2025 CVEs (page 46)
Page 46 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-14819 | Medium | 5.3 | 2026-01-08 | When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA… |
CVE-2025-14524 | Medium | 5.3 | 2026-01-08 | When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3… |
CVE-2025-14431 | High | 8.1 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in THEMELOGI Navian navian allows PHP Loc… |
CVE-2025-14430 | High | 8.1 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local… |
CVE-2025-14429 | High | 8.1 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove AeroLand aeroland allows PHP… |
CVE-2025-14360 | High | 7.5 | 2026-01-08 | Missing Authorization vulnerability in Kaira Blockons blockons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockons: fro… |
CVE-2025-14359 | High | 8.1 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in brandexponents Oshine allows PHP Local… |
CVE-2025-14358 | High | 7.5 | 2026-01-08 | Missing Authorization vulnerability in sizam REHub Framework rehub-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects… |
CVE-2025-14017 | Medium | 6.3 | 2026-01-08 | When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefo… |
CVE-2025-13504 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Real Estate Pro real-estate-pro allows Reflecte… |
CVE-2025-13034 | Medium | 5.9 | 2026-01-08 | When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool,curl should check the public key of the server certificate to v… |
CVE-2025-12551 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins ListingHub listinghub allows Reflected XSS.This… |
CVE-2025-12550 | High | 8.1 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes OchaHouse ochahouse allows P… |
CVE-2025-12549 | High | 8.1 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Rozy - Flower Shop rozy allo… |
CVE-2025-13679 | Medium | 6.5 | 2026-01-08 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the… |
CVE-2025-14275 | Medium | 6.4 | 2026-01-08 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.0.1 due to insufficient input s… |
CVE-2025-12640 | Medium | 4.3 | 2026-01-08 | The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Unauthorized Arbitrary Media… |
CVE-2025-15346 | | 2026-01-08 | A vulnerability in the handling of verify_mode = CERT_REQUIRED in the wolfssl Python package (wolfssl-py) causes client certificate requirements to not be full… | |
CVE-2025-69262 | High | 7.5 | 2026-01-07 | pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc config… |
CVE-2025-62224 | Medium | 5.5 | 2026-01-07 | User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an authorized attacker to perform spoofing over a network. |
CVE-2025-69264 | High | 8.8 | 2026-01-07 | pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 sec… |
CVE-2025-69263 | High | 7.5 | 2026-01-07 | pnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies (and git-hosted tarballs) in the lockfile without integrity hashes. This… |
CVE-2025-69222 | Critical | 9.1 | 2026-01-07 | LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 is prone to a server-side request forgery (SSRF) vulnerability due to missing restrict… |
CVE-2025-13151 | High | 7.5 | 2026-01-07 | Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_o… |
CVE-2025-12776 | Medium | 5.4 | 2026-01-07 | The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible… |
CVE-2025-69255 | Medium | 4.0 | 2026-01-07 | RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.77, a malformed gRPC GetMetrics request causes get_metri… |
CVE-2025-69221 | Medium | 4.3 | 2026-01-07 | LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when querying agent permissions. An authenticat… |
CVE-2025-69220 | High | 7.1 | 2026-01-07 | LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and… |
CVE-2025-68705 | Critical | 9.8 | 2026-01-07 | RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.78, RustFS contains a path traversal vulnerability in th… |
CVE-2025-66620 | High | 8.0 | 2026-01-07 | An unused webshell in MicroServer allows unlimited login attempts, with sudo rights on certain files and directories. An attacker with admin access to MicroSer… |
