2025 CVEs (page 430)
Page 430 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-22736 | High | 8.8 | 2025-01-15 | Incorrect Privilege Assignment vulnerability in Saad Iqbal User Management user-management allows Privilege Escalation.This issue affects User Management: from… |
CVE-2025-22734 | Medium | 5.9 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Data443 Risk Mitigation, Inc. Posts Footer Manager intell… |
CVE-2025-22731 | Medium | 4.3 | 2025-01-15 | Cross-Site Request Forgery (CSRF) vulnerability in silverplugins217 Build Private Store For Woocommerce build-private-store-for-woocommerce allows Cross Site R… |
CVE-2025-22729 | Medium | 4.3 | 2025-01-15 | Missing Authorization vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-22724 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MojofyWP Product Carousel For WooCommerce – WoorouSell al… |
CVE-2025-22587 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atanas Krachev SEO Bulk Editor seo-bulk-editor allows Sto… |
CVE-2025-22346 | Medium | 6.4 | 2025-01-15 | Server-Side Request Forgery (SSRF) vulnerability in Faizaan Gagan Course Migration for LearnDash allows Server Side Request Forgery.This issue affects Course M… |
CVE-2025-22329 | Medium | 6.5 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Agile Logix Free Google Maps wp-map allows Stored XSS.Thi… |
CVE-2025-22317 | High | 7.1 | 2025-01-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gallery Ape Photo Gallery – Image Gallery by Ape gallery-… |
CVE-2025-21088 | Medium | 6.5 | 2025-01-15 | Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate the style of proto supplied to an action's… |
CVE-2025-21629 | High | 8.2 | 2025-01-15 | In the Linux kernel, the following vulnerability has been resolved: net: reenable NETIF_F_IPV6_CSUM offload for BIG TCP packets The blamed commit disabled ha… |
CVE-2025-0448 | Medium | 4.3 | 2025-01-15 | Inappropriate implementation in Compositing in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (… |
CVE-2025-0447 | High | 8.8 | 2025-01-15 | Inappropriate implementation in Navigation in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to perform privilege escalation via a crafted HTML… |
CVE-2025-0446 | Medium | 4.3 | 2025-01-15 | Inappropriate implementation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2025-0443 | High | 8.8 | 2025-01-15 | Insufficient data validation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2025-0442 | Medium | 6.5 | 2025-01-15 | Inappropriate implementation in Payments in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestur… |
CVE-2025-0441 | Medium | 6.5 | 2025-01-15 | Inappropriate implementation in Fenced Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to obtain potentially sensitive information fro… |
CVE-2025-0440 | Medium | 6.5 | 2025-01-15 | Inappropriate implementation in Fullscreen in Google Chrome on Windows prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HT… |
CVE-2025-0439 | Medium | 6.5 | 2025-01-15 | Race in Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing… |
CVE-2025-0438 | High | 8.8 | 2025-01-15 | Stack buffer overflow in Tracing in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit stack corruption via a crafted HTML p… |
CVE-2025-0437 | High | 8.8 | 2025-01-15 | Out of bounds read in Metrics in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2025-0436 | High | 8.8 | 2025-01-15 | Integer overflow in Skia in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2025-0435 | Medium | 6.5 | 2025-01-15 | Inappropriate implementation in Navigation in Google Chrome on Android prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HT… |
CVE-2025-0434 | High | 8.8 | 2025-01-15 | Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2025-0193 | | 2025-01-15 | A stored Cross-site Scripting (XSS) vulnerability exists in the MGate 5121/5122/5123 Series firmware version v1.0 because of insufficient sanitization and enco… | |
CVE-2025-0356 | High | 7.2 | 2025-01-15 | NEC Corporation Aterm WX1500HP Ver.1.4.2 and earlier and WX3600HP Ver.1.5.3 and earlier allows a attacker to execute arbitrary OS commands via the network. |
CVE-2025-0355 | High | 7.5 | 2025-01-15 | Missing Authentication for Critical Function vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WF1200CRS Ver.1.6.0 and earlier, WG1200CRS… |
CVE-2025-0354 | Medium | 4.8 | 2025-01-15 | Cross-site scripting vulnerability in NEC Corporation Aterm WG2600HS Ver.1.7.2 and earlier, WG2600HP4 Ver.1.4.2 and earlier, WG2600HM4 Ver.1.4.2 and earlier, W… |
CVE-2025-23061 | Critical | 9.0 | 2025-01-15 | Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection. NOTE: this issue exists because of an inc… |
CVE-2025-22394 | Medium | 6.7 | 2025-01-15 | Dell Display Manager, versions prior to 2.3.2.18, contain a Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability. A low privileged attacker with loc… |
CVE-2025-21101 | Medium | 6.6 | 2025-01-15 | Dell Display Manager, versions prior to 2.3.2.20, contain a race condition vulnerability. A local malicious user could potentially exploit this vulnerability d… |
CVE-2025-23013 | | 2025-01-15 | In Yubico pam-u2f before 1.3.1, local privilege escalation can sometimes occur. This product implements a Pluggable Authentication Module (PAM) that can be dep… | |
CVE-2025-0343 | High | 7.5 | 2025-01-15 | Swift ASN.1 can be caused to crash when parsing certain BER/DER constructions. This crash is caused by a confusion in the ASN.1 library itself which assumes th… |
CVE-2025-22997 | Medium | 4.8 | 2025-01-15 | A stored cross-site scripting (XSS) vulnerability in the prf_table_content component of Linksys E5600 Router Ver. 1.1.0.26 allows attackers to execute arbitrar… |
CVE-2025-22996 | Medium | 4.8 | 2025-01-15 | A stored cross-site scripting (XSS) vulnerability in the spf_table_content component of Linksys E5600 Router Ver. 1.1.0.26 allows attackers to execute arbitrar… |
CVE-2025-23019 | Medium | 5.4 | 2025-01-14 | IPv6-in-IPv4 tunneling (RFC 4213) allows an attacker to spoof and route traffic via an exposed network interface. |
CVE-2025-23018 | Medium | 5.4 | 2025-01-14 | IPv4-in-IPv6 and IPv6-in-IPv6 tunneling (RFC 2473) do not require the validation or verification of the source of a network packet, allowing an attacker to spo… |
CVE-2025-21139 | High | 7.8 | 2025-01-14 | Substance3D - Designer versions 14.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in th… |
CVE-2025-21138 | High | 7.8 | 2025-01-14 | Substance3D - Designer versions 14.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-21137 | High | 7.8 | 2025-01-14 | Substance3D - Designer versions 14.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in th… |
CVE-2025-21136 | High | 7.8 | 2025-01-14 | Substance3D - Designer versions 14.0 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the cont… |
CVE-2025-21135 | High | 7.8 | 2025-01-14 | Animate versions 24.0.6, 23.0.9 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code executi… |
CVE-2025-23074 | Low | 2.4 | 2025-01-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - SocialProfile Extension allows Functionality Misus… |
CVE-2025-23073 | Low | 3.5 | 2025-01-14 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - GlobalBlocking Extension allows Retrieve Embedded… |
CVE-2025-23072 | Medium | 5.4 | 2025-01-14 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - RefreshSpecial Ex… |
CVE-2025-23042 | High | 7.5 | 2025-01-14 | Gradio is an open-source Python package that allows quick building of demos and web application for machine learning models, API, or any arbitrary Python funct… |
CVE-2025-23041 | Medium | 5.8 | 2025-01-14 | Umbraco.Forms is a web form framework written for the nuget ecosystem. Character limits configured by editors for short and long answer fields are validated on… |
CVE-2025-21134 | High | 7.8 | 2025-01-14 | Illustrator on iPad versions 3.0.7 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code exec… |
CVE-2025-21133 | High | 7.8 | 2025-01-14 | Illustrator on iPad versions 3.0.7 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code exec… |
CVE-2025-21132 | High | 7.8 | 2025-01-14 | Substance3D - Stager versions 3.0.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2025-21131 | High | 7.8 | 2025-01-14 | Substance3D - Stager versions 3.0.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2025-21130 | High | 7.8 | 2025-01-14 | Substance3D - Stager versions 3.0.4 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the conte… |
CVE-2025-21129 | High | 7.8 | 2025-01-14 | Substance3D - Stager versions 3.0.4 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the… |
CVE-2025-21128 | High | 7.8 | 2025-01-14 | Substance3D - Stager versions 3.0.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in th… |
CVE-2025-21127 | High | 7.8 | 2025-01-14 | Photoshop Desktop versions 25.12, 26.1 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could lead to arbitrary code executio… |
CVE-2025-21122 | High | 7.8 | 2025-01-14 | Photoshop Desktop versions 25.12, 26.1 and earlier are affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in arbitrary code… |
CVE-2025-0474 | High | 7.7 | 2025-01-14 | Invoice Ninja is vulnerable to authenticated Server-Side Request Forgery (SSRF) allowing for arbitrary file read and network resource requests as the applicati… |
CVE-2025-23366 | Medium | 6.5 | 2025-01-14 | A flaw was found in the HAL Console in the Wildfly component, which does not neutralize or incorrectly neutralizes user-controllable input before it is placed… |
CVE-2025-23052 | High | 7.2 | 2025-01-14 | Authenticated command injection vulnerability in the command line interface of a network management service. Successful exploitation of this vulnerability coul… |
CVE-2025-23051 | High | 7.2 | 2025-01-14 | An authenticated parameter injection vulnerability exists in the web-based management interface of the AOS-8 and AOS-10 Operating Systems. Successful exploitat… |
CVE-2025-23025 | Critical | 9.0 | 2025-01-14 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. NOTE: The Realtime WYSIWYG Editor extension was **expe… |
CVE-2025-21607 | High | 7.5 | 2025-01-14 | Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover (0x1) and Identity (0x4), the success flag of t… |
CVE-2025-21417 | High | 8.8 | 2025-01-14 | Windows Telephony Service Remote Code Execution Vulnerability |
CVE-2025-21413 | High | 8.8 | 2025-01-14 | Windows Telephony Service Remote Code Execution Vulnerability |
CVE-2025-21411 | High | 8.8 | 2025-01-14 | Windows Telephony Service Remote Code Execution Vulnerability |
CVE-2025-21409 | High | 8.8 | 2025-01-14 | Windows Telephony Service Remote Code Execution Vulnerability |
CVE-2025-21405 | High | 7.3 | 2025-01-14 | Visual Studio Elevation of Privilege Vulnerability |
CVE-2025-21403 | Medium | 6.4 | 2025-01-14 | On-Premises Data Gateway Information Disclosure Vulnerability |
CVE-2025-21402 | High | 7.8 | 2025-01-14 | Microsoft Office OneNote Remote Code Execution Vulnerability |
CVE-2025-21395 | High | 7.8 | 2025-01-14 | Microsoft Access Remote Code Execution Vulnerability |
CVE-2025-21393 | Medium | 6.3 | 2025-01-14 | Microsoft SharePoint Server Spoofing Vulnerability |
CVE-2025-21389 | High | 7.5 | 2025-01-14 | Uncontrolled resource consumption in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to deny service over a network. |
CVE-2025-21382 | High | 7.8 | 2025-01-14 | Windows Graphics Component Elevation of Privilege Vulnerability |
CVE-2025-21378 | High | 7.8 | 2025-01-14 | Windows CSC Service Elevation of Privilege Vulnerability |
CVE-2025-21374 | Medium | 5.5 | 2025-01-14 | Windows CSC Service Information Disclosure Vulnerability |
CVE-2025-21372 | High | 7.8 | 2025-01-14 | Microsoft Brokering File System Elevation of Privilege Vulnerability |
CVE-2025-21370 | High | 7.8 | 2025-01-14 | Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability |
CVE-2025-21366 | High | 7.8 | 2025-01-14 | Microsoft Access Remote Code Execution Vulnerability |
CVE-2025-21365 | High | 7.8 | 2025-01-14 | Microsoft Office Remote Code Execution Vulnerability |
CVE-2025-21364 | High | 7.8 | 2025-01-14 | Microsoft Excel Security Feature Bypass Vulnerability |
CVE-2025-21363 | High | 7.8 | 2025-01-14 | Microsoft Word Remote Code Execution Vulnerability |
CVE-2025-21362 | High | 8.4 | 2025-01-14 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2025-21361 | High | 7.8 | 2025-01-14 | Microsoft Outlook Remote Code Execution Vulnerability |
CVE-2025-21360 | High | 7.8 | 2025-01-14 | Microsoft AutoUpdate (MAU) Elevation of Privilege Vulnerability |
CVE-2025-21357 | Medium | 6.7 | 2025-01-14 | Microsoft Outlook Remote Code Execution Vulnerability |
CVE-2025-21356 | High | 7.8 | 2025-01-14 | Microsoft Office Visio Remote Code Execution Vulnerability |
CVE-2025-21354 | High | 8.4 | 2025-01-14 | Microsoft Excel Remote Code Execution Vulnerability |
CVE-2025-21348 | High | 7.2 | 2025-01-14 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2025-21346 | High | 7.1 | 2025-01-14 | Microsoft Office Security Feature Bypass Vulnerability |
CVE-2025-21345 | High | 7.8 | 2025-01-14 | Microsoft Office Visio Remote Code Execution Vulnerability |
CVE-2025-21344 | High | 7.8 | 2025-01-14 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2025-21343 | High | 7.5 | 2025-01-14 | Windows Web Threat Defense User Service Information Disclosure Vulnerability |
CVE-2025-21341 | Medium | 6.6 | 2025-01-14 | Windows Digital Media Elevation of Privilege Vulnerability |
CVE-2025-21340 | Medium | 5.5 | 2025-01-14 | Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability |
CVE-2025-21339 | High | 8.8 | 2025-01-14 | Windows Telephony Service Remote Code Execution Vulnerability |
CVE-2025-21338 | High | 7.8 | 2025-01-14 | GDI+ Remote Code Execution Vulnerability |
CVE-2025-21336 | Medium | 5.6 | 2025-01-14 | Windows Cryptographic Information Disclosure Vulnerability |
CVE-2025-21335 | High | 7.8 | 2025-01-14 | Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability |
CVE-2025-21334 | High | 7.8 | 2025-01-14 | Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability |
CVE-2025-21333 | High | 7.8 | 2025-01-14 | Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability |