2025 CVEs (page 406)
Page 406 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-0352 | High | 7.5 | 2025-02-20 | Rapid Response Monitoring My Security Account App utilizes an API that could be exploited by an attacker to modify request data, potentially causing the API to… |
CVE-2025-27096 | Critical | 9.8 | 2025-02-20 | WeGIA is a Web Manager for Institutions with a focus on Portuguese language. A SQL Injection vulnerability was discovered in the WeGIA application, personaliza… |
CVE-2025-26618 | | 2025-02-20 | Erlang is a programming language and runtime system for building massively scalable soft real-time systems with requirements on high availability. OTP is a set… | |
CVE-2025-27091 | High | 7.5 | 2025-02-20 | OpenH264 is a free license codec library which supports H.264 encoding and decoding. A vulnerability in the decoding functions of OpenH264 codec library could… |
CVE-2025-25973 | Medium | 6.5 | 2025-02-20 | A stored Cross Site Scripting vulnerability in the "related recommendations" feature in Ppress v.0.0.9 allows a remote attacker to execute arbitrary code via a… |
CVE-2025-25968 | Medium | 6.0 | 2025-02-20 | DDSN Interactive cm3 Acora CMS version 10.1.1 contains an improper access control vulnerability. An editor-privileged user can access sensitive information, su… |
CVE-2025-26311 | Medium | 6.5 | 2025-02-20 | Multiple memory leaks have been identified in the clip actions parsing functions (parseSWF_CLIPACTIONS and parseSWF_CLIPACTIONRECORD) in util/parser.c of libmi… |
CVE-2025-26310 | Medium | 6.5 | 2025-02-20 | Multiple memory leaks have been identified in the ABC file parsing functions (parseABC_CONSTANT_POOL and `parseABC_FILE) in util/parser.c of libming v0.4.8, wh… |
CVE-2025-26309 | Medium | 6.5 | 2025-02-20 | A memory leak has been identified in the parseSWF_DEFINESCENEANDFRAMEDATA function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial… |
CVE-2025-26308 | Medium | 6.5 | 2025-02-20 | A memory leak has been identified in the parseSWF_FILTERLIST function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial of service v… |
CVE-2025-26307 | Medium | 6.5 | 2025-02-20 | A memory leak has been identified in the parseSWF_IMPORTASSETS2 function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial of servic… |
CVE-2025-26306 | Medium | 6.5 | 2025-02-20 | A memory leak has been identified in the readSizedString function in util/read.c of libming v0.4.8, which allows attackers to cause a denial of service via a c… |
CVE-2025-26305 | High | 8.2 | 2025-02-20 | A memory leak has been identified in the parseSWF_SOUNDINFO function in util/parser.c of libming v0.4.8, which allows attackers to cause a denial of service vi… |
CVE-2025-26304 | High | 8.2 | 2025-02-20 | A memory leak has been identified in the parseSWF_EXPORTASSETS function in util/parser.c of libming v0.4.8. |
CVE-2025-0161 | High | 7.8 | 2025-02-20 | IBM Security Verify Access Appliance 10.0.0.0 through 10.0.0.9 and 11.0.0.0 could allow a local user to execute arbitrary code due to improper restrictions on… |
CVE-2025-20059 | Critical | 9.1 | 2025-02-20 | Relative Path Traversal vulnerability in Ping Identity PingAM Java Policy Agent allows Parameter Injection.This issue affects PingAM Java Policy Agent: through… |
CVE-2025-1039 | High | 7.2 | 2025-02-20 | The Lenix Elementor Leads addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a URL form field in all versions up to, and including, 1… |
CVE-2025-21106 | Medium | 5.5 | 2025-02-20 | Dell Recover Point for Virtual Machines 6.0.X contains a Weak file system permission vulnerability. A low privileged Local attacker could potentially exploit t… |
CVE-2025-21105 | Medium | 6.6 | 2025-02-20 | Dell RecoverPoint for Virtual Machines 6.0.X contains a command execution vulnerability. A Low privileged malicious user with local access could potentially ex… |
CVE-2025-1043 | Medium | 6.4 | 2025-02-20 | The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, a… |
CVE-2025-0868 | | 2025-02-20 | A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. Due to improper parsing of JSON data using eval() an unauthorized… | |
CVE-2025-1483 | Medium | 5.3 | 2025-02-20 | The LTL Freight Quotes – GlobalTranz Edition plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the e… |
CVE-2025-1328 | Medium | 6.4 | 2025-02-20 | The Typed JS: A typewriter style animation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘typespeed’ parameter in all versions up t… |
