2025 CVEs (page 42)
Page 42 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12895 | Medium | 5.3 | 2026-01-15 | The Kalium 3 | Creative WordPress & WooCommerce Theme theme for WordPress is vulnerable to unauthorized email sending due to a missing capability check on the… |
CVE-2025-14457 | Low | 3.7 | 2026-01-15 | The Drag and Drop Multiple File Upload for Contact Form 7 plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ownership ch… |
CVE-2025-14448 | Medium | 5.4 | 2026-01-15 | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Multiple Checkbox and Multiple Select user profile f… |
CVE-2025-14058 | Low | 3.2 | 2026-01-14 | A potential missing authentication vulnerability was reported in some Lenovo Tablets that could allow an unauthorized user with physical access to modify Contr… |
CVE-2025-13455 | High | 7.8 | 2026-01-14 | A vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to bypass ThinkPlus device authentication and enro… |
CVE-2025-13454 | Medium | 5.5 | 2026-01-14 | A potential vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to gain access to sensitive device infor… |
CVE-2025-13453 | Medium | 4.6 | 2026-01-14 | A potential vulnerability was reported in some ThinkPlus USB drives that could allow a user with physical access to read data stored on the drive. |
CVE-2025-13154 | Medium | 5.5 | 2026-01-14 | An improper link following vulnerability was reported in the SmartPerformanceAddin for Lenovo Vantage that could allow an authenticated local user to perform a… |
CVE-2025-12166 | High | 7.5 | 2026-01-14 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection via the `order` and `a… |
CVE-2025-71166 | Medium | 5.4 | 2026-01-14 | Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools S… |
CVE-2025-71165 | Medium | 5.4 | 2026-01-14 | Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the administrative interface within the Tools S… |
CVE-2025-71164 | Medium | 5.4 | 2026-01-14 | Typesetter CMS versions up to and including 5.1 contain a reflected cross-site scripting (XSS) vulnerability in the Editing component. The images parameter (su… |
CVE-2025-33206 | High | 7.8 | 2026-01-14 | NVIDIA NSIGHT Graphics for Linux contains a vulnerability where an attacker could cause command injection. A successful exploit of this vulnerability might lea… |
CVE-2025-14557 | Medium | 4.8 | 2026-01-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Facebook Pixel facebook_pixel allows Stored… |
CVE-2025-14556 | Medium | 5.4 | 2026-01-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Drupal Flag allows Cross-Site Scripting (XSS).This… |
CVE-2025-11224 | High | 7.7 | 2026-01-14 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allo… |
CVE-2025-71021 | High | 7.5 | 2026-01-14 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the serverName parameter of the sub_65A28 function. This vulnerability allows attackers to… |
CVE-2025-70747 | High | 7.5 | 2026-01-14 | Tenda AX-1806 v1.0.0.1 was discovered to contain a stack overflow in the serviceName parameter of the sub_65A28 function. This vulnerability allows attackers t… |
CVE-2025-65397 | Medium | 6.8 | 2026-01-14 | An insecure authentication mechanism in the safe_exec.sh startup script of Blurams Flare Camera version 24.1114.151.929 and earlier allows an attacker with phy… |
CVE-2025-63644 | Medium | 5.4 | 2026-01-14 | A stored cross-site scripting (XSS) vulnerability exists in pH7Software pH7-Social-Dating-CMS 17.9.1 in the user profile Description field. |
CVE-2025-70968 | Critical | 9.8 | 2026-01-14 | FreeImage 3.18.0 contains a Use After Free in PluginTARGA.cpp;loadRLE(). |
CVE-2025-67835 | Medium | 6.5 | 2026-01-14 | Paessler PRTG Network Monitor before 25.4.114 allows Denial-of-Service (DoS) by an authenticated attacker via the Notification Contacts functionality. |
CVE-2025-67834 | Medium | 5.4 | 2026-01-14 | Paessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the filter parameter. |
CVE-2025-67833 | Medium | 6.1 | 2026-01-14 | Paessler PRTG Network Monitor before 25.4.114 allows XSS by an unauthenticated attacker via the tag parameter. |
CVE-2025-65396 | Medium | 6.1 | 2026-01-14 | A vulnerability in the boot process of Blurams Flare Camera version 24.1114.151.929 and earlier allows a physically proximate attacker to hijack the boot mecha… |
CVE-2025-37185 | Medium | 5.5 | 2026-01-14 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to conduct a stored cross… |
CVE-2025-37184 | Critical | 9.8 | 2026-01-14 | A vulnerability exists in an Orchestrator service that could allow an unauthenticated remote attacker to bypass multi-factor authentication requirements. Succe… |
CVE-2025-37183 | High | 7.2 | 2026-01-14 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection… |
CVE-2025-37182 | High | 7.2 | 2026-01-14 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection… |
CVE-2025-37181 | High | 7.2 | 2026-01-14 | Vulnerabilities in the web-based management interface of EdgeConnect SD-WAN Orchestrator could allow an authenticated remote attacker to perform SQL injection… |
CVE-2025-67399 | Medium | 4.6 | 2026-01-14 | An issue in AIRTH SMART HOME AQI MONITOR Bootloader v.1.005 allows a physically proximate attacker to obtain sensitive information via the UART port of the BK7… |
CVE-2025-14242 | Medium | 6.5 | 2026-01-14 | A flaw was found in vsftpd. This vulnerability allows a denial of service (DoS) via an integer overflow in the ls command parameter parsing, triggered by a rem… |