CVE-2025-64305 | Medium | 6.5 | 2026-01-07 | MicroServer copies parts of the system firmware to an unencrypted external SD card on boot, which contains user and vendor secrets. An attacker can utilize the… |
CVE-2025-61939 | High | 8.8 | 2026-01-07 | An unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mutual authentication. An attacker on the local net… |
CVE-2025-66560 | Medium | 5.9 | 2026-01-07 | Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. Prior to versions 3.31.0, 3.27.2, and 3.20.5, a vulnerability exist… |
CVE-2025-61782 | Medium | 5.4 | 2026-01-07 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exi… |
CVE-2025-61492 | Critical | 10.0 | 2026-01-07 | A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted… |
CVE-2025-58441 | Medium | 6.5 | 2026-01-07 | Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, there is a blind server-side request forgery vulnerability. The v… |
CVE-2025-4677 | Medium | 6.5 | 2026-01-07 | Insufficient Session Expiration vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerV… |
CVE-2025-67366 | High | 7.5 | 2026-01-07 | @sylphxltd/filesystem-mcp v0.5.8 is an MCP server that provides file content reading functionality. Version 0.5.8 of filesystem-mcp contains a critical path tr… |
CVE-2025-67364 | High | 7.5 | 2026-01-07 | fast-filesystem-mcp version 3.4.0 contains a critical path traversal vulnerability in its file operation tools including fast_read_file. This vulnerability ari… |
CVE-2025-66837 | Medium | 6.8 | 2026-01-07 | A file upload vulnerability in ARIS 10.0.23.0.3587512 allows attackers to execute arbitrary code via uploading a crafted PDF file/Malware |
CVE-2025-66786 | High | 7.5 | 2026-01-07 | OpenAirInterface CN5G AMF<=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to… |
CVE-2025-66686 | Medium | 6.1 | 2026-01-07 | A stored Cross-Site Scripting (XSS) vulnerability exists in Perch CMS version 3.2. An authenticated attacker with administrative privileges can inject maliciou… |
CVE-2025-65805 | High | 7.5 | 2026-01-07 | OpenAirInterface CN5G AMF<=v2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote attackers can launch a denial-of-service… |
CVE-2025-61489 | Medium | 6.5 | 2026-01-07 | A command injection vulnerability in the shell_exec function of sonirico mcp-shell v0.3.1 allows attackers to execute arbitrary commands via supplying a crafte… |
CVE-2025-4676 | High | 8.8 | 2026-01-07 | Incorrect Implementation of Authentication Algorithm vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects We… |
CVE-2025-4675 | Medium | 6.5 | 2026-01-07 | Improper Check for Unusual or Exceptional Conditions vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects We… |
CVE-2025-12543 | Critical | 9.6 | 2026-01-07 | A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly val… |
CVE-2025-66838 | Medium | 6.5 | 2026-01-07 | In Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate limiting or throttling, allowing users to upload files at an unr… |
CVE-2025-62327 | Medium | 4.9 | 2026-01-07 | In HCL DevOps Deploy 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved for performing auth… |
CVE-2025-49335 | Medium | 4.9 | 2026-01-07 | Server-Side Request Forgery (SSRF) vulnerability in minnur External Media external-media allows Server Side Request Forgery.This issue affects External Media… |
CVE-2025-6225 | | 2026-01-07 | Kieback&Peter Neutrino-GLT product is used for building management. It's web component "SM70 PHWEB" is vulnerable to shell command injection via login form. Th… | |
CVE-2025-15479 | Medium | 5.4 | 2026-01-07 | Stored cross-site scripting (XSS, CWE-79) in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on… |
CVE-2025-47552 | Critical | 9.8 | 2026-01-07 | Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a… |
CVE-2025-46494 | High | 7.1 | 2026-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesgrove WidgetKit Pro allows Reflected XSS.This issue… |
CVE-2025-46434 | Medium | 6.5 | 2026-01-07 | Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro theplus_elementor_addon allows Exploiting Incorrectly Configured A… |
CVE-2025-46256 | Medium | 6.4 | 2026-01-07 | Path Traversal: '.../...//' vulnerability in SigmaPlugin Advanced Database Cleaner PRO allows Path Traversal.This issue affects Advanced Database Cleaner PRO… |
CVE-2025-32303 | