2025 CVEs (page 404)
Page 404 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-26794 | High | 7.5 | 2025-02-21 | Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. (Resolving SQL injection requires an update to 4.99.1… |
CVE-2025-1535 | High | 7.3 | 2025-02-21 | A vulnerability was found in Baiyi Cloud Asset Management System 8.142.100.161. It has been classified as critical. This affects an unknown part of the file /w… |
CVE-2025-1489 | Medium | 6.4 | 2025-02-21 | The WP-Appbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's appbox shortcode in all versions up to, and including, 4.5.4 d… |
CVE-2025-1402 | Medium | 5.3 | 2025-02-21 | The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'ajax_ticket_delete… |
CVE-2025-1471 | High | 7.8 | 2025-02-21 | In Eclipse OMR versions 0.2.0 to 0.4.0, some of the z/OS atoe print functions use a constant length buffer for string conversion. If the input format string an… |
CVE-2025-1470 | Medium | 5.5 | 2025-02-21 | In Eclipse OMR, from the initial contribution to version 0.4.0, some OMR internal port library and utilities consumers of z/OS atoe functions do not check thei… |
CVE-2025-1410 | Medium | 6.4 | 2025-02-21 | The Events Calendar Made Simple – Pie Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's piecal shortcode in all versi… |
CVE-2025-0728 | High | 7.5 | 2025-02-21 | In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of ser… |
CVE-2025-0727 | High | 7.5 | 2025-02-21 | In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause an integer underflow and a subsequent denial of ser… |
CVE-2025-0726 | High | 7.5 | 2025-02-21 | In NetX HTTP server functionality of Eclipse ThreadX NetX Duo before version 6.4.2, an attacker can cause a denial of service by specially crafted packets. T… |
CVE-2025-1407 | Medium | 6.4 | 2025-02-21 | The AMO Team Showcase plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's amoteam_skills shortcode in all versions up to, and in… |
CVE-2025-1406 | Medium | 6.4 | 2025-02-21 | The Newpost Catch plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's npc shortcode in all versions up to, and including, 1.3.19… |
CVE-2025-1001 | Medium | 5.7 | 2025-02-21 | Medixant RadiAnt DICOM Viewer is vulnerable due to failure of the update mechanism to verify the update server's certificate which could allow an attacker to a… |
CVE-2025-27100 | Medium | 6.5 | 2025-02-21 | lakeFS is an open-source tool that transforms your object storage into a Git-like repository. In affected versions an authenticated user can crash lakeFS by ex… |
CVE-2025-27088 | High | 8.2 | 2025-02-20 | oxyno-zeta/s3-proxy is an aws s3 proxy written in go. In affected versions a Reflected Cross-site Scripting (XSS) vulnerability enables attackers to create mal… |
CVE-2025-25957 | Medium | 6.1 | 2025-02-20 | Cross Site Scripting vulnerabilities in Xunruicms v.4.6.3 and before allows a remote attacker to escalate privileges via a crafted script. |
CVE-2025-25679 | High | 8.0 | 2025-02-20 | Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the index parameter in the formWifiMacFilterSet function. |
CVE-2025-25678 | Critical | 9.8 | 2025-02-20 | Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the funcpara1 parameter in the formSetCfm function. |
CVE-2025-25676 | Critical | 9.8 | 2025-02-20 | Tenda i12 V1.0.0.10(3805) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDset function. |
CVE-2025-25675 | Critical | 9.8 | 2025-02-20 | Tenda AC10 V1.0 V15.03.06.23 has a command injection vulnerablility located in the formexeCommand function. The str variable receives the cmdinput parameter fr… |
CVE-2025-25674 | Critical | 9.8 | 2025-02-20 | Tenda AC10 V1.0 V15.03.06.23 is vulnerable to Buffer Overflow in form_fast_setting_wifi_set via the parameter ssid. |
CVE-2025-25668 | Critical | 9.8 | 2025-02-20 | Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the sub_47D878 function. |
CVE-2025-25667 | Critical | 9.8 | 2025-02-20 | Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the urls parameter in the function get_parentControl_list_Info. |
CVE-2025-25664 | Critical | 9.8 | 2025-02-20 | Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the shareSpeed parameter in the sub_49E098 function. |
