2025 CVEs (page 41)
Page 41 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-71107 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: f2fs: ensure node page reads complete before f2fs_put_super() finishes Xfstests generic/3… |
CVE-2025-71106 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: fs: PM: Fix reverse check in filesystems_freeze_callback() The freeze_all_ptr check in fi… |
CVE-2025-71105 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: f2fs: use global inline_xattr_slab instead of per-sb slab cache As Hong Yun reported in m… |
CVE-2025-71104 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer When advan… |
CVE-2025-71103 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: drm/msm: adreno: fix deferencing ifpc_reglist when not declared On plaforms with an a7xx… |
CVE-2025-71102 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: scs: fix a wrong parameter in __scs_magic __scs_magic() needs a 'void *' variable, but a… |
CVE-2025-56226 | Medium | 5.3 | 2026-01-14 | Libsndfile <=1.2.2 contains a memory leak vulnerability in the mpeg_l3_encoder_init() function within the mpeg_l3_encode.c file. |
CVE-2025-14317 | | 2026-01-14 | In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a `loyaltyGuestId` parameter. Se… | |
CVE-2025-13175 | | 2026-01-14 | Y Soft SafeQ 6 renders the Workflow Connector password field in a way that allows an administrator with UI access to reveal the value using browser developer/i… | |
CVE-2025-67859 | | 2026-01-14 | A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power profile in use as well as the daemon’s log settings.This iss… | |
CVE-2025-66169 | Medium | 5.3 | 2026-01-14 | Cypher Injection vulnerability in Apache Camel camel-neo4j component. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, f… |
CVE-2025-66005 | | 2026-01-14 | Lack of authorization of the InputManager D-Bus interface in InputPlumber versions before v0.63.0 can lead to local Denial-of-Service, information leak or even… | |
CVE-2025-14338 | | 2026-01-14 | Polkit authentication dis isabled by default and a race condition in the Polkit authorization check in versions before v0.69.0 can lead to the same issues as i… | |
CVE-2025-0647 | High | 7.9 | 2026-01-14 | In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to the PE, either by the… |
CVE-2025-68492 | Medium | 4.2 | 2026-01-14 | Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be… |
CVE-2025-15513 | Medium | 5.3 | 2026-01-14 | The Float Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to improper error handling in the verifyFloatResponse() f… |
CVE-2025-15512 | Medium | 5.3 | 2026-01-14 | The Aplazo Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the check_success_respo… |
CVE-2025-15475 | Medium | 5.3 | 2026-01-14 | The PayHere Payment Gateway Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improper validation logic… |
CVE-2025-15376 | Medium | 4.3 | 2026-01-14 | The Stopwords for comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing n… |
CVE-2025-14846 | Medium | 4.3 | 2026-01-14 | The SocialChamp with WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.5. This is due to mis… |
CVE-2025-14770 | High | 7.5 | 2026-01-14 | The Shipping Rate By Cities plugin for WordPress is vulnerable to SQL Injection via the 'city' parameter in all versions up to, and including, 2.0.0 due to ins… |
CVE-2025-14173 | Medium | 5.3 | 2026-01-14 | The Perfit WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.1. This is due to missing authoriz… |
CVE-2025-15486 | Medium | 4.4 | 2026-01-14 | The Kunze Law plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's shortcode in all versions up to, and including, 2.1 due to the plu… |
CVE-2025-15378 | High | 7.2 | 2026-01-14 | The AJS Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note_list_class' and 'popup_display_effect_in' parameters in all v… |
CVE-2025-15377 | Medium | 4.3 | 2026-01-14 | The Sosh Share Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing non… |
CVE-2025-15283 | High | 7.2 | 2026-01-14 | The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name_directory_name' and 'name_directory_description' parameters… |
CVE-2025-15266 | High | 7.2 | 2026-01-14 | The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chat m… |
CVE-2025-15021 | Medium | 4.4 | 2026-01-14 | The Gotham Block Extra Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5.0 d… |
CVE-2025-15020 | Medium | 6.5 | 2026-01-14 | The Gotham Block Extra Light plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.5.0 via the 'ghostban' shortcod… |
CVE-2025-14880 | Medium | 5.3 | 2026-01-14 | The Netcash WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle… |
CVE-2025-14854 | Medium | 5.4 | 2026-01-14 | The WP-CRM System plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on the wpcrm_get_email_recipients and wpcrm_system… |
CVE-2025-14725 | Medium | 4.4 | 2026-01-14 | The Internal Link Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0 due to… |
CVE-2025-14615 | High | 7.1 | 2026-01-14 | The DASHBOARD BUILDER – WordPress plugin for Charts and Graphs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and incl… |
