2025 CVEs (page 419)
Page 419 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-24094 | Medium | 4.7 | 2025-01-27 | A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be… |
CVE-2025-24093 | Critical | 9.8 | 2025-01-27 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app ma… |
CVE-2025-24092 | Medium | 5.5 | 2025-01-27 | This issue was addressed with improved data protection. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3. An app may be able to read sensitive lo… |
CVE-2025-24087 | Medium | 5.5 | 2025-01-27 | The issue was addressed with additional permissions checks. This issue is fixed in macOS Sequoia 15.3. An app may be able to access protected user data. |
CVE-2025-24086 | Medium | 5.5 | 2025-01-27 | The issue was addressed with improved memory handling. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.4, macOS Sequoia 15.3, macOS Sonoma 14.7.3… |
CVE-2025-24085 | Critical | 10.0 | 2025-01-27 | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 18.3 and iPadOS 18.3, iPadOS 17.7.6, macOS Sequoia 15.3, macOS… |
CVE-2025-0753 | Medium | 6.3 | 2025-01-27 | A vulnerability classified as critical was found in Axiomatic Bento4 up to 1.6.0. This vulnerability affects the function AP4_StdcFileByteStream::ReadPartial o… |
CVE-2025-0751 | Medium | 6.3 | 2025-01-27 | A vulnerability classified as critical has been found in Axiomatic Bento4 up to 1.6.0. This affects the function AP4_BitReader::ReadBits of the component mp42a… |
CVE-2025-0734 | Medium | 4.7 | 2025-01-27 | A vulnerability has been found in y_project RuoYi up to 4.8.0 and classified as critical. This vulnerability affects the function getBeanName of the component… |
CVE-2025-24368 | High | 7.5 | 2025-01-27 | Cacti is an open source performance and fault management framework. Some of the data stored in automation_tree_rules.php is not thoroughly checked and is used… |
CVE-2025-24367 | High | 8.8 | 2025-01-27 | Cacti is an open source performance and fault management framework. An authenticated Cacti user can abuse graph creation and graph template functionality to cr… |
CVE-2025-24365 | High | 8.1 | 2025-01-27 | vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker can obtain owner rights of other organizatio… |
CVE-2025-24364 | High | 7.2 | 2025-01-27 | vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Attacker with authenticated access to the vaultwarden… |
CVE-2025-24357 | High | 7.5 | 2025-01-27 | vLLM is a library for LLM inference and serving. vllm/model_executor/weight_utils.py implements hf_model_weights_iterator to load the model checkpoint, which i… |
CVE-2025-24356 | High | 7.5 | 2025-01-27 | fastd is a VPN daemon which tunnels IP packets and Ethernet frames over UDP. When receiving a data packet from an unknown IP address/port combination, fastd wi… |
CVE-2025-24354 | Medium | 5.3 | 2025-01-27 | imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRE… |
CVE-2025-23197 | Medium | 6.5 | 2025-01-27 | matrix-hookshot is a Matrix bot for connecting to external services like GitHub, GitLab, JIRA, and more. When Hookshot 6 version 6.0.1 or below, or Hookshot 5… |
CVE-2025-0733 | Medium | 4.5 | 2025-01-27 | A vulnerability, which was classified as problematic, was found in Postman up to 11.20 on Windows. This affects an unknown part in the library profapi.dll. The… |
CVE-2025-0732 | Medium | 4.5 | 2025-01-27 | A vulnerability, which was classified as problematic, has been found in Discord up to 1.0.9177 on Windows. Affected by this issue is some unknown functionality… |
CVE-2025-22604 | Critical | 9.1 | 2025-01-27 | Cacti is an open source performance and fault management framework. Due to a flaw in multi-line SNMP result parser, authenticated users can inject malformed OI… |
CVE-2025-0730 | Low | 3.7 | 2025-01-27 | A vulnerability classified as problematic has been found in TP-Link TL-SG108E 1.0.0 Build 20201208 Rel. 40304. Affected is an unknown function of the file /usr… |
CVE-2025-0729 | Medium | 4.3 | 2025-01-27 | A vulnerability was found in TP-Link TL-SG108E 1.0.0 Build 20201208 Rel. 40304. It has been rated as problematic. This issue affects some unknown processing. T… |
CVE-2025-24783 | High | 7.5 | 2025-01-27 | ** UNSUPPORTED WHEN ASSIGNED ** Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) vulnerability in Apache Cocoon. This issue affects Apache Co… |
CVE-2025-24782 | Medium | 6.5 | 2025-01-27 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpWax Post Grid, Slider & Carousel Ult… |
CVE-2025-24747 | Medium | 5.3 | 2025-01-27 | Missing Authorization vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through <= 3.4.0. |
CVE-2025-24744 | Medium | 4.3 | 2025-01-27 | Missing Authorization vulnerability in NotFound Bridge Core. This issue affects Bridge Core: from n/a through 3.3. |
CVE-2025-24743 | Medium | 4.3 | 2025-01-27 | Missing Authorization vulnerability in Rometheme RTMKit rometheme-for-elementor.This issue affects RTMKit: from n/a through <= 1.5.2. |
CVE-2025-24742 | Medium | 4.3 | 2025-01-27 | Cross-Site Request Forgery (CSRF) vulnerability in WPGMaps WP Go Maps wp-google-maps.This issue affects WP Go Maps: from n/a through <= 9.0.40. |
CVE-2025-24741 | Medium | 4.7 | 2025-01-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in LOGON KB Support kb-support.This issue affects KB Support: from n/a through <= 1.6.7. |
CVE-2025-24740 | Medium | 4.7 | 2025-01-27 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in ThimPress LearnPress learnpress.This issue affects LearnPress: from n/a through <= 4.2.7.1. |
CVE-2025-24734 | High | 8.8 | 2025-01-27 | Missing Authorization vulnerability in CodeSolz Better Find and Replace real-time-auto-find-and-replace allows Privilege Escalation.This issue affects Better F… |
CVE-2025-24708 | High | 7.1 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks WP Dynamics CRM for Contact Form 7, WPForms, El… |
CVE-2025-24689 | Medium | 5.9 | 2025-01-27 | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Javier Carazo Import and export users and customers import-use… |
CVE-2025-24680 | High | 7.1 | 2025-01-27 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows… |
CVE-2025-24671 | Critical | 9.8 | 2025-01-27 | Deserialization of Untrusted Data vulnerability in Pdfcrowd Dev Team Save as PDF save-as-pdf-by-pdfcrowd allows Object Injection.This issue affects Save as PDF… |
CVE-2025-24667 | Critical | 9.3 | 2025-01-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Small Package Quotes – Worldwide Expres… |
CVE-2025-24665 | Critical | 9.3 | 2025-01-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology Small Package Quotes – Unishippers Edit… |
CVE-2025-24662 | Medium | 5.3 | 2025-01-27 | Missing Authorization vulnerability in LearnDash LearnDash LMS allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Learn… |
CVE-2025-24653 | Medium | 4.3 | 2025-01-27 | Missing Authorization vulnerability in NotFound Admin and Site Enhancements (ASE) Pro allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-24628 | Medium | 5.3 | 2025-01-27 | Authentication Bypass by Spoofing vulnerability in bestwebsoft Google Captcha google-captcha allows Identity Spoofing.This issue affects Google Captcha: from n… |
CVE-2025-24626 | High | 7.1 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Music Store music-store allows Reflected XSS.T… |
CVE-2025-24606 | Medium | 6.4 | 2025-01-27 | Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-24603 | Medium | 4.3 | 2025-01-27 | Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Print Barcode Labels for your WooCommerce products/orders a4-barcode-generator.This is… |
CVE-2025-24600 | Medium | 5.3 | 2025-01-27 | Missing Authorization vulnerability in davidfcarr RSVPMarker rsvpmaker.This issue affects RSVPMarker : from n/a through <= 11.4.5. |
CVE-2025-24593 | High | 7.1 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Reflected… |
CVE-2025-24590 | Medium | 5.3 | 2025-01-27 | Missing Authorization vulnerability in picu picu picu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects picu: from n/a… |
CVE-2025-24540 | Medium | 4.3 | 2025-01-27 | Cross-Site Request Forgery (CSRF) vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Cross Site R… |
CVE-2025-24538 | Medium | 5.4 | 2025-01-27 | Cross-Site Request Forgery (CSRF) vulnerability in Slava Abakumov BuddyPress Groups Extras buddypress-groups-extras allows Cross Site Request Forgery.This issu… |
CVE-2025-24537 | Medium | 5.4 | 2025-01-27 | Cross-Site Request Forgery (CSRF) vulnerability in StellarWP The Events Calendar the-events-calendar allows Cross Site Request Forgery.This issue affects The E… |
CVE-2025-23982 | High | 7.1 | 2025-01-27 | Missing Authorization vulnerability in Gopi krishnan Fare Calculator fare-calculator allows Stored XSS.This issue affects Fare Calculator: from n/a through <=… |
CVE-2025-23849 | Medium | 5.4 | 2025-01-27 | Missing Authorization vulnerability in bpiwowar PAPERCITE papercite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-23756 | High | 7.1 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ivanchernyakov LawPress – Law Firm Website Management law… |
CVE-2025-23754 | High | 7.1 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ulrich Sossou The Loops the-loops allows Reflected XSS.Th… |
CVE-2025-23752 | High | 7.1 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Clifton Griffin CGD Arrange Terms shopp-arrange allows Re… |
CVE-2025-23669 | Medium | 6.5 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nurul Amin WP Smart Tooltip wp-smart-tool-tip allows Stor… |
CVE-2025-23656 | Medium | 6.5 | 2025-01-27 | Missing Authorization vulnerability in Saul Morales Pacheco Donate visa donate-visa allows Stored XSS.This issue affects Donate visa: from n/a through <= 1.0.0. |
CVE-2025-23574 | High | 7.1 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jonathan Lau CubePM cubepm allows Reflected XSS.This issu… |
CVE-2025-23531 | High | 7.1 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in davidfcarr RSVPMaker Volunteer Roles rsvpmaker-volunteer-… |
CVE-2025-23529 | Medium | 6.5 | 2025-01-27 | Missing Authorization vulnerability in blokhauswp Minterpress minterpress allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mi… |
CVE-2025-24754 | Medium | 4.3 | 2025-01-27 | Missing Authorization vulnerability in favethemes Houzez houzez.This issue affects Houzez: from n/a through <= 3.4.0. |
CVE-2025-24685 | High | 8.1 | 2025-01-27 | Path Traversal: '.../...//' vulnerability in Ihor Kit Morkva UA Shipping morkva-ua-shipping allows PHP Local File Inclusion.This issue affects Morkva UA Shippi… |
CVE-2025-24664 | Critical | 9.3 | 2025-01-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in enituretechnology LTL Freight Quotes – Worldwide Express… |
CVE-2025-24612 | Critical | 9.3 | 2025-01-27 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ihor Kit Shipping for Nova Poshta nova-poshta-ttn allows… |
CVE-2025-24601 | Critical | 9.8 | 2025-01-27 | Deserialization of Untrusted Data vulnerability in ThimPress FundPress fundpress allows Object Injection.This issue affects FundPress: from n/a through <= 2.0… |
CVE-2025-24584 | Medium | 4.3 | 2025-01-27 | Missing Authorization vulnerability in bdthemes Ultimate Store Kit Elementor Addons ultimate-store-kit allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-24533 | Medium | 5.4 | 2025-01-27 | Cross-Site Request Forgery (CSRF) vulnerability in MetaSlider Responsive Slider by MetaSlider ml-slider allows Cross Site Request Forgery.This issue affects Re… |
CVE-2025-23792 | High | 7.1 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Busters Passwordless WP – Login with your glance or fi… |
CVE-2025-23457 | High | 7.1 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in shipdeoplugin Shipdeo shipdeo-woo allows Reflected XSS.Th… |
CVE-2025-22513 | High | 7.1 | 2025-01-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kyle Phillips Simple Locator simple-locator allows Reflec… |
CVE-2025-0696 | Medium | 5.3 | 2025-01-27 | A NULL Pointer Dereference vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the component embedding the library b… |
CVE-2025-0695 | Medium | 5.3 | 2025-01-27 | An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce a crash of the comp… |
CVE-2025-24814 | Medium | 5.5 | 2025-01-27 | Core creation allows users to replace "trusted" configset files with arbitrary configuration Solr instances that (1) use the "FileSystemConfigSetService" comp… |
CVE-2025-24390 | Medium | 6.8 | 2025-01-27 | A vulnerability in OTRS Application Server and reverse proxy settings allows session hijacking due to missing attributes for sensitive cookie settings in HTTPS… |
CVE-2025-24389 | Medium | 6.3 | 2025-01-27 | Certain errors of the upstream libraries will insert sensitive information in the OTRS or ((OTRS)) Community Edition log mechanism and mails send to the system… |
CVE-2025-0722 | Medium | 4.7 | 2025-01-27 | A vulnerability classified as critical was found in needyamin image_gallery 1.0. This vulnerability affects unknown code of the file /admin/gallery.php of the… |
CVE-2025-0721 | Medium | 4.3 | 2025-01-27 | A vulnerability classified as problematic has been found in needyamin image_gallery 1.0. This affects the function image_gallery of the file /view.php. The man… |
