2025 CVEs (page 43)
Page 43 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-68774 | High | 7.5 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix missing hfs_bnode_get() in __hfs_bnode_create When sync() and link() are cal… |
CVE-2025-68773 | | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: spi: fsl-cpm: Check length parity before switching to 16 bit mode Commit fc96ec826bce ("s… | |
CVE-2025-68772 | | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid updating compression context during writeback Bai, Shuangpeng <sjb7183… | |
CVE-2025-68771 | | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix kernel BUG in ocfs2_find_victim_chain syzbot reported a kernel BUG in ocfs2_fi… | |
CVE-2025-68770 | High | 7.5 | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix XDP_TX path For XDP_TX action in bnxt_rx_xdp(), clearing of the event flags… |
CVE-2025-68769 | | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: f2fs: fix return value of f2fs_recover_fsync_data() With below scripts, it will trigger p… | |
CVE-2025-68768 | | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: inet: frags: flush pending skbs in fqdir_pre_exit() We have been seeing occasional deadlo… | |
CVE-2025-68767 | | 2026-01-13 | In the Linux kernel, the following vulnerability has been resolved: hfsplus: Verify inode mode when loading from disk syzbot is reporting that S_IFMT bits of… | |
CVE-2025-66698 | High | 8.6 | 2026-01-13 | An issue in Semantic machines v5.4.8 allows attackers to bypass authentication via sending a crafted HTTP request to various API endpoints. |
CVE-2025-65783 | Critical | 9.8 | 2026-01-13 | An arbitrary file upload vulnerability in the /utils/uploadFile component of Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allows attackers to execute ar… |
CVE-2025-12548 | Critical | 9.0 | 2026-01-13 | A flaw was found in Eclipse Che che-machine-exec. This vulnerability allows unauthenticated remote arbitrary command execution and secret exfiltration (SSH key… |
CVE-2025-55462 | Medium | 6.5 | 2026-01-13 | A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-A… |
CVE-2025-36640 | High | 8.8 | 2026-01-13 | A vulnerability has been identified in the installation/uninstallation of the Nessus Agent Tray App on Windows Hosts which could lead to escalation of privileg… |
CVE-2025-13447 | High | 8.4 | 2026-01-13 | OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions… |
CVE-2025-13444 | High | 8.4 | 2026-01-13 | OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions… |
CVE-2025-9435 | Medium | 5.5 | 2026-01-13 | Zohocorp ManageEngine ADManager Plus versions below 7230 are vulnerable to Path Traversal in the User Management module |
CVE-2025-9427 | | 2026-01-13 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Lemonsoft WordPress add on allows Cross-Site Scrip… | |
CVE-2025-14507 | Medium | 5.3 | 2026-01-13 | The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includin… |
CVE-2025-11669 | High | 8.1 | 2026-01-13 | Zohocorp ManageEngine PAM360 versions before 8202; Password Manager Pro versions before 13221; Access Manager Plus versions prior to 4401 are vulnerable to an… |
CVE-2025-11250 | Critical | 9.1 | 2026-01-13 | Zohocorp ManageEngine ADSelfService Plus versions before 6519 are vulnerable to Authentication Bypass due to improper filter configurations. |
CVE-2025-13774 | High | 8.8 | 2026-01-13 | A vulnerability exists in Progress Flowmon ADS versions prior to 12.5.4 and 13.0.1 where an SQL injection vulnerability allows authenticated users to execute u… |
CVE-2025-59022 | High | 8.1 | 2026-01-13 | Backend users who had access to the recycler module could delete arbitrary data from any database table defined in the TCA - regardless of whether they had per… |
CVE-2025-59021 | Medium | 6.4 | 2026-01-13 | Backend users with access to the redirects module and write permission on the sys_redirect table were able to read, create, and modify any redirect record with… |
CVE-2025-59020 | Medium | 6.5 | 2026-01-13 | By exploiting the defVals parameter, attackers could bypass field‑level access checks during record creation in the TYPO3 backend. This gave them the ability t… |
CVE-2025-14001 | Medium | 5.4 | 2026-01-13 | The WP Duplicate Page plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'duplicateBulkHandle' and… |
CVE-2025-40944 | High | 7.5 | 2026-01-13 | A vulnerability has been identified in SIMATIC ET 200AL IM 157-1 PN (6ES7157-1AB00-0AB0) (All versions), SIMATIC ET 200MP IM 155-5 PN HF (6ES7155-5AA00-0AC0) (… |
CVE-2025-40942 | High | 8.8 | 2026-01-13 | A vulnerability has been identified in TeleControl Server Basic (All versions < V3.1.2.4). Affected application contains a local privilege escalation vulnerabi… |
CVE-2025-40805 | Critical | 10.0 | 2026-01-13 | Affected devices do not properly enforce user authentication on specific API endpoints. This could facilitate an unauthenticated remote attacker to circumvent… |
CVE-2025-41717 | High | 8.8 | 2026-01-13 | An unauthenticated remote attacker can trick a high privileged user into uploading a malicious payload via the config-upload endpoint, leading to code injectio… |
CVE-2025-14829 | Critical | 9.1 | 2026-01-13 | The E-xact | Hosted Payment | WordPress plugin through 2.0 is vulnerable to arbitrary file deletion due to insufficient file path validation. This makes it pos… |
CVE-2025-10915 | Critical | 9.8 | 2026-01-13 | The Dreamer Blog WordPress theme through 1.2 is vulnerable to arbitrary installations due to a missing capability check. |
CVE-2025-66177 | High | 8.8 | 2026-01-13 | There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision NVR/DVR/CVR/IPC models. If exploited, an attacker on the same… |
CVE-2025-66176 | High | 8.8 | 2026-01-13 | There is a Buffer overflow Vulnerability in the device Search and Discovery feature of Hikvision Access Control Products. If exploited, an attacker on the same… |
CVE-2025-15514 | High | 7.5 | 2026-01-12 | Ollama 0.11.5-rc0 through current version 0.13.5 contain a null pointer dereference vulnerability in the multi-modal model image processing functionality. When… |
CVE-2025-67146 | Critical | 9.4 | 2026-01-12 | Multiple SQL Injection vulnerabilities exist in AbhishekMali21 GYM-MANAGEMENT-SYSTEM 1.0 via the 'name' parameter in (1) member_search.php, (2) trainer_search… |
CVE-2025-29329 | Critical | 9.8 | 2026-01-12 | Buffer Overflow in the ippprint (Internet Printing Protocol) service in Sagemcom F@st 3686 MAGYAR_4.121.0 allows remote attacker to execute arbitrary code by s… |
CVE-2025-12420 | Critical | 9.8 | 2026-01-12 | A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operati… |
CVE-2025-67147 | Critical | 9.8 | 2026-01-12 | Multiple SQL Injection vulnerabilities exist in amansuryawanshi Gym-Management-System-PHP 1.0 via the 'name', 'email', and 'comment' parameters in (1) submit_c… |
CVE-2025-66802 | Critical | 9.8 | 2026-01-12 | Sourcecodester Covid-19 Contact Tracing System 1.0 is vulnerable to RCE (Remote Code Execution). The application receives a reverse shell (php) into imagem of… |
CVE-2025-51567 | Critical | 9.1 | 2026-01-12 | A SQL Injection was found in the /exam/user/profile.php page of kashipara Online Exam System V1.0, which allows remote attackers to execute arbitrary SQL comma… |
CVE-2025-68657 | Medium | 6.4 | 2026-01-12 | Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, calls to hid_host_device_close() can free the same… |
CVE-2025-68656 | Medium | 6.8 | 2026-01-12 | Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, usb_class_request_get_descriptor() frees and reall… |
CVE-2025-68471 | Medium | 6.5 | 2026-01-12 | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashe… |
CVE-2025-68468 | Medium | 6.5 | 2026-01-12 | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, avahi-daemon can be crashe… |
CVE-2025-68276 | Medium | 5.5 | 2026-01-12 | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local user… |
CVE-2025-68622 | Medium | 6.8 | 2026-01-12 | Espressif ESP-IDF USB Host UVC Class Driver allows video streaming from USB cameras. Prior to 2.4.0, a vulnerability in the esp-usb UVC host implementation all… |
CVE-2025-68472 | High | 8.1 | 2026-01-12 | MindsDB is a platform for building artificial intelligence from enterprise data. Prior to version 25.11.1, an unauthenticated path traversal in the file upload… |
CVE-2025-66689 | Medium | 6.5 | 2026-01-12 | A path traversal vulnerability exists in Zen MCP Server before 9.8.2 that allows authenticated attackers to read arbitrary files on the system. The vulnerabili… |
CVE-2025-63314 | Critical | 10.0 | 2026-01-12 | A static password reset token in the password reset function of DDSN Interactive Acora CMS v10.7.1 allows attackers to arbitrarily reset the user password and… |
CVE-2025-46070 | Critical | 9.8 | 2026-01-12 | An issue in Automai BotManager v.25.2.0 allows a remote attacker to execute arbitrary code via the BotManager.exe component |
