2025 CVEs (page 426)
Page 426 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-21658 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: btrfs: avoid NULL pointer dereference if no valid extent tree [BUG] Syzbot reported a cra… |
CVE-2025-21657 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Replace rq_lock() to raw_spin_rq_lock() in scx_ops_bypass() scx_ops_bypass() i… |
CVE-2025-21656 | Medium | 5.5 | 2025-01-21 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (drivetemp) Fix driver producing garbage data when SCSI errors occur scsi_execute_… |
CVE-2025-0615 | Medium | 5.3 | 2025-01-21 | Input validation vulnerability in Qualifio's Wheel of Fortune. This vulnerability allows an attacker to modify an email to contain the ‘+’ symbol to access the… |
CVE-2025-0614 | Medium | 5.3 | 2025-01-21 | Input validation vulnerability in Qualifio's Wheel of Fortune. This vulnerability could allow an attacker to modify a single email to contain upper and lower c… |
CVE-2025-0450 | Medium | 6.4 | 2025-01-21 | The Betheme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom JS functionality in all versions up to, and including, 27… |
CVE-2025-23184 | Medium | 5.9 | 2025-01-21 | A potential denial of service vulnerability is present in versions of Apache CXF before 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the CachedOutputStream ins… |
CVE-2025-0371 | Medium | 6.4 | 2025-01-21 | The JetElements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 2.7.2.1 due to insu… |
CVE-2025-23086 | Medium | 6.1 | 2025-01-21 | On most desktop platforms, Brave Browser versions 1.70.x-1.73.x included a feature to show a site's origin on the OS-provided file selector dialog when a site… |
CVE-2025-24014 | Medium | 4.2 | 2025-01-20 | Vim is an open source, command line text editor. A segmentation fault was found in Vim before 9.1.1043. In silent Ex mode (-s -e), Vim typically doesn't show a… |
CVE-2025-23214 | | 2025-01-20 | Cosmos provides users the ability self-host a home server by acting as a secure gateway to your application, as well as a server manager. By monitoring the err… | |
CVE-2025-23221 | Medium | 5.4 | 2025-01-20 | Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. This vulnerability allows a user to maneuver the… |
CVE-2025-24013 | Medium | 5.3 | 2025-01-20 | CodeIgniter is a PHP full-stack web framework. Prior to 4.5.8, CodeIgniter lacked proper header validation for its name and value. The potential attacker can c… |
CVE-2025-24010 | Medium | 6.5 | 2025-01-20 | Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to defa… |
CVE-2025-23220 | Critical | 9.8 | 2025-01-20 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the We… |
CVE-2025-23219 | Critical | 9.8 | 2025-01-20 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the We… |
CVE-2025-23218 | Critical | 9.8 | 2025-01-20 | WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A SQL Injection vulnerability was identified in the We… |
CVE-2025-23044 | Medium | 6.8 | 2025-01-20 | PwnDoc is a penetration test report generator. There is no CSRF protection in pwndoc, allowing attackers to send requests on a logged-in user's behalf. This in… |
CVE-2025-22620 | Medium | 5.0 | 2025-01-20 | gitoxide is an implementation of git written in Rust. Prior to 0.17.0, gix-worktree-state specifies 0777 permissions when checking out executable files, intend… |
CVE-2025-22131 | Medium | 6.1 | 2025-01-20 | PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. Cross-Site Scripting (XSS) vulnerability in the code which translates the XLSX file… |
CVE-2025-24337 | High | 8.4 | 2025-01-20 | WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini. |
CVE-2025-21655 | High | 7.8 | 2025-01-20 | In the Linux kernel, the following vulnerability has been resolved: io_uring/eventfd: ensure io_eventfd_signal() defers another RCU period io_eventfd_do_sign… |
CVE-2025-0479 | | 2025-01-20 | This vulnerability exists in the CP Plus Router due to insecure handling of cookie flags used within its web interface. A remote attacker could exploit this vu… | |
CVE-2025-0590 | High | 7.5 | 2025-01-20 | Improper permission settings for mobile applications (com.transsion.carlcare) may lead to information leakage risk. |
CVE-2025-0586 | High | 7.2 | 2025-01-20 | The a+HRD from aEnrich Technology has an Insecure Deserialization vulnerability, allowing remote attackers with database modification privileges and regular sy… |