CVE-2025-0720 | Low | 3.3 | 2025-01-26 | A vulnerability was found in Microword eScan Antivirus 7.0.32 on Linux. It has been rated as problematic. Affected by this issue is the function removeExtraSla… |
CVE-2025-24858 | | 2025-01-26 | Develocity (formerly Gradle Enterprise) before 2024.3.1 allows an attacker who has network access to a Develocity server to obtain the hashed password of the s… | |
CVE-2025-0543 | High | 7.8 | 2025-01-25 | Local privilege escalation in G DATA Security Client due to incorrect assignment of privileges to directories. This vulnerability allows a local, unprivileged… |
CVE-2025-0542 | High | 7.8 | 2025-01-25 | Local privilege escalation due to incorrect assignment of privileges of temporary files in the update mechanism of G DATA Management Server. This vulnerability… |
CVE-2025-0350 | Medium | 6.4 | 2025-01-25 | The Divi Carousel Maker – Image, Logo, Testimonial, Post Carousel & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Ima… |
CVE-2025-0682 | High | 8.8 | 2025-01-25 | The ThemeREX Addons plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.33.0 via the 'trx_sc_reviews' shortcode… |
CVE-2025-0411 | High | 7.0 | 2025-01-25 | 7-Zip Mark-of-the-Web Bypass Vulnerability. This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installat… |
CVE-2025-0357 | Critical | 9.8 | 2025-01-25 | The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in the 'WPB_Profile_controller::handle_image… |
CVE-2025-24361 | Medium | 5.3 | 2025-01-25 | Nuxt is an open-source web development framework for Vue.js. Source code may be stolen during dev when using version 3.0.0 through 3.15.12 of the webpack build… |
CVE-2025-24360 | Medium | 5.3 | 2025-01-25 | Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any reques… |
CVE-2025-21262 | Medium | 5.4 | 2025-01-24 | User Interface (UI) Misrepresentation of Critical Information in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a net… |
CVE-2025-0710 | Low | 3.5 | 2025-01-24 | A vulnerability classified as problematic has been found in CampCodes School Management Software 1.0. Affected is an unknown function of the file /notice-list… |
CVE-2025-0709 | Low | 2.4 | 2025-01-24 | A vulnerability was found in Dcat-Admin 2.2.1-beta. It has been rated as problematic. This issue affects some unknown processing of the file /admin/auth/roles… |
CVE-2025-0708 | Low | 3.5 | 2025-01-24 | A vulnerability was found in fumiao opencms 2.2. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/model/addOrUpd… |
CVE-2025-0707 | High | 7.8 | 2025-01-24 | A vulnerability was found in Rise Group Rise Mode Temp CPU 2.1. It has been classified as critical. This affects an unknown part in the library CRYPTBASE.dll o… |
CVE-2025-0706 | Low | 2.4 | 2025-01-24 | A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d and classified as problematic. Affected by this issue is some un… |
CVE-2025-24363 | Medium | 4.2 | 2025-01-24 | The HL7 FHIR IG publisher is a tool to take a set of inputs and create a standard FHIR IG. Prior to version 1.8.9, in CI contexts, the IG Publisher CLI uses gi… |
CVE-2025-0705 | Medium | 4.3 | 2025-01-24 | A vulnerability has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d and classified as problematic. Affected by this vulnerabili… |
CVE-2025-0704 | Medium | 5.3 | 2025-01-24 | A vulnerability, which was classified as problematic, was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. Affected is the function… |
CVE-2025-0703 | Medium | 4.3 | 2025-01-24 | A vulnerability, which was classified as problematic, has been found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. This issue affects s… |
CVE-2025-24756 | High | 7.1 | 2025-01-24 | Cross-Site Request Forgery (CSRF) vulnerability in mgplugin Roi Calculator roi-calculator allows Stored XSS.This issue affects Roi Calculator: from n/a through… |
CVE-2025-24755 | Medium | 6.5 | 2025-01-24 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in add-ons.org PDF Invoice Builder for WooCommerce pdf-for-w… |
CVE-2025-24753 | Medium | 4.3 | 2025-01-24 | Missing Authorization vulnerability in StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-24751 | Medium | 4.3 | 2025-01-24 | Missing Authorization vulnerability in GoDaddy CoBlocks coblocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoB… |