2025 CVEs (page 4)
Page 4 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-55017 | Critical | 9.1 | 2026-06-26 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 befo… |
CVE-2025-7958 | | 2026-06-26 | A Code Injection vulnerability existed in Trellix Network Security CM and NX. A locally authenticated admin user can execute arbitrary code using the web inter… | |
CVE-2025-10268 | Medium | 5.3 | 2026-06-26 | The Printcart Web to Print Product Designer for WooCommerce WordPress plugin through 2.4.8 is vulnerable to path traversal which makes it possible for the atta… |
CVE-2025-71340 | High | 8.1 | 2026-06-25 | picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. Attackers can e… |
CVE-2025-71338 | Critical | 10.0 | 2026-06-25 | Flowise contains a path traversal vulnerability in the /api/v1/document-store/loader/process endpoint that allows unauthenticated attackers to write arbitrary… |
CVE-2025-71336 | Critical | 9.8 | 2026-06-25 | Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which… |
CVE-2025-71335 | High | 8.1 | 2026-06-25 | Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An at… |
CVE-2025-71334 | Critical | 9.8 | 2026-06-25 | Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and ch… |
CVE-2025-71333 | Critical | 9.8 | 2026-06-25 | Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Att… |
CVE-2025-71328 | High | 8.3 | 2026-06-25 | Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account setting… |
CVE-2025-71327 | Critical | 9.1 | 2026-06-25 | Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create us… |
CVE-2025-71324 | High | 7.5 | 2026-06-25 | Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/do… |
CVE-2025-60465 | Medium | 6.1 | 2026-06-25 | A use-after-free in the gf_filter_pid_inst_swap function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial o… |
CVE-2025-60464 | High | 7.8 | 2026-06-25 | A use-after-free in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial… |
CVE-2025-60473 | Medium | 5.5 | 2026-06-25 | A NULL pointer dereference in the gf_filter_in_parent_chain function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to caus… |
CVE-2025-60466 | Medium | 5.0 | 2026-06-25 | A use-after-free in the gf_filter_pid_get_packet function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial… |
CVE-2025-60474 | High | 7.5 | 2026-06-24 | A buffer overflow in the gf_media_import function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Servi… |
CVE-2025-60467 | High | 7.5 | 2026-06-24 | A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to caus… |
CVE-2025-60468 | Medium | 5.5 | 2026-06-24 | GPAC Multimedia Open Source Project GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master is affected by: Buffer Overflow. The impact is: cause a denial of ser… |
CVE-2025-64719 | Medium | 4.9 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a d… |
CVE-2025-60471 | Medium | 5.5 | 2026-06-24 | A use-after-free in the gf_filter_pid_reconfigure_task_discard function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to c… |
CVE-2025-71361 | High | 8.1 | 2026-06-24 | picklescan before 0.0.29 fails to detect malicious idlelib.calltip.Calltip.fetch_tip calls in pickle files, allowing remote code execution. Attackers can embed… |
CVE-2025-71354 | High | 8.1 | 2026-06-24 | picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods. Attackers can… |
CVE-2025-71332 | Medium | 6.5 | 2026-06-24 | Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id value, an authentica… |
CVE-2025-64105 | | 2026-06-23 | FOSSBilling is a billing and client management system that automates invoicing, payments, and communication for online service businesses. Versions 0.6.21 thro… | |
CVE-2025-71382 | Medium | 6.5 | 2026-06-23 | MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of ser… |
CVE-2025-61029 | High | 7.5 | 2026-06-23 | An issue in the sqlo_untry component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2025-61024 | High | 7.5 | 2026-06-23 | An issue in the sqlo_try_in_loop component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statemen… |
CVE-2025-61028 | High | 7.5 | 2026-06-23 | An issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2025-61027 | High | 7.5 | 2026-06-23 | An issue in the t_set_push component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2025-61025 | High | 7.5 | 2026-06-23 | An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2025-61023 | High | 7.5 | 2026-06-23 | An issue in the st_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2025-61022 | High | 7.5 | 2026-06-23 | An issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL stateme… |