CVE-2025-0585 | Critical | 9.8 | 2025-01-20 | The a+HRD from aEnrich Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify… |
CVE-2025-0584 | Medium | 5.3 | 2025-01-20 | The a+HRD from aEnrich Technology has a Server-side Request Forgery, allowing unauthenticated remote attackers to exploit this vulnerability to probe internal… |
CVE-2025-0582 | Medium | 4.7 | 2025-01-20 | A vulnerability classified as critical was found in itsourcecode Farm Management System up to 1.0. This vulnerability affects unknown code of the file /add-pig… |
CVE-2025-0581 | Low | 3.5 | 2025-01-20 | A vulnerability classified as problematic has been found in CampCodes School Management Software 1.0. This affects an unknown part of the file /chat/group/send… |
CVE-2025-0580 | Medium | 5.6 | 2025-01-20 | A vulnerability was found in Shiprocket Module 3 on OpenCart. It has been rated as critical. Affected by this issue is some unknown functionality of the file /… |
CVE-2025-0579 | High | 7.3 | 2025-01-20 | A vulnerability was found in Shiprocket Module 3/4 on OpenCart. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-0583 | Medium | 6.1 | 2025-01-20 | The a+HRD from aEnrich Technology has a Reflected Cross-site Scripting vulnerability, allowing unauthenticated remote attackers to execute arbitrary JavaScript… |
CVE-2025-0578 | Low | 3.5 | 2025-01-20 | A vulnerability was found in Facile Sistemas Cloud Apps up to 20250107. It has been classified as problematic. Affected is an unknown function of the file /acc… |
CVE-2025-0576 | Medium | 4.3 | 2025-01-20 | A vulnerability was found in Mobotix M15 4.3.4.83 and classified as problematic. This issue affects some unknown processing of the file /control/player?center&… |
CVE-2025-0575 | Low | 3.9 | 2025-01-19 | A vulnerability has been found in Union Bank of India Vyom 8.0.34 on Android and classified as problematic. This vulnerability affects unknown code of the comp… |
CVE-2025-21654 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: ovl: support encoding fid from inode with no alias Dmitry Safonov reported that a WARN_ON… |
CVE-2025-21653 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute syzbot found that TCA_FLOW_RSHIFT… |
CVE-2025-21652 | High | 7.8 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: ipvlan: Fix use-after-free in ipvlan_get_iflink(). syzbot presented an use-after-free rep… |
CVE-2025-21651 | Medium | 4.7 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: net: hns3: don't auto enable misc vector Currently, there is a time window between misc i… |
CVE-2025-21650 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: net: hns3: fixed hclge_fetch_pf_reg accesses bar space out of bounds issue The TQP BAR sp… |
CVE-2025-21649 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: net: hns3: fix kernel crash when 1588 is sent on HIP08 devices Currently, HIP08 devices d… |
CVE-2025-21648 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: clamp maximum hashtable size to INT_MAX Use INT_MAX as maximum size… |
CVE-2025-21647 | High | 7.3 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: sched: sch_cake: add bounds checks to host bulk flow fairness counts Even though we fixed… |
CVE-2025-21646 | High | 7.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: afs: Fix the maximum cell name length The kafs filesystem limits the maximum length of a… |
CVE-2025-21645 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Only disable IRQ1 wakeup where i8042 actually enabled it Wakeup for… |
CVE-2025-21644 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix tlb invalidation when wedging If GuC fails to load, the driver wedges, but in… |
CVE-2025-21643 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: netfs: Fix kernel async DIO Netfslib needs to be able to handle kernel-initiated asynchro… |
CVE-2025-21642 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: mptcp: sysctl: sched: avoid using current->nsproxy Using the 'net' structure via 'current… |
CVE-2025-21641 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: mptcp: sysctl: blackhole timeout: avoid using current->nsproxy As mentioned in the previo… |
CVE-2025-21640 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy As mentioned in a previous co… |