CVE-2025-0866 | Medium | 6.5 | 2025-02-20 | The Legoeso PDF Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘checkedVals’ parameter in all versions up to, and including, 1… |
CVE-2025-1064 | Medium | 6.4 | 2025-02-20 | The Login/Signup Popup ( Inline Form + Woocommerce ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's xoo_el_action shortcode… |
CVE-2025-0897 | Medium | 6.4 | 2025-02-20 | The Modal Window – create popup modal window plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'iframeBox' shortcode in all ve… |
CVE-2025-26856 | High | 7.2 | 2025-02-20 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in UD-LT2 firmware Ver.1.00.008_SE and earlier. If an a… |
CVE-2025-27218 | Medium | 5.3 | 2025-02-20 | Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization. |
CVE-2025-24947 | Medium | 5.3 | 2025-02-20 | A hash collision vulnerability (in the hash table used to manage connections) in LSQUIC (aka LiteSpeed QUIC) before 4.2.0 allows remote attackers to cause a co… |
CVE-2025-24946 | Medium | 5.3 | 2025-02-20 | The hash table used to manage connections in picoquic before b80fd3f uses a weak hash function, allowing remote attackers to cause a considerable CPU load on t… |
CVE-2025-23020 | Medium | 5.3 | 2025-02-20 | An issue was discovered in Kwik before 0.10.1. A hash collision vulnerability (in the hash table used to manage connections) allows remote attackers to cause a… |
CVE-2025-1492 | High | 7.8 | 2025-02-20 | Bundle Protocol and CBOR dissector crashes in Wireshark 4.4.0 to 4.4.3 and 4.2.0 to 4.2.10 allows denial of service via packet injection or crafted capture file |
CVE-2025-1293 | High | 8.2 | 2025-02-20 | Hermes versions up to 0.4.0 improperly validated the JWT provided when using the AWS ALB authentication mode, potentially allowing for authentication bypass. T… |
CVE-2025-1223 | Medium | 6.1 | 2025-02-20 | An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac |
CVE-2025-1222 | Medium | 6.1 | 2025-02-20 | An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac |
CVE-2025-0112 | | 2025-02-20 | A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to… | |
CVE-2025-27092 | High | 7.5 | 2025-02-19 | GHOSTS is an open source user simulation framework for cyber experimentation, simulation, training, and exercise. A path traversal vulnerability was discovered… |
CVE-2025-25947 | Medium | 5.5 | 2025-02-19 | An issue in Bento4 v1.6.0-641 allows an attacker to trigger a segmentation fault via Ap4Atom.cpp, specifically in AP4_AtomParent::RemoveChild, during the execu… |
CVE-2025-25946 | Medium | 5.5 | 2025-02-19 | An issue in Bento4 v1.6.0-641 allows an attacker to cause a memory leak via Ap4Marlin.cpp and Ap4Processor.cpp, specifically in AP4_MarlinIpmpEncryptingProcess… |
CVE-2025-25945 | Medium | 6.5 | 2025-02-19 | An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the Mp4Fragment.cpp and in AP4_DescriptorFactory::CreateDescriptorFrom… |
CVE-2025-25944 | High | 7.3 | 2025-02-19 | Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the Ap4RtpAtom.cpp, specifically in AP4_RtpAtom::AP4_… |
CVE-2025-25943 | High | 7.8 | 2025-02-19 | Buffer Overflow vulnerability in Bento4 v.1.6.0-641 allows a local attacker to execute arbitrary code via the AP4_Stz2Atom::AP4_Stz2Atom component located in A… |
CVE-2025-25942 | Medium | 6.5 | 2025-02-19 | An issue in Bento4 v1.6.0-641 allows an attacker to obtain sensitive information via the the mp4fragment tool when processing invalid files. Specifically, memo… |
CVE-2025-24989 | High | 8.2 | 2025-02-19 | An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user reg… |
CVE-2025-21355 | High | 8.6 | 2025-02-19 | Missing Authentication for Critical Function in Microsoft Bing allows an unauthorized attacker to execute code over a network |
CVE-2025-27090 | Medium | 5.3 | 2025-02-19 | Sliver is an open source cross-platform adversary emulation/red team framework, it can be used by organizations of all sizes to perform security testing. The r… |
CVE-2025-25196 | Critical | 9.8 | 2025-02-19 | OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA < v1.8.4 (Helm chart <… |
CVE-2025-0677 | Medium | 6.4 | 2025-02-19 | A flaw was found in grub2. When performing a symlink lookup, the grub's UFS module checks the inode's data size to allocate the internal buffer to read the fil… |
CVE-2025-0624 | High | 7.6 | 2025-02-19 | A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environme… |
CVE-2025-24806 | | 2025-02-19 | Authelia is an open-source authentication and authorization server providing two-factor authentication and single sign-on (SSO) for applications via a web port… | |
