is some unknown functionali… |
CVE-2025-1307 | Critical | 9.8 | 2025-03-04 | The Newscrunch theme for WordPress is vulnerable to arbitrary file uploads due to a missing capability check in the newscrunch_install_and_activate_plugin() fu… |
CVE-2025-1306 | High | 8.8 | 2025-03-04 | The Newscrunch theme for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.8.4. This is due to missing or incorrect… |
CVE-2025-24309 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability… |
CVE-2025-24301 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can b… |
CVE-2025-23420 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability… |
CVE-2025-23418 | Low | 3.3 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read. |
CVE-2025-23414 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can b… |
CVE-2025-23409 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can b… |
CVE-2025-23240 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability… |
CVE-2025-23234 | Low | 3.3 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through buffer overflow. |
CVE-2025-22897 | Low | 3.3 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through buffer overflow. |
CVE-2025-22847 | Low | 3.3 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read. |
CVE-2025-22841 | Low | 3.3 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read. |
CVE-2025-22837 | Low | 3.3 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through NULL pointer dereference. |
CVE-2025-22835 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through out-of-bounds write. This vulnerability… |
CVE-2025-22443 | Low | 3.3 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read. |
CVE-2025-21098 | Medium | 5.5 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause information leak through out-of-bounds read bypass permission check. |
CVE-2025-21097 | Low | 3.3 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through NULL pointer dereference. |
CVE-2025-21089 | Low | 3.3 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read. |
CVE-2025-21084 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through through NULL pointer dereference.. This… |
CVE-2025-20626 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can b… |
CVE-2025-20091 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can b… |
CVE-2025-20081 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through use after free. This vulnerability can b… |
CVE-2025-20042 | Medium | 5.5 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause information leak through out-of-bounds read. |
CVE-2025-20024 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through integer overflow. This vulnerability can… |
CVE-2025-20021 | Low | 3.3 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker cause DOS through out-of-bounds read. |
CVE-2025-20011 | Low | 3.3 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker case DOS through missing release of memory. |
CVE-2025-1903 | High | 7.3 | 2025-03-04 | A vulnerability was found in Codezips Online Shopping Website 1.0. It has been rated as critical. This issue affects some unknown processing of the file /cart_… |
CVE-2025-1902 | High | 7.3 | 2025-03-04 | A vulnerability was found in PHPGurukul Student Record System 3.2. It has been declared as critical. This vulnerability affects unknown code of the file /passw… |
CVE-2025-1901 | High | 7.3 | 2025-03-04 | A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0. It has been classified as critical. This affects an unknown part of the file /admi… |
CVE-2025-1900 | High | 7.3 | 2025-03-04 | A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of… |
CVE-2025-1639 | High | 8.8 | 2025-03-04 | The Animation Addons for Elementor Pro plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on th… |
CVE-2025-1321 | Medium | 6.5 | 2025-03-04 | The teachPress plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tpsearch' shortcode in all versions up to, and including… |
CVE-2025-0912 | Critical | 9.8 | 2025-03-04 | The Donations Widget plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.19.4 via deserialization of untrusted i… |
CVE-2025-0587 | Low | 3.8 | 2025-03-04 | in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitrary code execution in pre-installed apps through integer overflow. This vulnerability can… |
CVE-2025-1899 | Medium | 6.5 | 2025-03-04 | A vulnerability has been found in Tenda TX3 16.03.13.11_multi and classified as critical. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2025-1898 | Medium | 6.5 | 2025-03-04 | A vulnerability, which was classified as critical, was found in Tenda TX3 16.03.13.11_multi. Affected is an unknown function of the file /goform/openSchedWifi… |
CVE-2025-1897 | Medium | 6.5 | 2025-03-04 | A vulnerability, which was classified as critical, has been found in Tenda TX3 16.03.13.11_multi. This issue affects some unknown processing of the file /gofor… |
CVE-2025-1896 | Medium | 6.5 | 2025-03-04 | A vulnerability classified as critical was found in Tenda TX3 16.03.13.11_multi. This vulnerability affects unknown code of the file /goform/SetStaticRouteCfg… |
CVE-2025-1895 | Medium | 6.5 | 2025-03-04 | A vulnerability classified as critical has been found in Tenda TX3 16.03.13.11_multi. This affects an unknown part of the file /goform/setMacFilterCfg. The man… |
CVE-2025-1894 | High | 7.3 | 2025-03-04 | A vulnerability was found in PHPGurukul Restaurant Table Booking System 1.0. It has been rated as critical. Affected by this issue is some unknown functionalit… |
CVE-2025-1893 | Medium | 4.3 | 2025-03-04 | A vulnerability was found in Open5GS up to 2.7.2. It has been declared as problematic. Affected by this vulnerability is the function gmm_state_authentication… |
CVE-2025-1892 | Low | 2.4 | 2025-03-04 | A vulnerability was found in shishuocms 1.1. It has been classified as problematic. Affected is an unknown function of the file /manage/folder/add.json of the… |
CVE-2025-1695 | Medium | 5.3 | 2025-03-04 | In NGINX Unit before version 1.34.2 with the Java Language Module in use, undisclosed requests can lead to an infinite loop and cause an increase in CPU resour… |
CVE-2025-27221 | Low | 3.2 | 2025-03-04 | In the URI gem before 1.0.3 for Ruby, the URI handling methods (URI.join, URI#merge, URI#+) have an inadvertent leakage of authentication credentials because u… |