2025 CVEs (page 4)

Page 4 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.

All CVEs published in 2025 — newest first (page 4 of 434)
CVESeverityScorePublishedSummary
CVE-2025-55017Critical9.12026-06-26Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 befo…
CVE-2025-79582026-06-26A Code Injection vulnerability existed in Trellix Network Security CM and NX. A locally authenticated admin user can execute arbitrary code using the web inter…
CVE-2025-10268Medium5.32026-06-26The Printcart Web to Print Product Designer for WooCommerce WordPress plugin through 2.4.8 is vulnerable to path traversal which makes it possible for the atta…
CVE-2025-71340High8.12026-06-25picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. Attackers can e…
CVE-2025-71338Critical10.02026-06-25Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary…
CVE-2025-71336Critical9.82026-06-25Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which…
CVE-2025-71335High8.12026-06-25Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An at…
CVE-2025-71334Critical9.82026-06-25Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and ch…
CVE-2025-71333Critical9.82026-06-25Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Att…
CVE-2025-71328High8.32026-06-25Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account setting…
CVE-2025-71327Critical9.12026-06-25Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create us…
CVE-2025-71324High7.52026-06-25Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/do…
CVE-2025-60465Medium6.12026-06-25A use-after-free in the gf_filter_pid_inst_swap function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial o…
CVE-2025-60464High7.82026-06-25A use-after-free in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial…
CVE-2025-60473Medium5.52026-06-25A NULL pointer dereference in the gf_filter_in_parent_chain function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to caus…
CVE-2025-60466Medium5.02026-06-25A use-after-free in the gf_filter_pid_get_packet function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial…
CVE-2025-60474High7.52026-06-24A buffer overflow in the gf_media_import function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Servi…
CVE-2025-60467High7.52026-06-24A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to caus…
CVE-2025-60468Medium5.52026-06-24GPAC Multimedia Open Source Project GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master is affected by: Buffer Overflow. The impact is: cause a denial of ser…
CVE-2025-64719Medium4.92026-06-24Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a d…
CVE-2025-60471Medium5.52026-06-24A use-after-free in the gf_filter_pid_reconfigure_task_discard function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to c…
CVE-2025-71361High8.12026-06-24picklescan before 0.0.29 fails to detect malicious idlelib.calltip.Calltip.fetch_tip calls in pickle files, allowing remote code execution. Attackers can embed…
CVE-2025-71354High8.12026-06-24picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods. Attackers can…
CVE-2025-71332Medium6.52026-06-24Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id value, an authentica…
CVE-2025-641052026-06-23FOSSBilling is a billing and client management system that automates invoicing, payments, and communication for online service businesses. Versions 0.6.21 thro…
CVE-2025-71382Medium6.52026-06-23MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of ser…
CVE-2025-61029High7.52026-06-23An issue in the sqlo_untry component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2025-61024High7.52026-06-23An issue in the sqlo_try_in_loop component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statemen…
CVE-2025-61028High7.52026-06-23An issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2025-61027High7.52026-06-23An issue in the t_set_push component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2025-61025High7.52026-06-23An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2025-61023High7.52026-06-23An issue in the st_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
CVE-2025-61022High7.52026-06-23An issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL stateme…
CVE-2025-61021High7.52026-06-23An issue in the sqlo_natural_join_cond component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL st…
CVE-2025-61020High7.52026-06-23An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statem…
CVE-2025-61019High7.52026-06-23An issue in the sqlo_key_part_best component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statem…
CVE-2025-61018High7.52026-06-23An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL stateme…
CVE-2025-13162Medium4.42026-06-23Uncontrolled Search Path Element vulnerability in ABB Control Builder A, ABB 800xA for Advant Master. This issue affects Control Builder A: through 1.4/4; 800…
CVE-2025-621802026-06-23Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional…
CVE-2025-55639Medium6.52026-06-23GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gf_isom_add_track_kind() function at isomedia/isom_write.c. This vulnerability all…
CVE-2025-15619Low3.52026-06-23HCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a single specific scenario.