CVE-2025-1118 | Medium | 4.4 | 2025-02-19 | A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attac… |
CVE-2025-0893 | High | 7.8 | 2025-02-19 | Symantec Diagnostic Tool (SymDiag), prior to 3.0.79, may be susceptible to a Privilege Escalation vulnerability. |
CVE-2025-27089 | Medium | 5.4 | 2025-02-19 | Directus is a real-time API and App dashboard for managing SQL database content. In affected versions if there are two overlapping policies for the `update` ac… |
CVE-2025-24965 | | 2025-02-19 | crun is an open source OCI Container Runtime fully written in C. In affected versions A malicious container image could trick the krun handler into escaping th… | |
CVE-2025-1426 | High | 8.8 | 2025-02-19 | Heap buffer overflow in GPU in Google Chrome on Android prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted… |
CVE-2025-1006 | High | 8.8 | 2025-02-19 | Use after free in Network in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted web app. (Chr… |
CVE-2025-0999 | High | 8.8 | 2025-02-19 | Heap buffer overflow in V8 in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2025-20211 | Medium | 6.1 | 2025-02-19 | A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform could allow an unauthenticated, remote attacker to cond… |
CVE-2025-20158 | Medium | 4.4 | 2025-02-19 | A vulnerability in the debug shell of Cisco Video Phone 8875 and Cisco Desk Phone 9800 Series could allow an authenticated, local attacker to access sensitive… |
CVE-2025-20153 | Medium | 5.8 | 2025-02-19 | A vulnerability in the email filtering mechanism of Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to bypass the configured rules a… |
CVE-2025-1465 | Medium | 4.1 | 2025-02-19 | A vulnerability, which was classified as problematic, was found in lmxcms 1.41. Affected is an unknown function of the file db.inc.php of the component Mainten… |
CVE-2025-1464 | High | 7.3 | 2025-02-19 | A vulnerability, which was classified as critical, has been found in Baiyi Cloud Asset Management System up to 20250204. This issue affects some unknown proces… |
CVE-2025-0968 | Medium | 5.3 | 2025-02-19 | The ElementsKit Elementor addons plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.0 due to a mis… |
CVE-2025-0916 | High | 7.2 | 2025-02-19 | The YaySMTP and Email Logs: Amazon SES, SendGrid, Outlook, Mailgun, Brevo, Google and Any SMTP Service plugin for WordPress is vulnerable to Stored Cross-Site… |
CVE-2025-1075 | High | 7.5 | 2025-02-19 | Insertion of Sensitive Information into Log File in Checkmk GmbH's Checkmk versions <2.3.0p27, <2.2.0p40, and 2.1.0p51 (EOL) causes LDAP credentials to be writ… |
CVE-2025-1135 | High | 7.2 | 2025-02-19 | A vulnerability exists in ChurchCRM 5.13.0. and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based bli… |
CVE-2025-1134 | High | 7.2 | 2025-02-19 | A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based and time-based blin… |
CVE-2025-1133 | High | 7.2 | 2025-02-19 | A vulnerability exists in ChurchCRM 5.13.0 and prior that allows an attacker to execute arbitrary SQL queries by exploiting a boolean-based blind SQL Injection… |
CVE-2025-1132 | High | 8.8 | 2025-02-19 | A time-based blind SQL Injection vulnerability exists in the ChurchCRM 5.13.0 and prior EditEventAttendees.php within the EN_tyid parameter. The parameter is d… |
CVE-2025-1024 | Medium | 4.8 | 2025-02-19 | A vulnerability exists in ChurchCRM 5.13.0 that allows an attacker to execute arbitrary JavaScript in a victim's browser via Reflected Cross-Site Scripting (XS… |
CVE-2025-1007 | Medium | 5.3 | 2025-02-19 | In OpenVSX version v0.9.0 to v0.20.0, the /user/namespace/{namespace}/details API allows a user to edit all namespace details, even if the user is not a name… |
CVE-2025-0865 | Medium | 6.5 | 2025-02-19 | The WP Media Category Management plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.0 to 2.3.3. This is due to missing or incorrect… |
CVE-2025-0633 | | 2025-02-19 | Heap-based Buffer Overflow vulnerability in iniparser_dumpsection_ini() in iniparser allows attacker to read out of bound memory | |
CVE-2025-25054 | Medium | 6.1 | 2025-02-19 | Movable Type contains a reflected cross-site scripting vulnerability in the user information edit page. When Multi-Factor authentication plugin is enabled and… |
CVE-2025-24841 | Medium | 5.4 | 2025-02-19 | Movable Type contains a stored cross-site scripting vulnerability in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 is used as a rich t… |