CVE-2025-46068 | High | 8.8 | 2026-01-12 | An issue in Automai Director v.25.2.0 allows a remote attacker to execute arbitrary code via the update mechanism |
CVE-2025-46067 | High | 8.2 | 2026-01-12 | An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges and obtain sensitive information via a crafted js file |
CVE-2025-46066 | Critical | 9.9 | 2026-01-12 | An issue in Automai Director v.25.2.0 allows a remote attacker to escalate privileges |
CVE-2025-71063 | High | 8.2 | 2026-01-12 | Errands before 46.2.10 does not verify TLS certificates for CalDAV servers. |
CVE-2025-67813 | Medium | 5.3 | 2026-01-12 | Quest KACE Desktop Authority through 11.3.1 has Insecure Permissions on the Named Pipes used for inter-process communication |
CVE-2025-66939 | Medium | 5.4 | 2026-01-12 | Cross Site Scripting vulnerability in 66biolinks by AltumCode v.61.0.1 allows an attacker to execute arbitrary code via a crafted favicon file |
CVE-2025-65553 | Medium | 6.5 | 2026-01-12 | D3D Wi-Fi Home Security System ZX-G12 v2.1.17 is susceptible to RF jamming on the 433 MHz alarm sensor channel. An attacker within RF range can transmit contin… |
CVE-2025-65552 | Critical | 9.8 | 2026-01-12 | D3D Wi-Fi Home Security System ZX-G12 v2.1.1 is vulnerable to RF replay attacks on the 433 MHz sensor communication channel. The system does not implement roll… |
CVE-2025-41078 | High | 8.1 | 2026-01-12 | Weaknesses in the authorization mechanisms of Viafirma Documents v3.7.129 allow an authenticated user without privileges to list and access other user data, us… |
CVE-2025-41077 | High | 8.1 | 2026-01-12 | IDOR vulnerability has been found in Viafirma Inbox v4.5.13 that allows any authenticated user without privileges in the application to list all users, access… |
CVE-2025-41006 | | 2026-01-12 | Imaster's MEMS Events CRM contains an SQL injection vulnerability in ‘phone’ parameter in ‘/memsdemo/login.php’. | |
CVE-2025-41005 | | 2026-01-12 | Imaster's MEMS Events CRM contains an SQL injection vulnerability in‘keyword’ parameter in ‘/memsdemo/exchange_offers.php’. | |
CVE-2025-41004 | | 2026-01-12 | Imaster's Patient Records Management System is vulnerable to SQL Injection in the endpoint ‘/projects/hospital/admin/complaints.php’ through the ‘id’ parameter. | |
CVE-2025-41003 | | 2026-01-12 | Imaster's Patient Record Management System contains a stored Cross-Site Scripting (XSS) vulnerability in the endpoint ‘/projects/hospital/admin/edit_patient.ph… | |
CVE-2025-40978 | | 2026-01-12 | Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's eCommerceGo SaaS, consisting of a stored XSS due to a lack of proper validation of user input by se… | |
CVE-2025-40977 | | 2026-01-12 | Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's eCommerceGo SaaS, consisting of a lack of proper validation of user input by sending a POST request… | |
CVE-2025-40976 | | 2026-01-12 | Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's TicketGo, consisting of a lack of proper validation of user input by sending a POST request to ‘/ti… | |
CVE-2025-40975 | | 2026-01-12 | Stored Cross-Site Scripting (XSS) vulnerability in WorkDo's HRMGo, consisting of a lack of proper validation of user input by sending a POST request to ‘/hrmgo… | |
CVE-2025-14279 | High | 8.1 | 2026-01-12 | MLFlow versions up to and including 3.4.0 are vulnerable to DNS rebinding attacks due to a lack of Origin header validation in the MLFlow REST server. This vul… |
CVE-2025-14579 | Medium | 4.8 | 2026-01-12 | The Quiz Maker WordPress plugin before 6.7.0.89 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2025-69276 | High | 8.8 | 2026-01-12 | Deserialization of Untrusted Data vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Object Injection.This issue affects DX NetOps Spectrum… |
CVE-2025-69275 | Medium | 6.1 | 2026-01-12 | Dependency on Vulnerable Third-Party Component vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows DOM-Based XSS.This issue affects DX NetOps… |
CVE-2025-69274 | High | 8.8 | 2026-01-12 | Authorization Bypass Through User-Controlled Key vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Privilege Escalation.This issue affects… |
CVE-2025-69273 | High | 7.5 | 2026-01-12 | Improper Authentication vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Authentication Bypass.This issue affects DX NetOps Spectrum: 24.3… |
