2025 CVEs (page 415)
Page 415 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-22866 | Medium | 4.0 | 2025-02-06 | Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on… |
CVE-2025-1078 | Medium | 5.3 | 2025-02-06 | A vulnerability has been found in AppHouseKitchen AlDente Charge Limiter up to 1.29 on macOS and classified as critical. This vulnerability affects the functio… |
CVE-2025-0994 | High | 8.8 | 2025-02-06 | Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10 are vulnerable to a deserialization vulnerability. This… |
CVE-2025-1076 | Medium | 4.8 | 2025-02-06 | A Stored Cross-Site Scripting (Stored XSS) vulnerability has been found in the Holded application. This vulnerability could allow an attacker to store a JavaSc… |
CVE-2025-1074 | Medium | 4.3 | 2025-02-06 | A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. Affected is the function logout of the file /en/?mylogout of the compo… |
CVE-2025-0982 | Critical | 10.0 | 2025-02-06 | Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScr… |
CVE-2025-0859 | Medium | 6.5 | 2025-02-06 | The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including… |
CVE-2025-24845 | Medium | 5.5 | 2025-02-06 | Improper neutralization of argument delimiters in a command ('Argument Injection') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If a… |
CVE-2025-24483 | Medium | 5.5 | 2025-02-06 | NULL pointer dereference vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker provides specially crafted data to the… |
CVE-2025-23236 | High | 8.8 | 2025-02-06 | Buffer overflow vulnerability exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker performs a specific operation, SYSTEM privilege… |
CVE-2025-22894 | High | 8.8 | 2025-02-06 | Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a specially craf… |
CVE-2025-20094 | High | 8.8 | 2025-02-06 | Unprotected Windows messaging channel ('Shatter') issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker sends a specially craf… |
CVE-2025-22890 | High | 8.8 | 2025-02-06 | Execution with unnecessary privileges issue exists in Defense Platform Home Edition Ver.3.9.51.x and earlier. If an attacker performs a specific operation, SYS… |
CVE-2025-0522 | Medium | 4.7 | 2025-02-06 | The LikeBot WordPress plugin through 0.85 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attacker… |
CVE-2025-0799 | Medium | 6.5 | 2025-02-06 | IBM App Connect enterprise 12.0.1.0 through 12.0.12.10 and 13.0.1.0 through 13.0.2.1 could allow an authenticated user to write to an arbitrary file on the sys… |
CVE-2025-1066 | Critical | 9.8 | 2025-02-06 | OpenPLC_V3 contains an arbitrary file upload vulnerability, which could be leveraged for malvertising or phishing campaigns. |
CVE-2025-24805 | Medium | 5.5 | 2025-02-05 | Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment fr… |
CVE-2025-24804 | Medium | 4.3 | 2025-02-05 | Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment fr… |
CVE-2025-24803 | Medium | 5.4 | 2025-02-05 | Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment fr… |
CVE-2025-24372 | High | 7.3 | 2025-02-05 | CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Using a specially crafted file, a user could potentially upload a… |
CVE-2025-24497 | High | 7.5 | 2025-02-05 | When URL categorization is configured on a virtual server, undisclosed requests can cause TMM to terminate. Note: Software versions which have reached End of… |
CVE-2025-24326 | High | 7.5 | 2025-02-05 | When BIG-IP Advanced WAF/ASM Behavioral DoS (BADoS) TLS Signatures feature is configured, undisclosed traffic can case an increase in memory resource utilizati… |
CVE-2025-24320 | High | 8.0 | 2025-02-05 | A stored cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript i… |
CVE-2025-24319 | Medium | 6.5 | 2025-02-05 | When BIG-IP Next Central Manager is running, undisclosed requests to the BIG-IP Next Central Manager API can cause the BIG-IP Next Central Manager Node's Kuber… |
CVE-2025-24312 | High | 7.5 | 2025-02-05 | When BIG-IP AFM is provisioned with IPS module enabled and protocol inspection profile is configured on a virtual server or firewall rule or policy, undisclose… |