CVE-2025-21639 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: rto_min/max: avoid using current->nsproxy As mentioned in a previous commit… |
CVE-2025-21638 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: auth_enable: avoid using current->nsproxy As mentioned in a previous commit… |
CVE-2025-21637 | High | 7.1 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: udp_port: avoid using current->nsproxy As mentioned in a previous commit of… |
CVE-2025-21636 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy As mentioned in a prev… |
CVE-2025-21635 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current->nsproxy As mentioned in a previou… |
CVE-2025-21634 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: remove kernfs active break A warning was found: WARNING: CPU: 10 PID: 348… |
CVE-2025-21632 | Medium | 5.5 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Ensure shadow stack is active before "getting" registers The x86 shadow stack su… |
CVE-2025-21631 | High | 7.8 | 2025-01-19 | In the Linux kernel, the following vulnerability has been resolved: block, bfq: fix waker_bfqq UAF after bfq_split_bfqq() Our syzkaller report a following UA… |
CVE-2025-0567 | Medium | 4.5 | 2025-01-19 | A vulnerability classified as problematic was found in Epic Games Launcher up to 17.2.1. This vulnerability affects unknown code in the library profapi.dll of… |
CVE-2025-0566 | High | 8.8 | 2025-01-19 | A vulnerability classified as critical has been found in Tenda AC15 15.13.07.13. This affects the function formSetDevNetName of the file /goform/SetDevNetName… |
CVE-2025-0565 | High | 7.3 | 2025-01-19 | A vulnerability was found in ZZCMS 2023. It has been rated as critical. Affected by this issue is some unknown functionality of the file /index.php. The manipu… |
CVE-2025-0564 | High | 7.3 | 2025-01-19 | A vulnerability was found in code-projects Fantasy-Cricket 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of… |
CVE-2025-0563 | Medium | 6.3 | 2025-01-19 | A vulnerability was found in code-projects Fantasy-Cricket 1.0. It has been classified as critical. Affected is an unknown function of the file /dash/update.ph… |
CVE-2025-0562 | Medium | 6.3 | 2025-01-19 | A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /dashboard/a… |
CVE-2025-0561 | Medium | 6.3 | 2025-01-19 | A vulnerability has been found in itsourcecode Farm Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /add-… |
CVE-2025-0560 | Low | 2.4 | 2025-01-18 | A vulnerability, which was classified as problematic, was found in CampCodes School Management Software 1.0. Affected is an unknown function of the file /photo… |
CVE-2025-0559 | Low | 2.4 | 2025-01-18 | A vulnerability, which was classified as problematic, has been found in Campcodes School Management Software 1.0. This issue affects some unknown processing of… |
CVE-2025-0558 | Medium | 6.3 | 2025-01-18 | A vulnerability classified as critical was found in TDuckCloud tduck-platform up to 4.0. This vulnerability affects the function QueryProThemeRequest of the fi… |
CVE-2025-0557 | Medium | 4.3 | 2025-01-18 | A vulnerability classified as problematic has been found in Hyland Alfresco Community Edition and Alfresco Enterprise Edition up to 6.2.2. This affects an unkn… |
CVE-2025-0515 | Medium | 4.3 | 2025-01-18 | The Buzz Club – Night Club, DJ and Music Festival Event WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data that can lead to… |
CVE-2025-0369 | Medium | 6.4 | 2025-01-18 | The JetEngine plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘list_tag’ parameter in all versions up to, and including, 3.6.2 due to… |
CVE-2025-0554 | Medium | 4.4 | 2025-01-18 | The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Feed Name value in version <= 4.1.25 due to insufficien… |
CVE-2025-0318 | Medium | 5.3 | 2025-01-18 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Inform… |
CVE-2025-0308 | High | 7.5 | 2025-01-18 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to time-b… |
CVE-2025-23209 | High | 8.0 | 2025-01-18 | Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. This is an remote code execution (RCE) vulnerability that… |
CVE-2025-23208 | High | 7.3 | 2025-01-17 | zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database (meta.db) is an append-list so group revoca… |