CVE-2025-71376High8.12026-06-23picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoComplete.fetch_completions in reduce methods. Attackers can embe…
CVE-2025-71370High8.12026-06-23picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper function calls embedded in pickle files. Attackers can craft ma…
CVE-2025-71365High8.12026-06-23picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval function through the reduce method. Attackers can cr…
CVE-2025-71341High8.12026-06-23picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attackers to embed undetected malicious code…
CVE-2025-71337High8.32026-06-23Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account ema…
CVE-2025-71358High8.12026-06-22picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.autocomplete.AutoComplete.get_entity function in reduce methods. Attackers…
CVE-2025-71344High8.12026-06-22picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip._run_pip built-in function when scanning pickle files, allowing a…
CVE-2025-71339High8.12026-06-22Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran._eval_length gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attac…
CVE-2025-66389High7.52026-06-22GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Theref…
CVE-2025-33128Medium5.42026-06-22IBM Engineering Workflow Management 7.0.3 through 7.0.3 Interim Fix 020, and 7.1 through 7.1 Interim Fix 007 is vulnerable to cross-site scripting. This vulner…
CVE-2025-2669Medium6.02026-06-22IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, 5.3 could allow a privileged user to perform operations and…
CVE-2025-49942026-06-22The SafeLine SL6 and SL6+ devices integrated into elevator emergency intercom systems are vulnerable to an authentication bypass. This vulnerability allows att…
CVE-2025-66336High8.12026-06-22Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL qu…
CVE-2025-62198Medium5.42026-06-22An authenticated user can perform XSS. This issue affects Apache Atlas versions 2.4.0 and earlier. Users are recommended to upgrade to version 2.5.0, which f…
CVE-2025-71378High8.12026-06-21picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious…
CVE-2025-71357High8.12026-06-21picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed und…
CVE-2025-713512026-06-21picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the __reduce__ method, allowing remote code execution. Attackers ca…
CVE-2025-71348High8.12026-06-21picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers ca…
CVE-2025-71379Medium4.32026-06-20vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.p…
CVE-2025-71331Medium6.12026-06-20Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An…
CVE-2025-71326High7.82026-06-19AVAST Antivirus 25.11 contains an unquoted service path vulnerability in the SecureLine service that allows local non-privileged users to execute code with ele…
CVE-2025-62821Critical9.12026-06-19Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving the reported data si…
CVE-2025-7737High8.62026-06-19DoS Vulnerability in 10G iSCSI Interface of Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual Storage Platform E990, E1090, E1090H: befor…
CVE-2025-15661Medium6.52026-06-18libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a m…
CVE-2025-53114High7.52026-06-18CometD is a scalable comet implementation for web messaging. In versions 5.0.0 through 5.0.22, 6.0.0 through 6.0.18, 7.0.0 through 7.0.18, and 8.0.0 through 8…
CVE-2025-324372026-06-18AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, `MediaDurationBlock…
CVE-2025-324362026-06-18AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, `AddAudioToVideoBlo…
CVE-2025-324242026-06-18AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, ScreenshotWebPageBl…
CVE-2025-324222026-06-18AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, `StepThroughItemsBl…
CVE-2025-323922026-06-18AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, AutoGPT's LoopVideo…
CVE-2025-58175Medium6.52026-06-18GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESO…
CVE-2025-52465High7.22026-06-18GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows…
CVE-2025-27511High7.22026-06-18GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an ad…
CVE-2025-105602026-06-18Worksnaps before version 1.6.20260201 contains hardcoded cloud credentials and related secret material in the Worksnaps client application binaries. The expose…
CVE-2025-71325Critical9.82026-06-17picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track arguments in the cor…
CVE-2025-71323Critical9.82026-06-17picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoking direct syscalls and accessing raw me…
CVE-2025-71322High8.82026-06-17PickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals list, allowing attackers to bypass security checks. Malicious actors can…
CVE-2025-71321Critical9.82026-06-17picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist by using distutils.file_util…
CVE-2025-71320Critical9.82026-06-17picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass se…
CVE-2025-32748Medium4.32026-06-17Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) a Host Header Injection vulnerability. An unauthenticated attacker with remote access could pot…
CVE-2025-26240High8.42026-06-17In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltrat…
CVE-2025-69189High7.32026-06-17Missing Authorization vulnerability in EMV JobBank allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobBank: from n…
CVE-2025-69175High8.12026-06-17Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions.
CVE-2025-69174High8.12026-06-17Unauthenticated Local File Inclusion in Etude <= 1.6 versions.
CVE-2025-69170High8.12026-06-17Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions.
CVE-2025-69166High8.12026-06-17Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions.
CVE-2025-69164High8.12026-06-17Unauthenticated Local File Inclusion in Skyward <= 1.10 versions.
CVE-2025-69158High8.12026-06-17Unauthenticated Local File Inclusion in Granola <= 1.13 versions.
CVE-2025-69157High8.12026-06-17Unauthenticated Local File Inclusion in Gamic <= 1.15 versions.
CVE-2025-69144High8.12026-06-17Unauthenticated Local File Inclusion in Preservation <= 1.10 versions.
CVE-2025-69140High7.12026-06-17Unauthenticated Cross Site Scripting (XSS) in SweetDate Core < 1.1.5 versions.
CVE-2025-69130High8.82026-06-17Subscriber PHP Object Injection in Entrepreneur - Booking for Small Businesses WordPress Theme <= 3.1.3 versions.
CVE-2025-69128High8.62026-06-17Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in EMV JobCareer allows Path Traversal. This issue affects JobCar…
CVE-2025-69127Critical9.82026-06-17Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions.
CVE-2025-69126High8.12026-06-17Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions.
CVE-2025-69123High8.12026-06-17Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions.
CVE-2025-69120High8.12026-06-17Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions.
CVE-2025-69115High8.12026-06-17Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions.
CVE-2025-69111Critical9.82026-06-17Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions.