2025 CVEs (page 401)
Page 401 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-1745 | Medium | 4.3 | 2025-02-27 | A vulnerability has been found in LinZhaoguan pb-cms 2.0 and classified as problematic. This vulnerability affects unknown code of the component Logout. The ma… |
CVE-2025-1743 | Medium | 5.3 | 2025-02-27 | A vulnerability, which was classified as critical, was found in zyx0814 Pichome 2.1.0. This affects an unknown part of the file /index.php?mod=textviewer. The… |
CVE-2025-27157 | Medium | 5.3 | 2025-02-27 | Mastodon is a self-hosted, federated microblogging platform. Starting in version 4.2.0 and prior to versions 4.2.16 and 4.3.4, the rate limits are missing on `… |
CVE-2025-25329 | Medium | 5.5 | 2025-02-27 | An issue in Tencent Technology (Beijing) Company Limited Tencent MicroVision iOS 8.137.0 allows attackers to access sensitive user information via supplying a… |
CVE-2025-23687 | High | 7.1 | 2025-02-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in simonhunter Woo Store Mode woo-store-mode allows Reflecte… |
CVE-2025-1742 | Medium | 4.3 | 2025-02-27 | A vulnerability, which was classified as problematic, has been found in pihome-shc PiHome 2.0. Affected by this issue is some unknown functionality of the file… |
CVE-2025-25334 | Medium | 5.5 | 2025-02-27 | An issue in Suning Commerce Group Suning EMall iOS 9.5.198 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2025-25333 | High | 7.5 | 2025-02-27 | An issue in IKEA CN iOS 4.13.0 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2025-25331 | Medium | 5.5 | 2025-02-27 | An issue in Beitatong Technology LianJia iOS 9.83.50 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2025-25330 | Medium | 5.5 | 2025-02-27 | An issue in Boohee Technology Boohee Health iOS 13.0.13 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2025-25326 | Medium | 5.5 | 2025-02-27 | An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0 allows attackers to access sensitive user information via suppl… |
CVE-2025-25325 | Medium | 5.5 | 2025-02-27 | An issue in Yibin Fengguan Network Technology Co., Ltd YuPao DirectHire iOS 8.8.0 allows attackers to access sensitive user information via supplying a crafted… |
CVE-2025-25324 | Medium | 5.5 | 2025-02-27 | An issue in Shandong Provincial Big Data Center AiShanDong iOS 5.0.0 allows attackers to access sensitive user information via supplying a crafted link. |
CVE-2025-25323 | Medium | 5.5 | 2025-02-27 | An issue in Qianjin Network Information Technology (Shanghai) Co., Ltd 51Job iOS 14.22.0 allows attackers to access sensitive user information via supplying a… |
CVE-2025-1756 | High | 7.5 | 2025-02-27 | mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated pr… |
CVE-2025-1755 | High | 7.5 | 2025-02-27 | MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with ele… |
CVE-2025-1741 | Medium | 4.7 | 2025-02-27 | A vulnerability classified as problematic was found in b1gMail up to 7.4.1-pl1. Affected by this vulnerability is an unknown functionality of the file src/admi… |
CVE-2025-0914 | Low | 3.8 | 2025-02-27 | An improper access control issue in the VQL shell feature in Velociraptor Versions < 0.73.4 allowed authenticated users to execute the execve() plugin in deplo… |
CVE-2025-25761 | High | 7.2 | 2025-02-27 | HkCms v2.3.2.240702 was discovered to contain an arbitrary file write vulnerability in the component Appcenter.php. |
CVE-2025-25760 | High | 7.5 | 2025-02-27 | A Server-Side Request Forgery (SSRF) in the component admin_webgather.php of SUCMS v1.0 allows attackers to access internal data and services via a crafted GET… |
CVE-2025-25759 | High | 7.5 | 2025-02-27 | An issue in the component admin_template.php of SUCMS v1.0 allows attackers to execute a directory traversal and arbitrary file deletion via a crafted GET requ… |
CVE-2025-0759 | Low | 3.3 | 2025-02-27 | IBM EntireX 11.1 could allow a local user to unintentionally modify data timestamp integrity due to improper shared resource synchronization. |
CVE-2025-27154 | Critical | 9.8 | 2025-02-27 | Spotipy is a lightweight Python library for the Spotify Web API. The `CacheHandler` class creates a cache file to store the auth token. Prior to version 2.25.1… |
CVE-2025-22280 | High | 7.6 | 2025-02-27 | Missing Authorization vulnerability in revmakx DefendWP Firewall defend-wp-firewall allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-1739 | High | 7.1 | 2025-02-27 | An Authentication Bypass vulnerability has been found in Trivision Camera NC227WF v5.8.0 from TrivisionSecurity. This vulnerability allows an attacker to retri… |
CVE-2025-1738 | Medium | 6.2 | 2025-02-27 | A Password Transmitted over Query String vulnerability has been found in Trivision Camera NC227WF v5.8.0 from TrivisionSecurity, exposing this sensitive inform… |
CVE-2025-1693 | Low | 3.9 | 2025-02-27 | The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can inject control charac… |
CVE-2025-1692 | Medium | 6.3 | 2025-02-27 | The MongoDB Shell may be susceptible to control character injection where an attacker with control of the user’s clipboard could manipulate them to paste text… |
CVE-2025-1691 | High | 7.6 | 2025-02-27 | The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature, can use the autocomplet… |
CVE-2025-1751 | Critical | 9.8 | 2025-02-27 | A SQL Injection vulnerability has been found in Ciges 2.15.5 from ATISoluciones. This vulnerability allows an attacker to retrieve, create, update and delete d… |
CVE-2025-1450 | Medium | 6.4 | 2025-02-27 | The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty plugin for WordPress is vulnerab… |
CVE-2025-1690 | Medium | 6.4 | 2025-02-27 | The ThemeMakers Stripe Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stripe' shortcode in versions up to, and including… |
CVE-2025-1282 | High | 8.8 | 2025-02-27 | The Car Dealer Automotive WordPress Theme – Responsive theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in… |
CVE-2025-1717 | High | 8.1 | 2025-02-27 | The Login Me Now plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.7.2. This is due to insecure authentication ba… |
CVE-2025-1689 | Medium | 6.4 | 2025-02-27 | The ThemeMakers PayPal Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'paypal' shortcode in versions up to, and inc… |
CVE-2025-1295 | High | 8.8 | 2025-02-27 | The Templines Elementor Helper Core plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.7. This is due to allowi… |
CVE-2025-1686 | Medium | 6.8 | 2025-02-27 | Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the include tag. A high p… |
CVE-2025-0469 | Medium | 6.4 | 2025-02-27 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the slider templa… |
CVE-2025-21797 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: HID: corsair-void: Add missing delayed work cancel for headset status The cancel_delayed_… |
CVE-2025-21796 | Critical | 9.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: nfsd: clear acl_access/acl_default after releasing them If getting acl_default fails, acl… |
CVE-2025-21795 | High | 7.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: NFSD: fix hang in nfsd4_shutdown_callback If nfs4_client is in courtesy state then there… |
CVE-2025-21794 | High | 7.1 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: HID: hid-thrustmaster: fix stack-out-of-bounds read in usb_check_int_endpoints() Syzbot[1… |
CVE-2025-21793 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: spi: sn-f-ospi: Fix division by zero When there is no dummy cycle in the spi-nor commands… |
CVE-2025-21792 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt If an AX25 device is bo… |
CVE-2025-21791 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: vrf: use RCU protection in l3mdev_l3_out() l3mdev_l3_out() can be called without RCU bein… |
CVE-2025-21790 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: vxlan: check vxlan_vnigroup_init() return value vxlan_init() must check vxlan_vnigroup_in… |
CVE-2025-21789 | High | 7.3 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: csum: Fix OoB access in IP checksum code for negative lengths Commit 69e3a6aa6… |
CVE-2025-21788 | High | 7.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases If the XDP program doesn't… |
CVE-2025-21787 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: team: better TEAM_OPTION_TYPE_STRING validation syzbot reported following splat [1] Make… |
CVE-2025-21786 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: workqueue: Put the pwq after detaching the rescuer from the pool The commit 68f83057b913(… |
CVE-2025-21785 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array The loop that detects/popu… |
CVE-2025-21784 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: bail out when failed to load fw in psp_init_cap_microcode() In function psp_i… |
CVE-2025-21783 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: gpiolib: Fix crash on error in gpiochip_get_ngpios() The gpiochip_get_ngpios() uses chip_… |
CVE-2025-21782 | High | 7.1 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: orangefs: fix a oob in orangefs_debug_write I got a syzbot report: slab-out-of-bounds Rea… |
CVE-2025-21781 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: batman-adv: fix panic during interface removal Reference counting is used to ensure that … |
CVE-2025-21780 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() It malicious user prov… |
CVE-2025-21779 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel Advertise su… |
CVE-2025-21778 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: tracing: Do not allow mmap() of persistent ring buffer When trying to mmap a trace instan… |
CVE-2025-21777 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Validate the persistent meta data subbuf array The meta data for a mapped ri… |
CVE-2025-21776 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: USB: hub: Ignore non-compliant devices with too many configs or interfaces Robert Morris… |
CVE-2025-21775 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: can: ctucanfd: handle skb allocation failure If skb allocation fails, the pointer to stru… |
CVE-2025-21774 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: can: rockchip: rkcanfd_handle_rx_fifo_overflow_int(): bail out if skb cannot be allocated … |
CVE-2025-21773 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: can: etas_es58x: fix potential NULL pointer dereference on udev->serial The driver assume… |
CVE-2025-21772 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: partitions: mac: fix handling of bogus partition table Fix several issues in partition pr… |
CVE-2025-21771 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix incorrect autogroup migration detection scx_move_task() is called from sch… |
CVE-2025-21770 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: iommu: Fix potential memory leak in iopf_queue_remove_device() The iopf_queue_remove_devi… |
CVE-2025-21769 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: ptp: vmclock: Add .owner to vmclock_miscdev_fops Without the .owner field, the module can… |
CVE-2025-21768 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels Some lwtunnels have a dst c… |
CVE-2025-21767 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context Th… |
CVE-2025-21766 | High | 8.1 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: ipv4: use RCU protection in __ip_rt_update_pmtu() __ip_rt_update_pmtu() must use RCU prot… |
CVE-2025-21765 | High | 8.1 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU protection in ip6_default_advmss() ip6_default_advmss() needs rcu protectio… |
CVE-2025-21764 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: ndisc: use RCU protection in ndisc_alloc_skb() ndisc_alloc_skb() can be called without RT… |
CVE-2025-21763 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: neighbour: use RCU protection in __neigh_notify() __neigh_notify() can be called without… |
CVE-2025-21762 | High | 8.1 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: arp: use RCU protection in arp_xmit() arp_xmit() can be called without RTNL or RCU protec… |
CVE-2025-21761 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: openvswitch: use RCU protection in ovs_vport_cmd_fill_info() ovs_vport_cmd_fill_info() ca… |
CVE-2025-21760 | High | 8.1 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: ndisc: extend RCU protection in ndisc_send_skb() ndisc_send_skb() can be called without R… |
CVE-2025-21759 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: extend RCU protection in igmp6_send() igmp6_send() can be called without RTN… |
CVE-2025-21758 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: add RCU protection to mld_newpack() mld_newpack() can be called without RTNL… |
CVE-2025-21756 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: vsock: Keep the binding until socket destruction Preserve sockets bindings; this includes… |
CVE-2025-21754 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix assertion failure when splitting ordered extent after transaction abort If whi… |
CVE-2025-21753 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free when attempting to join an aborted transaction When we are tryi… |
CVE-2025-21752 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents Don't use btrfs_set_item_… |
CVE-2025-21751 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, change error flow on matcher disconnect Currently, when firmware failure o… |
CVE-2025-21750 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: Check the return value of of_property_read_string_index() Somewhen betwee… |
CVE-2025-21749 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: net: rose: lock the socket in rose_bind() syzbot reported a soft lockup in rose_loopback_… |
CVE-2025-21748 | Critical | 9.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix integer overflows on 32 bit systems On 32bit systems the addition operations i… |
CVE-2025-21747 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: drm/ast: astdp: Fix timeout for enabling video signal The ASTDP transmitter sometimes tak… |
CVE-2025-21746 | Medium | 4.7 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: Input: synaptics - fix crash when enabling pass-through port When enabling a pass-through… |
CVE-2025-21745 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: Fix class @block_class's subsystem refcount leakage blkcg_fill_root_iostats()… |
CVE-2025-21744 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix NULL pointer dereference in brcmf_txfinalize() On removal of the devi… |
CVE-2025-21743 | High | 7.1 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: usbnet: ipheth: fix possible overflow in DPE length check Originally, it was possible for… |
CVE-2025-21742 | High | 7.1 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: usbnet: ipheth: use static NDP16 location in URB Original code allowed for the start of N… |
CVE-2025-21741 | High | 7.1 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: usbnet: ipheth: fix DPE OoB read Fix an out-of-bounds DPE read, limit the number of proce… |
CVE-2025-21739 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Fix use-after free in init error and remove paths devm_blk_crypto_profil… |
CVE-2025-21738 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: ata: libata-sff: Ensure that we cannot write outside the allocated buffer reveliofuzzing… |
CVE-2025-21737 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: ceph: fix memory leak in ceph_mds_auth_match() We now free the temporary target path subs… |
CVE-2025-21736 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix possible int overflows in nilfs_fiemap() Since nilfs_bmap_lookup_contig() in… |
CVE-2025-21735 | High | 8.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: NFC: nci: Add bounds checking in nci_hci_create_pipe() The "pipe" variable is a u8 which… |
CVE-2025-21734 | High | 7.8 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: Fix copy buffer page size For non-registered buffer, fastrpc driver copies… |
CVE-2025-21733 | Medium | 5.5 | 2025-02-27 | In the Linux kernel, the following vulnerability has been resolved: tracing/osnoise: Fix resetting of tracepoints If a timerlat tracer is started with the os… |