CVE-2025-25663 | Critical | 9.8 | 2025-02-20 | A vulnerability was found in Tenda AC8V4 V16.03.34.06. Affected is the function SUB_0046AC38 of the file /goform/WifiExtraSet. The manipulation of the argument… |
CVE-2025-25662 | Critical | 9.8 | 2025-02-20 | Tenda O4 V3.0 V1.0.0.10(2936) is vulnerable to Buffer Overflow in the function SafeSetMacFilter of the file /goform/setMacFilterList via the argument remark/ty… |
CVE-2025-22973 | High | 7.5 | 2025-02-20 | An issue in QiboSoft QiboCMS X1.0 allows a remote attacker to obtain sensitive information via the http_curl() function in the '/application/common. php' file… |
CVE-2025-25960 | Medium | 6.1 | 2025-02-20 | Cross Site Scripting vulnerability in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via the menu interface of the member center of the backg… |
CVE-2025-25958 | Medium | 5.4 | 2025-02-20 | Cross Site Scripting vulnerabilities in phpcmsv9 v.9.6.3 allows a remote attacker to escalate privileges via a crafted script. |
CVE-2025-27098 | Medium | 5.8 | 2025-02-20 | GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST… |
CVE-2025-27097 | High | 7.5 | 2025-02-20 | GraphQL Mesh is a GraphQL Federation framework and gateway for both GraphQL Federation and non-GraphQL Federation subgraphs, non-GraphQL services, such as REST… |
CVE-2025-25299 | | 2025-02-20 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. During a recent internal audit, a Cross-Site Scripting (XSS) vulnerability was dis… | |
CVE-2025-24893 | Critical | 9.8 | 2025-02-20 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any guest can perform arbitrary remote code execution… |
CVE-2025-1265 | Critical | 9.9 | 2025-02-20 | An OS command injection vulnerability exists in Vinci Protocol Analyzer that could allow an attacker to escalate privileges and perform code execution on affec… |
CVE-2025-0352 | High | 7.5 | 2025-02-20 | Rapid Response Monitoring My Security Account App utilizes an API that could be exploited by an attacker to modify request data, potentially causing the API to… |
CVE-2025-27096 | Critical | 9.8 | 2025-02-20 | WeGIA is a Web Manager for Institutions with a focus on Portuguese language. A SQL Injection vulnerability was discovered in the WeGIA application, personaliza… |
CVE-2025-26618 | | 2025-02-20 | Erlang is a programming language and runtime system for building massively scalable soft real-time systems with requirements on high availability. OTP is a set… | |
CVE-2025-27091 | High | 7.5 | 2025-02-20 | OpenH264 is a free license codec library which supports H.264 encoding and decoding. A vulnerability in the decoding functions of OpenH264 codec library could… |
CVE-2025-25973 | Medium | 6.5 | 2025-02-20 | A stored Cross Site Scripting vulnerability in the "related recommendations" feature in Ppress v.0.0.9 allows a remote attacker to execute arbitrary code via a… |
CVE-2025-25968 | Medium | 6.0 | 2025-02-20 | DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive information, su… |
CVE-2025-26311 | Medium | 6.5 | 2025-02-20 | Multiple memory leaks have been identified in the clip actions parsing functions (parseSWF_CLIPACTIONS and parseSWF_CLIPACTIONRECORD) in util/parser.c of libmi… |
CVE-2025-26310 | Medium | 6.5 | 2025-02-20 | Multiple memory leaks have been identified in the ABC file parsing functions (parseABC_CONSTANT_POOL and `parseABC_FILE) in util/parser.c of libming v0.4.8, wh… |
CVE-2025-26309 | Medium | 6.5 | 2025-02-20 | A memory leak has been identified in the parseSWF_DEFINESCENEANDFRAMEDATA function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial… |
CVE-2025-26308 | Medium | 6.5 | 2025-02-20 | A memory leak has been identified in the parseSWF_FILTERLIST function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial of service v… |
CVE-2025-26307 | Medium | 6.5 | 2025-02-20 | A memory leak has been identified in the parseSWF_IMPORTASSETS2 function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial of servic… |
CVE-2025-26306 | Medium | 6.5 | 2025-02-20 | A memory leak has been identified in the readSizedString function in util/read.c of libming v0.4.8, which allows attackers to cause a denial of service via a c… |
