2025 CVEs (page 412)
Page 412 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-21691 | Medium | 5.5 | 2025-02-10 | In the Linux kernel, the following vulnerability has been resolved: cachestat: fix page cache statistics permission checking When the 'cachestat()' system ca… |
CVE-2025-21690 | Medium | 5.5 | 2025-02-10 | In the Linux kernel, the following vulnerability has been resolved: scsi: storvsc: Ratelimit warning logs to prevent VM denial of service If there's a persis… |
CVE-2025-21689 | Medium | 5.5 | 2025-02-10 | In the Linux kernel, the following vulnerability has been resolved: USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() This patch addresses… |
CVE-2025-21688 | Medium | 4.7 | 2025-02-10 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Assign job pointer to NULL before signaling the fence In commit e4b5ccd392b9 ("d… |
CVE-2025-21687 | High | 7.8 | 2025-02-10 | In the Linux kernel, the following vulnerability has been resolved: vfio/platform: check the bounds of read/write syscalls count and offset are passed from u… |
CVE-2025-1149 | Low | 3.1 | 2025-02-10 | A vulnerability was found in GNU Binutils 2.43. It has been classified as problematic. This affects the function xstrdup of the file libiberty/xmalloc.c of the… |
CVE-2025-1193 | High | 8.1 | 2025-02-10 | Improper host validation in the certificate validation component in Devolutions Remote Desktop Manager on 2024.3.19 and earlier on Windows allows an attacker t… |
CVE-2025-1148 | Low | 3.1 | 2025-02-10 | A vulnerability was found in GNU Binutils 2.43 and classified as problematic. Affected by this issue is the function link_order_scan of the file ld/ldelfgen.c… |
CVE-2025-1147 | Low | 3.1 | 2025-02-10 | A vulnerability has been found in GNU Binutils 2.43 and classified as problematic. Affected by this vulnerability is the function __sanitizer::internal_strlen… |
CVE-2025-1175 | Medium | 6.1 | 2025-02-10 | Reflected Cross-Site Scripting (XSS) vulnerability in Kelio Visio 1, Kelio Visio X7 and Kelio Visio X4, in versions between 3.2C and 5.1K. This vulnerability c… |
CVE-2025-25247 | Medium | 6.1 | 2025-02-10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Felix Webconsole. This issue affects Apache Felix… |
CVE-2025-1099 | | 2025-02-10 | This vulnerability exists in Tapo C500 Wi-Fi camera due to hard-coded RSA private key embedded within the device firmware. An attacker with physical access cou… | |
CVE-2025-21685 | Medium | 4.7 | 2025-02-09 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: lenovo-yoga-tab2-pro-1380-fastcharger: fix serdev race The yt2_1380_fc_serd… |
CVE-2025-21684 | Medium | 5.5 | 2025-02-09 | In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: Convert gpio_lock to raw spinlock irq_chip functions may be called in raw s… |
CVE-2025-0169 | Medium | 6.4 | 2025-02-08 | The DWT - Directory & Listing WordPress Theme is vulnerable to Stored Cross-Site Scripting via shortcodes in versions up to, and including, 3.3.4 due to insuff… |
CVE-2025-0316 | Critical | 9.8 | 2025-02-08 | The WP Directorybox Manager plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.5. This is due to incorrect authent… |
CVE-2025-1117 | High | 7.3 | 2025-02-08 | A vulnerability, which was classified as critical, was found in CoinRemitter 0.0.1/0.0.2 on OpenCart. This affects an unknown part. The manipulation of the arg… |
CVE-2025-1116 | High | 7.3 | 2025-02-08 | A vulnerability, which was classified as critical, has been found in Dreamvention Live AJAX Search Free up to 1.0.6 on OpenCart. Affected by this issue is the… |
CVE-2025-1115 | Low | 3.3 | 2025-02-08 | A vulnerability classified as problematic was found in RT-Thread up to 5.1.0. Affected by this vulnerability is the function sys_device_close/sys_device_contro… |
CVE-2025-25187 | High | 7.8 | 2025-02-07 | Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is cause… |
CVE-2025-24028 | High | 7.8 | 2025-02-07 | Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into notebooks. This vulnerability is cause… |
CVE-2025-1114 | Low | 3.5 | 2025-02-07 | A vulnerability classified as problematic has been found in newbee-mall 1.0. Affected is the function save of the file /admin/categories/save of the component… |
CVE-2025-24366 | High | 7.5 | 2025-02-07 | SFTPGo is an open source, event-driven file transfer solution. SFTPGo supports execution of a defined set of commands via SSH. Besides a set of default command… |