CVE-2025-23419 | Medium | 4.3 | 2025-02-05 | When multiple server blocks are configured to share the same IP address and port, an attacker can use session resumption to bypass client certificate authentic… |
CVE-2025-23415 | Low | 3.1 | 2025-02-05 | An insufficient verification of data authenticity vulnerability exists in BIG-IP APM Access Policy endpoint inspection that may allow an attacker to bypass end… |
CVE-2025-23413 | Medium | 4.4 | 2025-02-05 | When users log in through the webUI or API using local authentication, BIG-IP Next Central Manager may log sensitive information in the pgaudit log files. N… |
CVE-2025-23412 | High | 7.5 | 2025-02-05 | When BIG-IP APM Access Profile is configured on a virtual server, undisclosed request can cause TMM to terminate. Note: Software versions which have rea… |
CVE-2025-23239 | High | 8.7 | 2025-02-05 | When running in Appliance mode, and logged into a highly-privileged role, an authenticated remote command injection vulnerability exists in an undisclosed iCon… |
CVE-2025-22891 | High | 7.5 | 2025-02-05 | When BIG-IP PEM Control Plane listener Virtual Server is configured with Diameter Endpoint profile, undisclosed traffic can cause the Virtual Server to stop pr… |
CVE-2025-22846 | High | 7.5 | 2025-02-05 | When SIP Session and Router ALG profiles are configured on a Message Routing type virtual server, undisclosed traffic can cause the Traffic Management Microker… |
CVE-2025-21091 | High | 7.5 | 2025-02-05 | When SNMP v1 or v2c are disabled on the BIG-IP, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which h… |
CVE-2025-21087 | High | 7.5 | 2025-02-05 | When Client or Server SSL profiles are configured on a Virtual Server, or DNSSEC signing operations are in use, undisclosed traffic can cause an increase in me… |
CVE-2025-20058 | High | 7.5 | 2025-02-05 | When a BIG-IP message routing profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Softwa… |
CVE-2025-20045 | High | 7.5 | 2025-02-05 | When SIP session Application Level Gateway mode (ALG) profile with Passthru Mode enabled and SIP router ALG profile are configured on a Message Routing type vi… |
CVE-2025-20029 | High | 8.8 | 2025-02-05 | Command injection vulnerability exists in iControl REST and BIG-IP TMOS Shell (tmsh) save command, which may allow an authenticated attacker to execute arbitra… |
CVE-2025-20207 | Medium | 4.3 | 2025-02-05 | A vulnerability in Simple Network Management Protocol (SNMP) polling for Cisco Secure Email and Web Manager, Cisco Secure Email Gateway, and Cisco Secure Web A… |
CVE-2025-20205 | Medium | 4.8 | 2025-02-05 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) guest portals could allow an authenticated, remote attac… |
CVE-2025-20204 | Medium | 4.8 | 2025-02-05 | Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine (ISE) guest portals could allow an authenticated, remote attac… |
CVE-2025-20185 | Low | 3.4 | 2025-02-05 | A vulnerability in the implementation of the remote access functionality of Cisco AsyncOS Software for Cisco Secure Email and Web Manager, Cisco Secure Email G… |
CVE-2025-20184 | Medium | 6.5 | 2025-02-05 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Web Appliance could allow an au… |
CVE-2025-20183 | Medium | 5.8 | 2025-02-05 | A vulnerability in a policy-based Cisco Application Visibility and Control (AVC) implementation of Cisco AsyncOS Software for Cisco Secure Web Appliance could… |
CVE-2025-20180 | Medium | 4.8 | 2025-02-05 | A vulnerability in the web-based management interface of Cisco AsyncOS Software for Cisco Secure Email and Web Manager and Secure Email Gateway could allow an… |
CVE-2025-20179 | Medium | 6.1 | 2025-02-05 | A vulnerability in the web-based management interface of Cisco Expressway Series could allow an unauthenticated, remote attacker to conduct a cross-site script… |
CVE-2025-20176 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on… |
CVE-2025-20175 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on… |
CVE-2025-20174 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on… |
CVE-2025-20173 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on… |
CVE-2025-20172 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an authenticated, remote attacker to… |
CVE-2025-20171 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on… |
