2025 CVEs (page 418)
Page 418 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-21682 | High | 7.3 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: always recalculate features after XDP clearing, fix null-deref Recalculate fea… |
CVE-2025-21681 | Medium | 5.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix lockup on tx to unregistering netdev with carrier Commit in a fixes tag… |
CVE-2025-21680 | High | 7.8 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: pktgen: Avoid out-of-bounds access in get_imix_entries Passing a sufficient amount of imi… |
CVE-2025-21679 | Medium | 5.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: btrfs: add the missing error handling inside get_canonical_dev_path Inside function get_c… |
CVE-2025-21678 | High | 7.8 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: gtp: Destroy device along with udp socket's netns dismantle. gtp_newlink() links the devi… |
CVE-2025-21677 | High | 7.8 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: pfcp: Destroy device along with udp socket's netns dismantle. pfcp_newlink() links the de… |
CVE-2025-21676 | High | 7.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: net: fec: handle page_pool_dev_alloc_pages error The fec_enet_update_cbd function calls p… |
CVE-2025-21675 | Medium | 5.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Clear port select structure when fail to create Clear the port select structure… |
CVE-2025-21674 | Medium | 5.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix inversion dependency warning while enabling IPsec tunnel Attempt to enable… |
CVE-2025-21673 | Critical | 9.8 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double free of TCP_Server_Info::hostname When shutting down the server i… |
CVE-2025-21672 | Medium | 5.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix merge preference rule failure condition syzbot reported a lock held when returni… |
CVE-2025-21671 | High | 7.8 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: zram: fix potential UAF of zram table If zram_meta_alloc failed early, it frees allocated… |
CVE-2025-21670 | Medium | 5.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: vsock/bpf: return early if transport is not assigned Some of the core functions can only… |
CVE-2025-21669 | High | 7.8 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: discard packets if the transport changes If the socket has been de-assigned… |
CVE-2025-21668 | Medium | 5.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: pmdomain: imx8mp-blk-ctrl: add missing loop break condition Currently imx8mp_blk_ctrl_rem… |
CVE-2025-21667 | Medium | 5.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: iomap: avoid avoid truncating 64-bit offset to 32 bits on 32-bit kernels, iomap_write_del… |
CVE-2025-21666 | Medium | 5.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] Recent reports have shown ho… |
CVE-2025-21665 | Medium | 5.5 | 2025-01-31 | In the Linux kernel, the following vulnerability has been resolved: filemap: avoid truncating 64-bit offset to 32 bits On 32-bit kernels, folio_seek_hole_dat… |
CVE-2025-24749 | High | 7.1 | 2025-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Overt Software Solutions LTD EZPZ SAML SP Single Sign On (SSO) allows Cross Site Request Forgery. This issue… |
CVE-2025-24718 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in activity-log.com WP Sessions Time Monitoring Full Automat… |
CVE-2025-24710 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcel Pol Gwolle Guestbook gwolle-gb allows Reflected XS… |
CVE-2025-24686 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Metagauss RegistrationMagic custom-registration-form-buil… |
CVE-2025-24635 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in integrationdevpaytm Paytm Payment Donation paytm-donation… |
CVE-2025-24632 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in algol.plus Advanced Dynamic Pricing for WooCommerce advan… |
CVE-2025-24609 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PORTONE PORTONE 우커머스 결제 iamport-for-woocommerce allows Re… |
CVE-2025-24608 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Milan Petrovic GD Mail Queue gd-mail-queue allows Reflect… |
CVE-2025-24597 | Medium | 6.5 | 2025-01-31 | Insertion of Sensitive Information Into Sent Data vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Generator for WooCommerce embedding-barcodes-into-… |
CVE-2025-24563 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themeglow Cleanup – Directory Listing & Classifieds WordP… |
CVE-2025-24560 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AwesomeTOGI Awesome Event Booking awesome-event-booking a… |
CVE-2025-24551 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in oneteamsoftware Radio Buttons and Swatches for WooCommerc… |
CVE-2025-24549 | High | 7.1 | 2025-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Mahbubur Rahman Post Meta post-meta allows Reflected XSS.This issue affects Post Meta: from n/a through <= 1… |
CVE-2025-24535 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sonalsinha21 SKT Donation skt-donation allows Reflected X… |
CVE-2025-24534 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dinamiko DPortfolio dportfolio allows Reflected XSS.This… |
CVE-2025-23990 | High | 7.1 | 2025-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in jablonczay Scroll Styler scroll-styler.This issue affects Scroll Styler: from n/a through <= 1.1. |
CVE-2025-23989 | High | 7.1 | 2025-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Alessandro Piconi Internal Link Builder internal-link-builder allows Cross Site Request Forgery.This issue a… |
CVE-2025-23987 | Medium | 6.5 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codegearthemes Designer designer allows DOM-Based XSS.Thi… |
CVE-2025-23985 | Medium | 5.4 | 2025-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in brainvireinfo Dynamic URL SEO dynamic-url-seo allows Cross Site Request Forgery.This issue affects Dynamic U… |
CVE-2025-23980 | High | 7.1 | 2025-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in James Andrews Full Circle full-circle allows Stored XSS.This issue affects Full Circle: from n/a through <=… |
CVE-2025-23978 | High | 7.1 | 2025-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Ninos FlashCounter flashcounter allows Stored XSS.This issue affects FlashCounter: from n/a through <= 1.1.8. |
CVE-2025-23977 | High | 7.1 | 2025-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in Bhaskar Dhote Post Carousel Slider post-carousel-slider allows Stored XSS.This issue affects Post Carousel S… |
CVE-2025-23976 | High | 7.1 | 2025-01-31 | Cross-Site Request Forgery (CSRF) vulnerability in operationsissuu Issuu Panel issuu-panel allows Stored XSS.This issue affects Issuu Panel: from n/a through <… |
CVE-2025-23759 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gavin Affiliate Tools Việt Nam affiliate-tools-viet-nam a… |
CVE-2025-23671 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in sav WP OpenSearch wp-opensearch allows Stored XSS.This is… |
CVE-2025-23596 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in grafeon Notifikácie.sk notifikacie-sk allows Reflected XS… |
CVE-2025-22757 | Medium | 6.5 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeBard CodeBard Help Desk codebard-help-desk allows Sto… |
CVE-2025-22720 | Medium | 5.8 | 2025-01-31 | Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Confi… |
CVE-2025-22564 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in faaiq Pretty Url pretty-url allows Reflected XSS.This iss… |
CVE-2025-22341 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in parswp Hide Login+ hide-login allows Reflected XSS.This i… |
CVE-2025-22332 | High | 7.1 | 2025-01-31 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shanaver CloudFlare(R) Cache Purge cloudflare-cache-purge… |
CVE-2025-22265 | Medium | 6.5 | 2025-01-31 | Missing Authorization vulnerability in mgplugin EMI Calculator emi-calculator allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-22216 | Medium | 5.4 | 2025-01-31 | A UAA configured with multiple identity zones, does not properly validate session information across those zones. A User authenticated against a corporate IDP… |
CVE-2025-0809 | High | 7.2 | 2025-01-31 | The Link Fixer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via broken links in all versions up to, and including, 3.4 due to insufficient… |
CVE-2025-0507 | Medium | 6.4 | 2025-01-31 | The Ticketmeo – Sell Tickets – Event Ticketing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up… |
CVE-2025-0493 | Critical | 9.8 | 2025-01-31 | The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Limited Local File Inclusion in all version… |
CVE-2025-0470 | Medium | 6.1 | 2025-01-31 | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the title para… |
CVE-2025-24336 | Low | 3.3 | 2025-01-31 | SXF Common Library handles input data improperly. If a product using the library reads a crafted file, the product may be crashed. |
CVE-2025-24886 | High | 7.7 | 2025-01-30 | pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Incorrect symlink checks on user specifie… |
CVE-2025-24885 | High | 7.6 | 2025-01-30 | pwn.college is an education platform to learn about, and practice, core cybersecurity concepts in a hands-on fashion. Missing access control on rendering custo… |
CVE-2025-0882 | Medium | 6.3 | 2025-01-30 | A vulnerability was found in code-projects Chat System up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2025-0881 | Medium | 6.3 | 2025-01-30 | A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /dashboard/adm… |
CVE-2025-0880 | Medium | 6.3 | 2025-01-30 | A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /dashboard/a… |
CVE-2025-0574 | High | 7.5 | 2025-01-30 | Sante PACS Server URL path Memory Corruption Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service conditio… |
CVE-2025-0573 | Medium | 5.3 | 2025-01-30 | Sante PACS Server DCM File Parsing Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbitrary files… |
CVE-2025-0572 | Medium | 4.3 | 2025-01-30 | Sante PACS Server Web Portal DCM File Parsing Directory Traversal Arbitrary File Write Vulnerability. This vulnerability allows remote attackers to create arbi… |
CVE-2025-0571 | Medium | 6.5 | 2025-01-30 | Sante PACS Server Web Portal DCM File Parsing Memory Corruption Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-… |
CVE-2025-0570 | Medium | 6.5 | 2025-01-30 | Sante PACS Server Web Portal DCM File Parsing Memory Corruption Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-… |
CVE-2025-0569 | High | 7.5 | 2025-01-30 | Sante PACS Server DCM File Parsing Memory Corruption Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service… |
CVE-2025-0568 | High | 7.5 | 2025-01-30 | Sante PACS Server DCM File Parsing Memory Corruption Denial-of-Service Vulnerability. This vulnerability allows remote attackers to create a denial-of-service… |