CVE-2025-14613 | High | 7.2 | 2026-01-14 | The GetContentFromURL plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0. This is due to the plugin us… |
CVE-2025-14502 | Critical | 9.8 | 2026-01-14 | The News and Blog Designer Bundle plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.1 via the template paramet… |
CVE-2025-14482 | Medium | 4.3 | 2026-01-14 | The Crush.pics Image Optimizer - Image Compression and Optimization plugin for WordPress is vulnerable to unauthorized modification of data due to missing capa… |
CVE-2025-14464 | Medium | 5.3 | 2026-01-14 | The PDF Resume Parser plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0. This is due to the plugin… |
CVE-2025-14389 | Medium | 4.3 | 2026-01-14 | The WPBlogSyn plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce… |
CVE-2025-14379 | Medium | 4.4 | 2026-01-14 | The Testimonials Creator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version 1.6 due to insufficient input sanitiza… |
CVE-2025-14301 | Critical | 9.8 | 2026-01-14 | The Integration Opvius AI for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.0. This is due to the… |
CVE-2025-13627 | Medium | 4.4 | 2026-01-14 | The Makesweat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'makesweat_clubid' setting in all versions up to, and including, 0.1 du… |
CVE-2025-12178 | Medium | 6.4 | 2026-01-14 | The SpiceForms Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'spiceforms' shortcode in all versions up to, and includi… |
CVE-2025-68970 | Medium | 6.1 | 2026-01-14 | Permission verification bypass vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect service confidential… |
CVE-2025-68969 | Medium | 6.8 | 2026-01-14 | Multi-thread race condition vulnerability in the thermal management module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-68968 | High | 7.8 | 2026-01-14 | Double free vulnerability in the multi-mode input module. Impact: Successful exploitation of this vulnerability may affect the input function. |
CVE-2025-68967 | Medium | 5.7 | 2026-01-14 | Vulnerability of improper permission control in the print module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-68966 | Medium | 5.1 | 2026-01-14 | Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-68965 | Medium | 4.7 | 2026-01-14 | Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-68964 | Medium | 6.2 | 2026-01-14 | Data verification vulnerability in the HiView module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-68963 | Medium | 5.7 | 2026-01-14 | Man-in-the-middle attack vulnerability in the Clone module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-68962 | Medium | 5.1 | 2026-01-14 | Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-68961 | Medium | 5.1 | 2026-01-14 | Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-68960 | High | 8.4 | 2026-01-14 | Multi-thread race condition vulnerability in the video framework module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-68959 | Medium | 6.2 | 2026-01-14 | Permission verification bypass vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect service confidential… |
CVE-2025-68958 | High | 8.0 | 2026-01-14 | Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-68957 | High | 8.4 | 2026-01-14 | Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-68956 | High | 8.0 | 2026-01-14 | Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-68955 | High | 8.0 | 2026-01-14 | Multi-thread race condition vulnerability in the card framework module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-12053 | High | 7.8 | 2026-01-14 | The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a… |
CVE-2025-12052 | High | 7.8 | 2026-01-14 | The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a… |
CVE-2025-12051 | High | 7.8 | 2026-01-14 | The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a… |
CVE-2025-12050 | High | 7.8 | 2026-01-14 | The drivers in the tool packages use RTL_QUERY_REGISTRY_DIRECT flag to read a registry value to which an untrusted user-mode application may be able to cause a… |
CVE-2025-68947 | Medium | 4.7 | 2026-01-13 | NSecsoft 'NSecKrnl' is a Windows driver that allows a local, authenticated attacker to terminate processes owned by other users, including SYSTEM and Protected… |
CVE-2025-68658 | Medium | 4.3 | 2026-01-13 | Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. opensourcepos 3.4.0 and 3.4.1 ha… |
CVE-2025-37186 | High | 7.8 | 2026-01-13 | A local privilege-escalation vulnerability has been discovered in the HPE Aruba Networking Virtual Intranet Access (VIA) client. Successful exploitation of thi… |
CVE-2025-15056 | Medium | 6.1 | 2026-01-13 | A lack of data validation vulnerability in the HTML export feature in Quill in allows Cross-Site Scripting (XSS). This issue affects Quill: 2.0.3. |
CVE-2025-68931 | High | 7.5 | 2026-01-13 | Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, AES/CBC/PKCS5Padding lacks authentication, making it vulner… |
CVE-2025-68925 | Medium | 5.3 | 2026-01-13 | Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the code doesn't validate that the JWT header specifies "al… |
CVE-2025-68704 | High | 7.5 | 2026-01-13 | Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses java.util.Random() which is not cryptographical… |