CVE-2025-23207 | Medium | 6.3 | 2025-01-17 | KaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. KaTeX users who render untrusted mathematical expressions with `renderToStri… |
CVE-2025-0541 | Medium | 6.3 | 2025-01-17 | A vulnerability was found in Codezips Gym Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /dashboard/a… |
CVE-2025-23206 | High | 8.1 | 2025-01-17 | The AWS Cloud Development Kit (AWS CDK) is an open-source software development framework to define cloud infrastructure in code and provision it through AWS Cl… |
CVE-2025-23205 | | 2025-01-17 | nbgrader is a system for assigning and grading notebooks. Enabling frame-ancestors: 'self' grants any JupyterHub user the ability to extract formgrader content… | |
CVE-2025-23202 | | 2025-01-17 | Bible Module is a tool designed for ROBLOX developers to integrate Bible functionality into their games. The `FetchVerse` and `FetchPassage` functions in the B… | |
CVE-2025-23039 | Medium | 5.2 | 2025-01-17 | Caido is a web security auditing toolkit. A Cross-Site Scripting (XSS) vulnerability was identified in Caido v0.45.0 due to improper sanitization in the URL de… |
CVE-2025-21606 | | 2025-01-17 | stats is a macOS system monitor in for the menu bar. The Stats application is vulnerable to a local privilege escalation due to the insecure implementation of… | |
CVE-2025-0540 | Medium | 6.3 | 2025-01-17 | A vulnerability has been found in itsourcecode Tailoring Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file… |
CVE-2025-0538 | Low | 3.5 | 2025-01-17 | A vulnerability, which was classified as problematic, was found in code-projects Tourism Management System 1.0. Affected is an unknown function of the file /ad… |
CVE-2025-21399 | High | 7.4 | 2025-01-17 | Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability |
CVE-2025-21185 | Medium | 6.5 | 2025-01-17 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2025-0537 | Low | 2.4 | 2025-01-17 | A vulnerability, which was classified as problematic, has been found in code-projects Car Rental Management System 1.0. This issue affects some unknown process… |
CVE-2025-0536 | Medium | 6.3 | 2025-01-17 | A vulnerability classified as critical was found in 1000 Projects Attendance Tracking Management System 1.0. This vulnerability affects unknown code of the fil… |
CVE-2025-0535 | Medium | 6.3 | 2025-01-17 | A vulnerability classified as critical has been found in Codezips Gym Management System 1.0. This affects an unknown part of the file /dashboard/admin/edit_mem… |
CVE-2025-0534 | High | 7.3 | 2025-01-17 | A vulnerability was found in 1000 Projects Campaign Management System Platform for Women 1.0. It has been rated as critical. Affected by this issue is some unk… |
CVE-2025-0533 | High | 7.3 | 2025-01-17 | A vulnerability was found in 1000 Projects Campaign Management System Platform for Women 1.0. It has been declared as critical. Affected by this vulnerability… |
CVE-2025-0532 | Medium | 6.3 | 2025-01-17 | A vulnerability was found in Codezips Gym Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /dashboard/adm… |
CVE-2025-0430 | High | 7.5 | 2025-01-17 | Belledonne Communications Linphone-Desktop is vulnerable to a NULL Dereference vulnerability, which could allow a remote attacker to create a denial-of-servi… |
CVE-2025-0531 | Medium | 6.3 | 2025-01-17 | A vulnerability was found in code-projects Chat System 1.0 and classified as critical. This issue affects some unknown processing of the file /user/leaveroom.p… |
CVE-2025-0530 | Low | 3.5 | 2025-01-17 | A vulnerability has been found in code-projects Job Recruitment 1.0 and classified as problematic. This vulnerability affects unknown code of the file /_parse/… |
CVE-2025-0529 | Medium | 5.3 | 2025-01-17 | A vulnerability, which was classified as critical, was found in code-projects Train Ticket Reservation System 1.0. This affects an unknown part of the componen… |
CVE-2025-0528 | High | 7.2 | 2025-01-17 | A vulnerability, which was classified as critical, has been found in Tenda AC8, AC10 and AC18 16.03.10.20. Affected by this issue is some unknown functionality… |
CVE-2025-0527 | High | 7.3 | 2025-01-17 | A vulnerability classified as critical was found in code-projects Admission Management System 1.0. Affected by this vulnerability is an unknown functionality o… |
CVE-2025-21325 | High | 7.8 | 2025-01-17 | Windows Secure Kernel Mode Elevation of Privilege Vulnerability |