CVE-2025-26305 | High | 8.2 | 2025-02-20 | A memory leak has been identified in the parseSWF_SOUNDINFO function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial of service vi… |
CVE-2025-26304 | High | 8.2 | 2025-02-20 | A memory leak has been identified in the parseSWF_EXPORTASSETS function in util/parser.c of libming v0.4.8. |
CVE-2025-0161 | High | 7.8 | 2025-02-20 | IBM Security Verify Access Appliance 10.0.0.0 through 10.0.0.9 and 11.0.0.0 could allow a local user to execute arbitrary code due to improper restrictions on… |
CVE-2025-20059 | Critical | 9.1 | 2025-02-20 | Relative Path Traversal vulnerability in Ping Identity PingAM Java Policy Agent allows Parameter Injection.This issue affects PingAM Java Policy Agent: through… |
CVE-2025-1039 | High | 7.2 | 2025-02-20 | The Lenix Elementor Leads addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a URL form field in all versions up to, and including, 1… |
CVE-2025-21106 | Medium | 5.5 | 2025-02-20 | Dell Recover Point for Virtual Machines 6.0.X contains a Weak file system permission vulnerability. A low privileged Local attacker could potentially exploit t… |
CVE-2025-21105 | Medium | 6.6 | 2025-02-20 | Dell RecoverPoint for Virtual Machines 6.0.X contains a command execution vulnerability. A Low privileged malicious user with local access could potentially ex… |
CVE-2025-1043 | Medium | 6.4 | 2025-02-20 | The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, a… |
CVE-2025-0868 | | 2025-02-20 | A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized… | |
CVE-2025-1483 | Medium | 5.3 | 2025-02-20 | The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the e… |
CVE-2025-1328 | Medium | 6.4 | 2025-02-20 | The Typed JS: A typewriter style animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘typespeed’ parameter in all versions up t… |
CVE-2025-0866 | Medium | 6.5 | 2025-02-20 | The Legoeso PDF Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘checkedVals’ parameter in all versions up to, and including, 1… |
CVE-2025-1064 | Medium | 6.4 | 2025-02-20 | The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xoo_el_action shortcode… |
CVE-2025-0897 | Medium | 6.4 | 2025-02-20 | The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframeBox' shortcode in all ve… |
CVE-2025-26856 | High | 7.2 | 2025-02-20 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If an a… |
CVE-2025-27218 | Medium | 5.3 | 2025-02-20 | Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization. |
CVE-2025-24947 | Medium | 5.3 | 2025-02-20 | A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attackers to cause a co… |
CVE-2025-24946 | Medium | 5.3 | 2025-02-20 | The hash table used to manage connections in picoquic before b80fd3f uses a weak hash function, allowing remote attackers to cause a considerable CPU load on t… |
CVE-2025-23020 | Medium | 5.3 | 2025-02-20 | An issue was discovered in Kwik before 0.10.1. A hash collision vulnerability (in the hash table used to manage connections) allows remote attackers to cause a… |
CVE-2025-1492 | High | 7.8 | 2025-02-20 | Bundle Protocol and CBOR dissector crashes in Wireshark 4.4.0 to 4.4.3 and 4.2.0 to 4.2.10 allows denial of service via packet injection or crafted capture file |
CVE-2025-1293 | High | 8.2 | 2025-02-20 | Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. T… |
CVE-2025-1223 | Medium | 6.1 | 2025-02-20 | An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac |
CVE-2025-1222 | Medium | 6.1 | 2025-02-20 | An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac |
CVE-2025-0112 | | 2025-02-20 | A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to… | |
CVE-2025-27092 | High | 7.5 | 2025-02-19 | GHOSTS is an open source user simulation framework for cyber experimentation, simulation, training, and exercise. A path traversal vulnerability was discovered… |
CVE-2025-25947 | Medium | 5.5 | 2025-02-19 | An issue in Bento4 v1.6.0-641 allows an attacker to trigger a segmentation fault via Ap4Atom.cpp, specifically in AP4_AtomParent::RemoveChild, during the execu… |
CVE-2025-25946 | Medium | 5.5 | 2025-02-19 | An issue in Bento4 v1.6.0-641 allows an attacker to cause a memory leak via Ap4Marlin.cpp and Ap4Processor.cpp, specifically in AP4_MarlinIpmpEncryptingProcess… |