CVE-2025-9142 | High | 7.5 | 2026-01-14 | A local user can trigger Harmony SASE Windows client to write or delete files outside the intended certificate working directory. |
CVE-2025-71144 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: mptcp: ensure context reset on disconnect() After the blamed commit below, if the MPC sub… |
CVE-2025-71143 | High | 7.8 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: clk: samsung: exynos-clkout: Assign .num before accessing .hws Commit f316cdff8d67 ("clk… |
CVE-2025-71142 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: cpuset: fix warning when disabling remote partition A warning was triggered as follows: … |
CVE-2025-71141 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: drm/tilcdc: Fix removal actions in case of failed probe The drm_kms_helper_poll_fini() an… |
CVE-2025-71140 | | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Use spinlock for context list protection lock Previously a mutex… | |
CVE-2025-71139 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: kernel/kexec: fix IMA when allocation happens in CMA area *** Bug description *** When I… |
CVE-2025-71138 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: Add missing NULL pointer check for pingpong interface It is checked almost a… |
CVE-2025-71137 | High | 7.8 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" This patch ensures that the RX ring… |
CVE-2025-71136 | High | 7.1 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: media: adv7842: Avoid possible out-of-bounds array accesses in adv7842_cp_log_status() It… |
CVE-2025-71135 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: md/raid5: fix possible null-pointer dereferences in raid5_store_group_thread_cnt() The va… |
CVE-2025-71134 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: mm/page_alloc: change all pageblocks migrate type on coalescing When a page is freed it c… |
CVE-2025-71133 | High | 7.1 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: avoid invalid read in irdma_net_event irdma_net_event() should not dereferenc… |
CVE-2025-71132 | High | 7.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: smc91x: fix broken irq-context in PREEMPT_RT When smc91x.c is built with PREEMPT_RT, the… |
CVE-2025-71131 | High | 7.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: crypto: seqiv - Do not use req->iv after crypto_aead_encrypt As soon as crypto_aead_encry… |
CVE-2025-71130 | High | 7.8 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Zero-initialize the eb.vma array in i915_gem_do_execbuffer Initialize the e… |
CVE-2025-71129 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Sign extend kfunc call arguments The kfunc calls are native calls so they… |
CVE-2025-71128 | High | 7.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: erspan: Initialize options_len before referencing options. The struct ip_tunnel_info has… |
CVE-2025-71127 | High | 7.1 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: Discard Beacon frames to non-broadcast address Beacon frames are required… |
CVE-2025-71126 | High | 7.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: mptcp: avoid deadlock on fallback while reinjecting Jakub reported an MPTCP deadlock at f… |
CVE-2025-71125 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: tracing: Do not register unsupported perf events Synthetic events currently do not have a… |
CVE-2025-71124 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: move preempt_prepare_postamble after error check Move the call to preempt_p… |
CVE-2025-71123 | High | 7.8 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: ext4: fix string copying in parse_apply_sb_mount_options() strscpy_pad() can't be used to… |
CVE-2025-71122 | High | 7.8 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED syzkaller found it cou… |
CVE-2025-71121 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: parisc: Do not reprogram affinitiy on ASP chip The ASP chip is a very old variant of the… |
CVE-2025-71120 | High | 7.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf A z… |
CVE-2025-71119 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: powerpc/kexec: Enable SMT before waking offline CPUs If SMT is disabled or a partial SMT… |
CVE-2025-71118 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: ACPICA: Avoid walking the Namespace if start_node is NULL Although commit 0c9992315e73 ("… |
CVE-2025-71117 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: block: Remove queue freezing from several sysfs store callbacks Freezing the request queu… |
CVE-2025-71116 | Critical | 9.1 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: libceph: make decode_pool() more resilient against corrupted osdmaps If the osdmap is (ma… |
CVE-2025-71115 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: um: init cpu_tasks[] earlier This is currently done in uml_finishsetup(), but e.g. with K… |
CVE-2025-71114 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: via_wdt: fix critical boot hang due to unnamed resource allocation The VIA watchdog drive… |
CVE-2025-71113 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - zero initialize memory allocated via sock_kmalloc Several crypto user AP… |
CVE-2025-71112 | High | 8.8 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: net: hns3: add VLAN id validation before using Currently, the VLAN id may be used without… |
CVE-2025-71111 | Medium | 4.7 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (w83791d) Convert macros to functions to avoid TOCTOU The macro FAN_FROM_REG evalu… |