CVE-2025-1113 | Medium | 6.3 | 2025-02-07 | A vulnerability was found in taisan tarzan-cms up to 1.0.0. It has been rated as critical. This issue affects the function upload of the file /admin#themes of… |
CVE-2025-25183 | Low | 2.6 | 2025-02-07 | vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Maliciously constructed statements can lead to hash collisions, resulting… |
CVE-2025-24980 | Medium | 5.3 | 2025-02-07 | pimcore/admin-ui-classic-bundle provides a Backend UI for Pimcore. In affected versions an error message discloses existing accounts and leads to user enumerat… |
CVE-2025-1106 | Medium | 5.4 | 2025-02-07 | A vulnerability classified as critical has been found in CmsEasy 7.7.7.9. This affects the function deletedir_action/restore_action in the library lib/admin/da… |
CVE-2025-1105 | Medium | 4.3 | 2025-02-07 | A vulnerability was found in SiberianCMS 4.20.6. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /app/sae/de… |
CVE-2025-1104 | High | 7.3 | 2025-02-07 | A vulnerability has been found in D-Link DHP-W310AV 1.04 and classified as critical. This vulnerability affects unknown code. The manipulation leads to authent… |
CVE-2025-1103 | Medium | 6.5 | 2025-02-07 | A vulnerability, which was classified as problematic, was found in D-Link DIR-823X 240126/240802. This affects the function set_wifi_blacklists of the file /go… |
CVE-2025-1108 | High | 8.6 | 2025-02-07 | Insufficient data authenticity verification vulnerability in Janto, versions prior to r12. This allows an unauthenticated attacker to modify the content of ema… |
CVE-2025-1107 | Critical | 9.9 | 2025-02-07 | Unverified password change vulnerability in Janto, versions prior to r12. This could allow an unauthenticated attacker to change another user's password withou… |
CVE-2025-25069 | Medium | 6.5 | 2025-02-07 | A Cross-Protocol Scripting vulnerability is found in Apache Kvrocks. Since Kvrocks didn't detect if "Host:" or "POST" appears in RESP requests, a valid HTTP r… |
CVE-2025-25168 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Black and White BookPress – For Book Authors book-press allows Cross-Site Scripting (XSS).This issue affects… |
CVE-2025-25167 | High | 8.2 | 2025-02-07 | Missing Authorization vulnerability in Black and White BookPress – For Book Authors book-press allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-25166 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in gabrieldarezzo InLocation inlocation allows Stored XSS.This issue affects InLocation: from n/a through <= 1… |
CVE-2025-25163 | High | 7.5 | 2025-02-07 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Zach Swetz Plugin A/B Image Optimizer images-optimizer allows P… |
CVE-2025-25160 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Mark Barnes Style Tweaker style-tweaker allows Stored XSS.This issue affects Style Tweaker: from n/a through… |
CVE-2025-25159 | High | 7.1 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in robert_kolatzek WP doodlez wpdoodlez allows Stored XSS.Th… |
CVE-2025-25156 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Stanko Metodiev Quote Comments quote-comments allows Stored XSS.This issue affects Quote Comments: from n/a… |
CVE-2025-25155 | High | 7.5 | 2025-02-07 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in efreja Music Sheet Viewer music-sheet-viewer allows Path Traver… |
CVE-2025-25154 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in scweber Custom Comment Notifications custom-comment-notifications allows Stored XSS.This issue affects Custo… |
CVE-2025-25153 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in djjmz Simple Auto Tag simple-auto-tag allows Stored XSS.This issue affects Simple Auto Tag: from n/a through… |
CVE-2025-25152 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in LukaszWiecek Smart DoFollow smart-dofollow allows Stored XSS.This issue affects Smart DoFollow: from n/a thr… |
CVE-2025-25151 | High | 8.5 | 2025-02-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stylemix uListing ulisting allows SQL Injection.This issu… |
CVE-2025-25149 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Danillo Nunes Login-box login-box allows Stored XSS.This issue affects Login-box: from n/a through <= 2.0.4. |
CVE-2025-25148 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in ElbowRobo Read More Copy Link read-more-copy-link allows Stored XSS.This issue affects Read More Copy Link… |