CVE-2025-22888 | Medium | 5.4 | 2025-02-19 | Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor. If exploited, an arbitrary script may be ex… |
CVE-2025-1065 | Medium | 6.4 | 2025-02-19 | The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Import Data From Fil… |
CVE-2025-1441 | Medium | 6.1 | 2025-02-19 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1007. This… |
CVE-2025-22622 | Medium | 4.3 | 2025-02-19 | Age Verification for your checkout page. Verify your customer's identity 1.20.0 was found to be vulnerable. The web application dynamically generates web conte… |
CVE-2025-1448 | High | 7.3 | 2025-02-19 | A vulnerability was found in Synway SMG Gateway Management Software up to 20250204. It has been rated as critical. This issue affects some unknown processing o… |
CVE-2025-1447 | Medium | 4.3 | 2025-02-19 | A vulnerability was found in kasuganosoras Pigeon 1.0.177. It has been declared as critical. This vulnerability affects unknown code of the file /pigeon/imgpro… |
CVE-2025-27113 | Low | 2.9 | 2025-02-18 | libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a NULL pointer dereference in xmlPatMatch in pattern.c. |
CVE-2025-26624 | | 2025-02-18 | Rufus is a utility that helps format and create bootable USB flash drives. A DLL hijacking vulnerability in Rufus 4.6.2208 and earlier versions allows an attac… | |
CVE-2025-25475 | High | 7.5 | 2025-02-18 | A NULL pointer dereference in the component /libsrc/dcrleccd.cc of DCMTK v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via a crafted DICOM fi… |
CVE-2025-25474 | Medium | 6.5 | 2025-02-18 | DCMTK v3.6.9+ DEV was discovered to contain a buffer overflow via the component /dcmimgle/diinpxt.h. |
CVE-2025-25473 | Medium | 5.3 | 2025-02-18 | FFmpeg git master before commit c08d30 was discovered to contain a memory leak in the avformat_free_context function in libavutil/mem.c. |
CVE-2025-25472 | Medium | 5.3 | 2025-02-18 | A buffer overflow in DCMTK git master v3.6.9+ DEV allows attackers to cause a Denial of Service (DoS) via a crafted DCM file. |
CVE-2025-25471 | Medium | 4.3 | 2025-02-18 | FFmpeg git master before commit fd1772 was discovered to contain a NULL pointer dereference via the component libavformat/mov.c. |
CVE-2025-24928 | High | 7.8 | 2025-02-18 | libxml2 before 2.12.10 and 2.13.x before 2.13.6 has a stack-based buffer overflow in xmlSnprintfElements in valid.c. To exploit this, DTD validation must occur… |
CVE-2025-22920 | Medium | 5.3 | 2025-02-18 | A heap buffer overflow vulnerability in FFmpeg before commit 4bf784c allows attackers to trigger a memory corruption via supplying a crafted media file in avfo… |
CVE-2025-22919 | Medium | 6.5 | 2025-02-18 | A reachable assertion in FFmpeg git-master commit N-113007-g8d24a28d06 allows attackers to cause a Denial of Service (DoS) via opening a crafted AAC file. |
CVE-2025-25896 | Medium | 5.7 | 2025-02-18 | A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01 via the destination, netmask, and gateway parameters. This vulnerability allows attacke… |
CVE-2025-25895 | High | 8.0 | 2025-02-18 | An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the public_type parameter. This vulnerability allows attackers to execute arb… |
CVE-2025-25894 | High | 8.0 | 2025-02-18 | An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the samba_wg and samba_nbn parameters. This vulnerability allows attackers to… |
CVE-2025-25893 | High | 8.0 | 2025-02-18 | An OS command injection vulnerability was discovered in D-Link DSL-3782 v1.01 via the inIP, insPort, inePort, exsPort, exePort, and protocol parameters. This v… |
CVE-2025-25892 | Medium | 5.7 | 2025-02-18 | A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01 via the sstartip, sendip, dstartip, and dendip parameters. This vulnerability allows at… |
CVE-2025-25891 | Medium | 5.7 | 2025-02-18 | A buffer overflow vulnerability was discovered in D-Link DSL-3782 v1.01, triggered by the destination, netmask and gateway parameters. This vulnerability allow… |
CVE-2025-25469 | Medium | 6.5 | 2025-02-18 | FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/iamf.c. |
CVE-2025-25468 | Medium | 6.5 | 2025-02-18 | FFmpeg git-master before commit d5873b was discovered to contain a memory leak in the component libavutil/mem.c. |
CVE-2025-25467 | Critical | 9.8 | 2025-02-18 | Insufficient tracking and releasing of allocated used memory in libx264 git master allows attackers to execute arbitrary code via creating a crafted AAC file. |