CVE-2025-61021 | High | 7.5 | 2026-06-23 | An issue in the sqlo_natural_join_cond component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL st… |
CVE-2025-61020 | High | 7.5 | 2026-06-23 | An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statem… |
CVE-2025-61019 | High | 7.5 | 2026-06-23 | An issue in the sqlo_key_part_best component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statem… |
CVE-2025-61018 | High | 7.5 | 2026-06-23 | An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL stateme… |
CVE-2025-13162 | Medium | 4.4 | 2026-06-23 | Uncontrolled Search Path Element vulnerability in ABB Control Builder A, ABB 800xA for Advant Master. This issue affects Control Builder A: through 1.4/4; 800… |
CVE-2025-62180 | | 2026-06-23 | Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional… | |
CVE-2025-55639 | Medium | 6.5 | 2026-06-23 | GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gf_isom_add_track_kind() function at isomedia/isom_write.c. This vulnerability all… |
CVE-2025-15619 | Low | 3.5 | 2026-06-23 | HCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a single specific scenario. |
CVE-2025-71376 | High | 8.1 | 2026-06-23 | picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoComplete.fetch_completions in reduce methods. Attackers can embe… |
CVE-2025-71370 | High | 8.1 | 2026-06-23 | picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper function calls embedded in pickle files. Attackers can craft ma… |
CVE-2025-71365 | High | 8.1 | 2026-06-23 | picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval function through the reduce method. Attackers can cr… |
CVE-2025-71341 | High | 8.1 | 2026-06-23 | picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attackers to embed undetected malicious code… |
CVE-2025-71337 | High | 8.3 | 2026-06-23 | Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account ema… |
CVE-2025-71358 | High | 8.1 | 2026-06-22 | picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.autocomplete.AutoComplete.get_entity function in reduce methods. Attackers… |
CVE-2025-71344 | High | 8.1 | 2026-06-22 | picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip._run_pip built-in function when scanning pickle files, allowing a… |
CVE-2025-71339 | High | 8.1 | 2026-06-22 | Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran._eval_length gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attac… |
CVE-2025-66389 | High | 7.5 | 2026-06-22 | GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Theref… |
CVE-2025-33128 | Medium | 5.4 | 2026-06-22 | IBM Engineering Workflow Management 7.0.3 through 7.0.3 Interim Fix 020, and 7.1 through 7.1 Interim Fix 007 is vulnerable to cross-site scripting. This vulner… |
CVE-2025-2669 | Medium | 6.0 | 2026-06-22 | IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, 5.3 could allow a privileged user to perform operations and… |
CVE-2025-4994 | | 2026-06-22 | The SafeLine SL6 and SL6+ devices integrated into elevator emergency intercom systems are vulnerable to an authentication bypass. This vulnerability allows att… | |
CVE-2025-66336 | High | 8.1 | 2026-06-22 | Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL qu… |
CVE-2025-62198 | Medium | 5.4 | 2026-06-22 | An authenticated user can perform XSS. This issue affects Apache Atlas versions 2.4.0 and earlier. Users are recommended to upgrade to version 2.5.0, which f… |
CVE-2025-71378 | High | 8.1 | 2026-06-21 | picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious… |
CVE-2025-71357 | High | 8.1 | 2026-06-21 | picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed und… |
CVE-2025-71351 | | 2026-06-21 | picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the __reduce__ method, allowing remote code execution. Attackers ca… | |
CVE-2025-71348 | High | 8.1 | 2026-06-21 | picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers ca… |
CVE-2025-71379 | Medium | 4.3 | 2026-06-20 | vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.p… |
CVE-2025-71331 | Medium | 6.1 | 2026-06-20 | Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An… |
CVE-2025-71326 | High | 7.8 | 2026-06-19 | AVAST Antivirus 25.11 contains an unquoted service path vulnerability in the SecureLine service that allows local non-privileged users to execute code with ele… |