CVE-2025-25147 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Phillip.Gooch Auto SEO auto-seo allows Stored XSS.This issue affects Auto SEO: from n/a through <= 2.5.6. |
CVE-2025-25146 | Medium | 4.3 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in saleandro Songkick Concerts and Festivals songkick-concerts-and-festivals allows Cross Site Request Forgery… |
CVE-2025-25145 | Medium | 5.4 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in jordan.hatch Infusionsoft Analytics infusionsoft-web-tracker allows Cross Site Request Forgery.This issue af… |
CVE-2025-25144 | High | 7.1 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in theasys Theasys theasys allows Stored XSS.This issue affe… |
CVE-2025-25143 | Medium | 4.3 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in ibasit GlobalQuran globalquran allows Cross Site Request Forgery.This issue affects GlobalQuran: from n/a th… |
CVE-2025-25141 | High | 7.5 | 2025-02-07 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zankover Fami Sales Popup fami-sales-p… |
CVE-2025-25140 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Scriptonite Simple User Profile simple-user-profile allows Stored XSS.This issue affects Simple User Profile… |
CVE-2025-25139 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Cynob IT Consultancy WP Custom Post RSS Feed wp-custom-post-rss-feed allows Stored XSS.This issue affects WP… |
CVE-2025-25138 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Rishi On Page SEO + Whatsapp Chat Button ops-robots-txt allows Stored XSS.This issue affects On Page SEO + W… |
CVE-2025-25136 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shujahat21 Optimate Ads optimate-ads allows Stored XSS.Th… |
CVE-2025-25135 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Victor Barkalov Custom Links On Admin Dashboard Toolbar customize-wpadmin allows Stored XSS.This issue affec… |
CVE-2025-25128 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in orlandolac Facilita Form Tracker facilita-form-tracker allows Stored XSS.This issue affects Facilita Form Tr… |
CVE-2025-25126 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in zmseo ZMSEO zmseo allows Stored XSS.This issue affects ZMSEO: from n/a through <= 1.14.1. |
CVE-2025-25125 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in CyrilG Fyrebox Quizzes fyrebox-shortcode allows Stored XSS.This issue affects Fyrebox Quizzes: from n/a thro… |
CVE-2025-25123 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in xdark Easy Related Posts easy-related-posts allows Stored XSS.This issue affects Easy Related Posts: from n/… |
CVE-2025-25120 | Medium | 4.3 | 2025-02-07 | Missing Authorization vulnerability in Melodic Media Slide Banners slide-banners allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-25117 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Polonski Smart Countdown FX smart-countdown-fx allow… |
CVE-2025-25116 | High | 7.6 | 2025-02-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in sudipto Link to URL / Post link-to-url-post allows Blind… |
CVE-2025-25111 | Medium | 5.4 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in WP Spell Check WP Spell Check wp-spell-check allows Cross Site Request Forgery.This issue affects WP Spell C… |
CVE-2025-25110 | Medium | 5.4 | 2025-02-07 | Missing Authorization vulnerability in Metagauss Event Kikfyre kikfyre-events-calendar-tickets allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-25107 | Critical | 9.6 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in sainwp OneStore Sites onestore-sites allows Cross Site Request Forgery.This issue affects OneStore Sites: fr… |
CVE-2025-25106 | Critical | 9.6 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in FancyWP Starter Templates by FancyWP starter-templates allows Cross Site Request Forgery.This issue affects… |
CVE-2025-25105 | Medium | 5.9 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in coffeestudios Pop Up popup-seo-optimized allows Stored XS… |
CVE-2025-25104 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in mraliende URL-Preview-Box good-url-preview-box allows Cross Site Request Forgery.This issue affects URL-Prev… |
CVE-2025-25103 | Medium | 4.3 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in bnielsen Indeed API indeed-api allows Cross Site Request Forgery.This issue affects Indeed API: from n/a thr… |