CVE-2025-71110 | High | 7.8 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: mm/slub: reset KASAN tag in defer_free() before accessing freed memory When CONFIG_SLUB_T… |
CVE-2025-71109 | High | 7.1 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits Since commit e4… |
CVE-2025-71108 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: Handle incorrect num_connectors capability The UCSI spec states that th… |
CVE-2025-71107 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: f2fs: ensure node page reads complete before f2fs_put_super() finishes Xfstests generic/3… |
CVE-2025-71106 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: fs: PM: Fix reverse check in filesystems_freeze_callback() The freeze_all_ptr check in fi… |
CVE-2025-71105 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: f2fs: use global inline_xattr_slab instead of per-sb slab cache As Hong Yun reported in m… |
CVE-2025-71104 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer When advan… |
CVE-2025-71103 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: drm/msm: adreno: fix deferencing ifpc_reglist when not declared On plaforms with an a7xx… |
CVE-2025-71102 | Medium | 5.5 | 2026-01-14 | In the Linux kernel, the following vulnerability has been resolved: scs: fix a wrong parameter in __scs_magic __scs_magic() needs a 'void *' variable, but a… |
CVE-2025-56226 | Medium | 5.3 | 2026-01-14 | Libsndfile <=1.2.2 contains a memory leak vulnerability in the mpeg_l3_encoder_init() function within the mpeg_l3_encode.c file. |
CVE-2025-14317 | | 2026-01-14 | In Crazy Bubble Tea mobile application authenticated attacker can obtain personal information about other users by enumerating a `loyaltyGuestId` parameter. Se… | |
CVE-2025-13175 | | 2026-01-14 | Y Soft SafeQ 6 renders the Workflow Connector password field in a way that allows an administrator with UI access to reveal the value using browser developer/i… | |
CVE-2025-67859 | | 2026-01-14 | A Improper Authentication vulnerability in TLP allows local users to arbitrarily control the power profile in use as well as the daemon’s log settings.This iss… | |
CVE-2025-66169 | Medium | 5.3 | 2026-01-14 | Cypher Injection vulnerability in Apache Camel camel-neo4j component. This issue affects Apache Camel: from 4.10.0 before 4.10.8, from 4.14.0 before 4.14.3, f… |
CVE-2025-66005 | | 2026-01-14 | Lack of authorization of the InputManager D-Bus interface in InputPlumber versions before v0.63.0 can lead to local Denial-of-Service, information leak or even… | |
CVE-2025-14338 | | 2026-01-14 | Polkit authentication dis isabled by default and a race condition in the Polkit authorization check in versions before v0.69.0 can lead to the same issues as i… | |
CVE-2025-0647 | High | 7.9 | 2026-01-14 | In certain Arm CPUs, a CPP RCTX instruction executed on one Processing Element (PE) may inhibit TLB invalidation when a TLBI is issued to the PE, either by the… |
CVE-2025-68492 | Medium | 4.2 | 2026-01-14 | Chainlit versions prior to 2.8.5 contain an authorization bypass through user-controlled key vulnerability. If this vulnerability is exploited, threads may be… |
CVE-2025-15513 | Medium | 5.3 | 2026-01-14 | The Float Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to improper error handling in the verifyFloatResponse() f… |
CVE-2025-15512 | Medium | 5.3 | 2026-01-14 | The Aplazo Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the check_success_respo… |
CVE-2025-15475 | Medium | 5.3 | 2026-01-14 | The PayHere Payment Gateway Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to an improper validation logic… |
CVE-2025-15376 | Medium | 4.3 | 2026-01-14 | The Stopwords for comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing n… |
CVE-2025-14846 | Medium | 4.3 | 2026-01-14 | The SocialChamp with WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3.5. This is due to mis… |
CVE-2025-14770 | High | 7.5 | 2026-01-14 | The Shipping Rate By Cities plugin for WordPress is vulnerable to SQL Injection via the 'city' parameter in all versions up to, and including, 2.0.0 due to ins… |
CVE-2025-14173 | Medium | 5.3 | 2026-01-14 | The Perfit WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.1. This is due to missing authoriz… |
CVE-2025-15486 | Medium | 4.4 | 2026-01-14 | The Kunze Law plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's shortcode in all versions up to, and including, 2.1 due to the plu… |
CVE-2025-15378 | High | 7.2 | 2026-01-14 | The AJS Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note_list_class' and 'popup_display_effect_in' parameters in all v… |
CVE-2025-15377 | Medium | 4.3 | 2026-01-14 | The Sosh Share Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.0. This is due to missing non… |
CVE-2025-15283 | High | 7.2 | 2026-01-14 | The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name_directory_name' and 'name_directory_description' parameters… |
CVE-2025-15266 | High | 7.2 | 2026-01-14 | The GeekyBot — Generate AI Content Without Prompt, Chatbot and Lead Generation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chat m… |
CVE-2025-15021 | Medium | 4.4 | 2026-01-14 | The Gotham Block Extra Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.5.0 d… |
CVE-2025-15020 | Medium | 6.5 | 2026-01-14 | The Gotham Block Extra Light plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.5.0 via the 'ghostban' shortcod… |
CVE-2025-14880 | Medium | 5.3 | 2026-01-14 | The Netcash WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the handle… |