CVE-2025-62821 | Critical | 9.1 | 2026-06-19 | Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving the reported data si… |
CVE-2025-7737 | High | 8.6 | 2026-06-19 | DoS Vulnerability in 10G iSCSI Interface of Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual Storage Platform E990, E1090, E1090H: befor… |
CVE-2025-15661 | Medium | 6.5 | 2026-06-18 | libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a m… |
CVE-2025-53114 | High | 7.5 | 2026-06-18 | CometD is a scalable comet implementation for web messaging. In versions 5.0.0 through 5.0.22, 6.0.0 through 6.0.18, 7.0.0 through 7.0.18, and 8.0.0 through 8… |
CVE-2025-32437 | | 2026-06-18 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, `MediaDurationBlock… | |
CVE-2025-32436 | | 2026-06-18 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, `AddAudioToVideoBlo… | |
CVE-2025-32424 | | 2026-06-18 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, ScreenshotWebPageBl… | |
CVE-2025-32422 | | 2026-06-18 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, `StepThroughItemsBl… | |
CVE-2025-32392 | | 2026-06-18 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, AutoGPT's LoopVideo… | |
CVE-2025-58175 | Medium | 6.5 | 2026-06-18 | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESO… |
CVE-2025-52465 | High | 7.2 | 2026-06-18 | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows… |
CVE-2025-27511 | High | 7.2 | 2026-06-18 | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an ad… |
CVE-2025-10560 | | 2026-06-18 | Worksnaps before version 1.6.20260201 contains hardcoded cloud credentials and related secret material in the Worksnaps client application binaries. The expose… | |
CVE-2025-71325 | Critical | 9.8 | 2026-06-17 | picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track arguments in the cor… |
CVE-2025-71323 | Critical | 9.8 | 2026-06-17 | picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoking direct syscalls and accessing raw me… |
CVE-2025-71322 | High | 8.8 | 2026-06-17 | PickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals list, allowing attackers to bypass security checks. Malicious actors can… |
CVE-2025-71321 | Critical | 9.8 | 2026-06-17 | picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist by using distutils.file_util… |
CVE-2025-71320 | Critical | 9.8 | 2026-06-17 | picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass se… |
CVE-2025-32748 | Medium | 4.3 | 2026-06-17 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) a Host Header Injection vulnerability. An unauthenticated attacker with remote access could pot… |
CVE-2025-26240 | High | 8.4 | 2026-06-17 | In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltrat… |
CVE-2025-69189 | High | 7.3 | 2026-06-17 | Missing Authorization vulnerability in EMV JobBank allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobBank: from n… |
CVE-2025-69175 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions. |
CVE-2025-69174 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Etude <= 1.6 versions. |
CVE-2025-69170 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions. |
CVE-2025-69166 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions. |
CVE-2025-69164 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Skyward <= 1.10 versions. |
CVE-2025-69158 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Granola <= 1.13 versions. |
CVE-2025-69157 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Gamic <= 1.15 versions. |
CVE-2025-69144 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Preservation <= 1.10 versions. |
CVE-2025-69140 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in SweetDate Core < 1.1.5 versions. |
CVE-2025-69130 | High | 8.8 | 2026-06-17 | Subscriber PHP Object Injection in Entrepreneur - Booking for Small Businesses WordPress Theme <= 3.1.3 versions. |
CVE-2025-69128 | High | 8.6 | 2026-06-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in EMV JobCareer allows Path Traversal. This issue affects JobCar… |
CVE-2025-69127 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions. |
CVE-2025-69126 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions. |
CVE-2025-69123 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions. |
CVE-2025-69120 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions. |
CVE-2025-69115 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions. |
CVE-2025-69111 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions. |