CVE-2025-68703 | High | 7.5 | 2026-01-13 | Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sum(passphrase). Two encrypt… |
CVE-2025-68702 | High | 7.5 | 2026-01-13 | Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses padLeft(32, '0') when it should use padLeft(64… |
CVE-2025-68701 | High | 7.5 | 2026-01-13 | Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses deterministic AES IV derivation from a passphra… |
CVE-2025-68698 | High | 7.5 | 2026-01-13 | Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, Jervis uses PKCS1Encoding which is vulnerable to Bleichenba… |
CVE-2025-37179 | Medium | 5.3 | 2026-01-13 | Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation… |
CVE-2025-37178 | Medium | 5.3 | 2026-01-13 | Multiple out-of-bounds read vulnerabilities were identified in a system component responsible for handling certain data buffers. Due to insufficient validation… |
CVE-2025-37177 | Medium | 6.5 | 2026-01-13 | An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating syst… |
CVE-2025-37176 | Medium | 6.5 | 2026-01-13 | A command injection vulnerability in AOS-8 allows an authenticated privileged user to alter a package header to inject shell commands, potentially affecting th… |
CVE-2025-37175 | High | 7.2 | 2026-01-13 | Arbitrary file upload vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems. Succe… |
CVE-2025-37174 | High | 7.2 | 2026-01-13 | Authenticated arbitrary file write vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating s… |
CVE-2025-37173 | High | 7.2 | 2026-01-13 | An improper input handling vulnerability exists in the web-based management interface of mobility conductors running either AOS-10 or AOS-8 operating systems… |
CVE-2025-37172 | High | 7.2 | 2026-01-13 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful e… |
CVE-2025-37171 | High | 7.2 | 2026-01-13 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful e… |
CVE-2025-37170 | High | 7.2 | 2026-01-13 | Authenticated command injection vulnerabilities exist in the web-based management interface of mobility conductors running AOS-8 operating system. Successful e… |
CVE-2025-37169 | High | 7.2 | 2026-01-13 | A stack overflow vulnerability exists in the AOS-10 web-based management interface of a Mobility Gateway. Successful exploitation could allow an authenticated… |
CVE-2025-37168 | High | 8.2 | 2026-01-13 | Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. Successful exploitation… |
CVE-2025-68949 | Medium | 5.3 | 2026-01-13 | n8n is an open source workflow automation platform. From 1.36.0 to before 2.2.0, the Webhook node’s IP whitelist validation performed partial string matching i… |
CVE-2025-68271 | Critical | 10.0 | 2026-01-13 | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.0 to 6.10.1, OpenC3 COSMOS con… |
CVE-2025-37166 | High | 7.5 | 2026-01-13 | A vulnerability affecting HPE Networking Instant On Access Points has been identified where a device processing a specially crafted packet could enter a non-re… |
CVE-2025-37165 | High | 7.5 | 2026-01-13 | A vulnerability in the router mode configuration of HPE Instant On Access Points exposed certain network configuration details to unintended interfaces. A mali… |
CVE-2025-10865 | High | 7.8 | 2026-01-13 | Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of reference counting to cause a potential use… |
CVE-2025-8090 | Medium | 6.2 | 2026-01-13 | Null pointer dereference in the MsgRegisterEvent() system call could allow an attacker with local access and code execution abilities to crash the QNX Neutrino… |
CVE-2025-68707 | High | 8.8 | 2026-01-13 | An authentication bypass vulnerability in the Tongyu AX1800 Wi-Fi 6 Router with firmware 1.0.0 allows unauthenticated network-adjacent attackers to perform arb… |
CVE-2025-67685 | Low | 3.8 | 2026-01-13 | A Server-Side Request Forgery (SSRF) vulnerability [CWE-918] vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox 4.4 all versions, FortiSa… |
CVE-2025-65784 | Medium | 6.5 | 2026-01-13 | Insecure permissions in Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows authenticated attackers with low-level privileges to access other users' inf… |
CVE-2025-64155 | Critical | 9.8 | 2026-01-13 | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 throug… |
CVE-2025-62182 | | 2026-01-13 | Pega Customer Service Framework versions 8.7.0 through 25.1.0 are affected by a Unrestricted file upload vulnerability, where a privileged user could potential… | |
CVE-2025-59922 | High | 7.2 | 2026-01-13 | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet FortiClientEMS 7.4.3 t… |
CVE-2025-58693 | Medium | 6.5 | 2026-01-13 | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7.0.0 th… |
CVE-2025-58411 | High | 8.8 | 2026-01-13 | Software installed and run as a non-privileged user may conduct improper GPU system calls to cause mismanagement of resources reference counting creating a pot… |
CVE-2025-58409 | Low | 3.5 | 2026-01-13 | Software installed and run as a non-privileged user may conduct improper GPU system calls to subvert GPU HW to write to arbitrary physical memory pages. Under… |