CVE-2025-24802 | High | 8.6 | 2025-01-30 | Plonky2 is a SNARK implementation based on techniques from PLONK and FRI. Lookup tables, whose length is not divisible by 26 = floor(num_routed_wires / 3) alwa… |
CVE-2025-0147 | High | 8.8 | 2025-01-30 | Type confusion in the Zoom Workplace App for Linux before 6.2.10 may allow an authorized user to conduct an escalation of privilege via network access. |
CVE-2025-0146 | Low | 3.9 | 2025-01-30 | Symlink following in the installer for Zoom Workplace App for macOS before 6.2.10 may allow an authenticated user to conduct a denial of service via local acce… |
CVE-2025-0145 | Medium | 4.6 | 2025-01-30 | Untrusted search path in the installer for some Zoom Workplace Apps for Windows may allow an authorized user to conduct an escalation of privilege via local ac… |
CVE-2025-0144 | Low | 3.1 | 2025-01-30 | Out-of-bounds write in some Zoom Workplace Apps may allow an authorized user to conduct a loss of integrity via network access. |
CVE-2025-0143 | Medium | 4.3 | 2025-01-30 | Out-of-bounds write in the Zoom Workplace App for Linux before version 6.2.5 may allow an unauthorized user to conduct a denial of service via network access. |
CVE-2025-0142 | Medium | 4.3 | 2025-01-30 | Cleartext storage of sensitive information in the Zoom Jenkins Marketplace plugin before version 1.4 may allow an authenticated user to conduct a disclosure of… |
CVE-2025-24507 | | 2025-01-30 | This vulnerability allows appliance compromise at boot time. | |
CVE-2025-24506 | | 2025-01-30 | A specific authentication strategy allows to learn ids of PAM users associated with certain authentication types. | |
CVE-2025-24505 | | 2025-01-30 | This vulnerability allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by uploading a specially craf… | |
CVE-2025-24504 | | 2025-01-30 | An improper input validation the CSRF filter results in unsanitized user input written to the application logs. | |
CVE-2025-24503 | | 2025-01-30 | A malicious actor can fix the session of a PAM user by tricking the user to click on a specially crafted link to the PAM server. | |
CVE-2025-24502 | | 2025-01-30 | An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by… | |
CVE-2025-24501 | | 2025-01-30 | An improper input validation allows an unauthenticated attacker to alter PAM logs by sending a specially crafted HTTP request. | |
CVE-2025-24500 | | 2025-01-30 | The vulnerability allows an unauthenticated attacker to access information in PAM database. | |
CVE-2025-0683 | Medium | 5.9 | 2025-01-30 | In its default configuration, Contec Health CMS8000 Patient Monitor transmits plain-text patient data to a hard-coded public IP address when a patient is hook… |
CVE-2025-0681 | Medium | 6.2 | 2025-01-30 | The Cloud MQTT service of the affected products supports wildcard topic subscription which could allow an attacker to obtain sensitive information from tappi… |
CVE-2025-0680 | Critical | 9.8 | 2025-01-30 | Affected products contain a vulnerability in the device cloud rpc command handling process that could allow remote attackers to take control over arbitrary dev… |
CVE-2025-0626 | High | 7.5 | 2025-01-30 | The "monitor" binary in the firmware of the affected product attempts to mount to a hard-coded, routable IP address, bypassing existing device network settings… |
CVE-2025-0874 | Medium | 6.3 | 2025-01-30 | A vulnerability, which was classified as critical, has been found in code-projects Simple Plugins Car Rental Management 1.0. Affected by this issue is some unk… |
CVE-2025-0498 | Critical | 9.8 | 2025-01-30 | A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to insec… |
CVE-2025-0497 | Critical | 9.8 | 2025-01-30 | A data exposure vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to stori… |
CVE-2025-0477 | Critical | 9.8 | 2025-01-30 | An encryption vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to a weak… |
CVE-2025-24099 | Medium | 5.1 | 2025-01-30 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. A local attacker may be abl… |
CVE-2025-0873 | Medium | 6.3 | 2025-01-30 | A vulnerability classified as critical was found in itsourcecode Tailoring Management System 1.0. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-0367 | Medium | 6.5 | 2025-01-30 | In versions 3.1.0 and lower of the Splunk Supporting Add-on for Active Directory, also known as SA-ldapsearch, a vulnerable regular expression pattern could le… |
CVE-2025-24883 | | 2025-01-30 | go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially cra… | |
CVE-2025-24784 | Medium | 4.3 | 2025-01-30 | kubewarden-controller is a Kubernetes controller that allows you to dynamically register Kubewarden admission policies. The policy group feature, added to by t… |
CVE-2025-24376 | Medium | 6.5 | 2025-01-30 | kubewarden-controller is a Kubernetes controller that allows you to dynamically register Kubewarden admission policies. By design, AdmissionPolicy and Admissio… |
CVE-2025-23216 | Medium | 6.8 | 2025-01-30 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error message… |
CVE-2025-22222 | High | 7.7 | 2025-01-30 | VMware Aria Operations contains an information disclosure vulnerability. A malicious user with non-administrative privileges may exploit this vulnerability to… |
CVE-2025-22221 | Medium | 5.2 | 2025-01-30 | VMware Aria Operation for Logs contains a stored cross-site scripting vulnerability. A malicious actor with admin privileges to VMware Aria Operations for Logs… |