CVE-2025-25101 | Critical | 9.6 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in MetricThemes Munk Sites munk-sites allows Cross Site Request Forgery.This issue affects Munk Sites: from n/a… |
CVE-2025-25098 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zack Katz Links in Captions links-in-captions allows Stor… |
CVE-2025-25097 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in kwiliarty External Video For Everybody external-video-for… |
CVE-2025-25096 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in titusbicknell RSS in Page rss-in-page allows Stored XSS.T… |
CVE-2025-25095 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reverbnationdev ReverbNation Widgets reverbnation-widgets… |
CVE-2025-25094 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Amitythemes.com Breaking News Ticker breaking-news-ticker… |
CVE-2025-25093 | Medium | 6.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in paulswarthout Child Themes Helper child-themes-helper allows Path Traversal.This issue affects Child Themes… |
CVE-2025-25091 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in zackdesign NextGen Cooliris Gallery nextgen-cooliris-gall… |
CVE-2025-25088 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in blackus3r WP Keyword Monitor wp-keyword-monitor allows Cross Site Request Forgery.This issue affects WP Keyw… |
CVE-2025-25085 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in matt_mcbrien WP SimpleWeather wp-simpleweather allows Sto… |
CVE-2025-25082 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Max Chirkov FlexIDX Home Search flexidx-home-search allow… |
CVE-2025-25081 | Medium | 4.2 | 2025-02-07 | Missing Authorization vulnerability in DeannaS Embed RSS embed-rss allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects E… |
CVE-2025-25080 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gubbigubbi Kona Gallery Block kona-instagram-feed-for-gut… |
CVE-2025-25079 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Garrett Grimm Simple Select All Text Box simple-select-al… |
CVE-2025-25078 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Andrew Norcross Google Earth Embed google-earth-tours all… |
CVE-2025-25077 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dugbug Easy Chart Builder for WordPress easy-chart-builde… |
CVE-2025-25076 | Medium | 6.5 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicholaswilson Graceful Email Obfuscation graceful-email-… |
CVE-2025-25075 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Venugopal Show notice or message on admin area show-notice-or-message-on-admin-area allows Stored XSS.This i… |
CVE-2025-25074 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in Nirmal Kumar Ram WP Social Stream wp-social-stream allows Stored XSS.This issue affects WP Social Stream: fr… |
CVE-2025-25073 | Medium | 5.9 | 2025-02-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vasilis Triantafyllou Easy WP Tiles easy-wp-tiles allows… |
CVE-2025-25072 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in thunderbax WP Admin Custom Page wp-admin-custom-page allows Stored XSS.This issue affects WP Admin Custom Pa… |
CVE-2025-25071 | High | 7.1 | 2025-02-07 | Cross-Site Request Forgery (CSRF) vulnerability in topplugins Vignette Ads vignete-ads allows Stored XSS.This issue affects Vignette Ads: from n/a through <= 0… |
CVE-2025-0304 | High | 8.8 | 2025-02-07 | in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through use afte… |
CVE-2025-0303 | High | 8.8 | 2025-02-07 | in OpenHarmony v4.1.2 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through buffer o… |
CVE-2025-0302 | Medium | 5.5 | 2025-02-07 | in OpenHarmony v4.1.2 and prior versions allow a local attacker cause DOS through integer overflow. |
CVE-2025-1077 | | 2025-02-07 | A security vulnerability has been identified in the IBL Software Engineering Visual Weather and derived products (NAMIS, Aero Weather, Satellite Weather). The… | |
CVE-2025-22880 | High | 7.8 | 2025-02-07 | Delta Electronics CNCSoft-G2 lacks proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. If a target v… |
CVE-2025-23085 | Medium | 5.3 | 2025-02-07 | A memory leak could occur when a remote peer abruptly closes the socket without sending a GOAWAY notification. Additionally, if an invalid header was detected… |