CVE-2025-20170 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on… |
CVE-2025-20169 | High | 7.7 | 2025-02-05 | A vulnerability in the SNMP subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause a DoS condition on… |
CVE-2025-20125 | Critical | 9.1 | 2025-02-05 | A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change n… |
CVE-2025-20124 | Critical | 9.9 | 2025-02-05 | A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected device. T… |
CVE-2025-0858 | | 2025-02-05 | A vulnerability was discovered in the firmware builds up to 8.2.1.0820 in certain Poly devices. The firmware flaw does not properly prevent path traversal and… | |
CVE-2025-21117 | Medium | 6.6 | 2025-02-05 | Dell Avamar, version 19.4 or later, contains an access token reuse vulnerability in the AUI. A low privileged local attacker could potentially exploit this vul… |
CVE-2025-0725 | High | 7.3 | 2025-02-05 | When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3… |
CVE-2025-0665 | High | 7.0 | 2025-02-05 | libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve. |
CVE-2025-0167 | Low | 3.4 | 2025-02-05 | When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to hos… |
CVE-2025-25246 | High | 8.1 | 2025-02-05 | NETGEAR XR1000 before 1.0.0.74, XR1000v2 before 1.1.0.22, and XR500 before 2.3.2.134 allow remote code execution by unauthenticated users. |
CVE-2025-1026 | High | 8.6 | 2025-02-05 | Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation due to improper URL validation through the setUrl method, w… |
CVE-2025-1025 | High | 7.5 | 2025-02-05 | Versions of the package cockpit-hq/cockpit before 2.4.1 are vulnerable to Arbitrary File Upload where an attacker can use different extension to bypass the upl… |
CVE-2025-1022 | High | 8.2 | 2025-02-05 | Versions of the package spatie/browsershot before 5.0.5 are vulnerable to Improper Input Validation in the setHtml function, invoked by Browsershot::html(), wh… |
CVE-2025-1028 | High | 8.1 | 2025-02-05 | The Contact Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the contact form upload feature in all… |
CVE-2025-23114 | Critical | 9.0 | 2025-02-05 | A vulnerability in Veeam Updater component allows Man-in-the-Middle attackers to execute arbitrary code on the affected server. This issue occurs due to a fail… |
CVE-2025-0413 | High | 7.8 | 2025-02-05 | Parallels Desktop Technical Data Reporter Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privi… |
CVE-2025-23023 | High | 8.2 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions an attacker can carefully craft a request with the right request headers to… |
CVE-2025-22602 | Medium | 6.5 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions an attacker can execute arbitrary JavaScript on users' browsers by posting… |
CVE-2025-22601 | Low | 3.1 | 2025-02-04 | Discourse is an open source platform for community discussion. In affected versions an attacker can trick a target user to make changes to their own username v… |
CVE-2025-24968 | High | 8.8 | 2025-02-04 | reNgine is an automated reconnaissance framework for web applications. An unrestricted project deletion vulnerability allows attackers with specific roles, suc… |
CVE-2025-24967 | Medium | 5.4 | 2025-02-04 | reNgine is an automated reconnaissance framework for web applications. A stored cross-site scripting (XSS) vulnerability exists in the admin panel's user manag… |
CVE-2025-24966 | Medium | 5.4 | 2025-02-04 | reNgine is an automated reconnaissance framework for web applications. HTML Injection occurs when an application improperly validates or sanitizes user inputs… |
CVE-2025-24964 | Critical | 9.6 | 2025-02-04 | Vitest is a testing framework powered by Vite. Affected versions are subject to arbitrary remote Code Execution when accessing a malicious website while Vitest… |
CVE-2025-24963 | Medium | 5.9 | 2025-02-04 | Vitest is a testing framework powered by Vite. The `__screenshot-error` handler on the browser mode HTTP server that responds any file on the file system. Espe… |
CVE-2025-0960 | Critical | 9.8 | 2025-02-04 | AutomationDirect C-more EA9 HMI contains a function with bounds checks that can be skipped, which could result in an attacker abusing the function to cause a d… |