CVE-2025-69272 | High | 7.5 | 2026-01-12 | Cleartext Transmission of Sensitive Information vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Sniffing Attacks.This issue affects DX Ne… |
CVE-2025-69271 | High | 7.5 | 2026-01-12 | Insufficiently Protected Credentials vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Sniffing Attacks.This issue affects DX NetOps Spectr… |
CVE-2025-69270 | Critical | 9.8 | 2026-01-12 | Information Exposure Through Query Strings in GET Request vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Session Hijacking.This issue af… |
CVE-2025-69269 | Critical | 9.8 | 2026-01-12 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allow… |
CVE-2025-69268 | Medium | 6.1 | 2026-01-12 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allo… |
CVE-2025-69267 | Medium | 6.5 | 2026-01-12 | Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in Broadcom DX NetOps Spectrum on Windows, Linux allows Path Travers… |
CVE-2025-52694 | Critical | 10.0 | 2026-01-12 | Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable s… |
CVE-2025-68493 | High | 8.1 | 2026-01-11 | Missing XML Validation vulnerability in Apache Struts, Apache Struts. This issue affects Apache Struts: from 2.0.0 before 2.2.1; Apache Struts: from 2.2.1 thr… |
CVE-2025-15506 | Low | 3.3 | 2026-01-11 | A vulnerability was found in AcademySoftwareFoundation OpenColorIO up to 2.5.0. This issue affects the function ConvertToRegularExpression of the file src/Open… |
CVE-2025-15505 | Low | 2.4 | 2026-01-11 | A vulnerability was found in Luxul XWR-600 up to 4.0.1. The affected element is an unknown function of the component Web Administration Interface. The manipula… |
CVE-2025-13393 | Medium | 4.3 | 2026-01-10 | The Featured Image from URL (FIFU) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.3.1. This is due t… |
CVE-2025-12379 | Medium | 6.4 | 2026-01-10 | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a combination of the 'tag' and ‘title_t… |
CVE-2025-14555 | Medium | 6.4 | 2026-01-10 | The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpdevart_countdown' shortcode in all… |
CVE-2025-15504 | Low | 3.3 | 2026-01-10 | A security flaw has been discovered in lief-project LIEF up to 0.17.1. Affected by this issue is the function Parser::parse_binary of the file src/ELF/Parser.t… |
CVE-2025-14506 | Medium | 6.4 | 2026-01-10 | The ConvertForce Popup Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gutenberg block's `entrance_animation` attribute in al… |
CVE-2025-62235 | High | 8.1 | 2026-01-10 | Authentication Bypass by Spoofing vulnerability in Apache NimBLE. Receiving specially crafted Security Request could lead to removal of original bond and re-b… |
CVE-2025-53477 | High | 7.5 | 2026-01-10 | NULL Pointer Dereference vulnerability in Apache Nimble. Missing validation of HCI connection complete or HCI command TX buffer could lead to NULL pointer der… |
CVE-2025-53470 | Low | 3.1 | 2026-01-10 | Out-of-bounds Read vulnerability in Apache NimBLE HCI H4 driver. Specially crafted HCI event could lead to invalid memory read in H4 driver. This issue affec… |
CVE-2025-52435 | High | 7.5 | 2026-01-10 | J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE. Improper handling of Pause Encryption procedure on Link Layer resu… |
CVE-2025-15503 | High | 7.3 | 2026-01-10 | A security flaw has been discovered in Sangfor Operation and Maintenance Management System up to 3.0.8. The impacted element is an unknown function of the file… |
CVE-2025-14976 | Medium | 5.4 | 2026-01-10 | The User Registration & Membership – Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin plugin for Word… |
CVE-2025-15502 | High | 7.3 | 2026-01-10 | A vulnerability was identified in Sangfor Operation and Maintenance Management System up to 3.0.8. The affected element is the function SessionController of th… |
CVE-2025-14948 | Medium | 5.3 | 2026-01-10 | The miniOrange OTP Verification and SMS Notification for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing c… |
CVE-2025-14943 | Medium | 4.3 | 2026-01-10 | The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including… |
CVE-2025-65091 | Critical | 10.0 | 2026-01-10 | XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.5, users with the right to view the Calendar.JSONService page (i… |
CVE-2025-65090 | Medium | 5.3 | 2026-01-10 | XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.6, users with the rights to view the Calendar.JSONService page (… |