CVE-2025-25945 | Medium | 6.5 | 2025-02-19 | An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the Mp4Fragment.cpp and in AP4_DescriptorFactory::CreateDescriptorFrom… |
CVE-2025-25944 | High | 7.3 | 2025-02-19 | Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the Ap4RtpAtom.cpp, specifically in AP4_RtpAtom::AP4_… |
CVE-2025-25943 | High | 7.8 | 2025-02-19 | Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the AP4_Stz2Atom::AP4_Stz2Atom component located in A… |
CVE-2025-25942 | Medium | 6.5 | 2025-02-19 | An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the mp4fragment tool when processing invalid files. Specifically, memo… |
CVE-2025-24989 | High | 8.2 | 2025-02-19 | An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user reg… |
CVE-2025-21355 | High | 8.6 | 2025-02-19 | Missing Authentication for Critical Function in Microsoft Bing allows an unauthorized attacker to execute code over a network |
CVE-2025-27090 | Medium | 5.3 | 2025-02-19 | Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. The r… |
CVE-2025-25196 | Critical | 9.8 | 2025-02-19 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA < v1.8.4 (Helm chart <… |
CVE-2025-0677 | Medium | 6.4 | 2025-02-19 | A flaw was found in grub2. When performing a symlink lookup, the grub's UFS module checks the inode's data size to allocate the internal buffer to read the fil… |
CVE-2025-0624 | High | 7.6 | 2025-02-19 | A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environme… |
CVE-2025-24806 | | 2025-02-19 | Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web port… | |
CVE-2025-1118 | Medium | 4.4 | 2025-02-19 | A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attac… |
CVE-2025-0893 | High | 7.8 | 2025-02-19 | Symantec Diagnostic Tool (SymDiag), prior to 3.0.79, may be susceptible to a Privilege Escalation vulnerability. |
CVE-2025-27089 | Medium | 5.4 | 2025-02-19 | Directus is a real-time API and App dashboard for managing SQL database content. In affected versions if there are two overlapping policies for the `update` ac… |
CVE-2025-24965 | | 2025-02-19 | crun is an open source OCI Container Runtime fully written in C. In affected versions A malicious container image could trick the krun handler into escaping th… | |
CVE-2025-1426 | High | 8.8 | 2025-02-19 | Heap buffer overflow in GPU in Google Chrome on Android prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2025-1006 | High | 8.8 | 2025-02-19 | Use after free in Network in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted web app. (Chr… |
CVE-2025-0999 | High | 8.8 | 2025-02-19 | Heap buffer overflow in V8 in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2025-20211 | Medium | 6.1 | 2025-02-19 | A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform could allow an unauthenticated, remote attacker to cond… |
CVE-2025-20158 | Medium | 4.4 | 2025-02-19 | A vulnerability in the debug shell of Cisco Video Phone 8875 and Cisco Desk Phone 9800 Series could allow an authenticated, local attacker to access sensitive… |
CVE-2025-20153 | Medium | 5.8 | 2025-02-19 | A vulnerability in the email filtering mechanism of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to bypass the configured rules a… |
CVE-2025-1465 | Medium | 4.1 | 2025-02-19 | A vulnerability, which was classified as problematic, was found in lmxcms 1.41. Affected is an unknown function of the file db.inc.php of the component Mainten… |
CVE-2025-1464 | High | 7.3 | 2025-02-19 | A vulnerability, which was classified as critical, has been found in Baiyi Cloud Asset Management System up to 20250204. This issue affects some unknown proces… |
CVE-2025-0968 | Medium | 5.3 | 2025-02-19 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.0 due to a mis… |
CVE-2025-0916 | High | 7.2 | 2025-02-19 | The YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service plugin for WordPress is vulnerable to Stored Cross-Site… |
CVE-2025-1075 | High | 7.5 | 2025-02-19 | Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p27, <2.2.0p40, and 2.1.0p51 (EOL) causes LDAP credentials to be writ… |
CVE-2025-1135 | High | 7.2 | 2025-02-19 | A vulnerability exists in ChurchCRM 5.13.0. and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based bli… |