CVE-2025-0630 | Medium | 6.5 | 2025-02-04 | Multiple Western Telematic (WTI) products contain a web interface that is vulnerable to a local file inclusion attack (LFI), where any authenticated user has p… |
CVE-2025-0509 | High | 7.3 | 2025-02-04 | A security issue was found in Sparkle before version 2.6.4. An attacker can replace an existing signed update with another payload, bypassing Sparkle’s (Ed)DSA… |
CVE-2025-25039 | Medium | 4.7 | 2025-02-04 | A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager (CPPM) allows remote authenticated users to run arbitrar… |
CVE-2025-24971 | | 2025-02-04 | DumpDrop is a stupid simple file upload application that provides an interface for dragging and dropping files. An OS Command Injection vulnerability was disco… | |
CVE-2025-24373 | Medium | 6.5 | 2025-02-04 | woocommerce-pdf-invoices-packing-slips is an extension which allows users to create, print & automatically email PDF invoices & packing slips for WooCommerce o… |
CVE-2025-0451 | Medium | 6.3 | 2025-02-04 | Inappropriate implementation in Extensions API in Google Chrome prior to 133.0.6943.53 allowed a remote attacker who convinced a user to engage in specific UI… |
CVE-2025-0445 | Medium | 5.4 | 2025-02-04 | Use after free in V8 in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-0444 | Medium | 6.3 | 2025-02-04 | Use after free in Skia in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrom… |
CVE-2025-23060 | Medium | 6.6 | 2025-02-04 | A vulnerability in HPE Aruba Networking ClearPass Policy Manager may, under certain circumstances, expose sensitive unencrypted information. Exploiting this vu… |
CVE-2025-23059 | Medium | 6.8 | 2025-02-04 | A vulnerability in the web-based management interface of HPE Aruba Networking ClearPass Policy Manager exposes directories containing sensitive information. If… |
CVE-2025-23058 | High | 8.8 | 2025-02-04 | A vulnerability in the ClearPass Policy Manager web-based management interface allows a low-privileged (read-only) authenticated remote attacker to gain unauth… |
CVE-2025-0364 | Critical | 9.8 | 2025-02-04 | BigAntSoft BigAnt Server, up to and including version 5.6.06, is vulnerable to unauthenticated remote code execution via account registration. An unauthenticat… |
CVE-2025-24677 | Critical | 9.9 | 2025-02-04 | Improper Control of Generation of Code ('Code Injection') vulnerability in wpspin Post/Page Copying Tool postpage-import-export-with-custom-fields-taxonomies a… |
CVE-2025-24648 | High | 7.5 | 2025-02-04 | Incorrect Privilege Assignment vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Privilege Escalation.This issue affects A… |
CVE-2025-24602 | High | 7.1 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP24 WP24 Domain Check wp24-domain-check allows Reflected… |
CVE-2025-24599 | High | 7.1 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tribulant Software Newsletters newsletters-lite allows Re… |
CVE-2025-24598 | High | 7.1 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in brandtoss WP Mailster wp-mailster allows Reflected XSS.Th… |
CVE-2025-23645 | High | 7.1 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Optimize Worldwide Find Content IDs find-content-ids allo… |
CVE-2025-22794 | High | 7.1 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ianhaycox World Cup Predictor world-cup-predictor allows… |
CVE-2025-22730 | Medium | 6.5 | 2025-02-04 | Missing Authorization vulnerability in ksher thailand Ksher ksher-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-22700 | High | 8.5 | 2025-02-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler Code traveler-code.This issue affects… |
CVE-2025-22699 | Critical | 9.0 | 2025-02-04 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in shinetheme Traveler Code traveler-code.This issue affects… |
CVE-2025-22697 | Medium | 6.5 | 2025-02-04 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CyberChimps Responsive Blocks responsive-block-editor-add… |
CVE-2025-22696 | Medium | 5.4 | 2025-02-04 | Missing Authorization vulnerability in WPDeveloper Document Block – Upload & Embed Docs document.This issue affects Document Block – Upload & Embed Docs: from… |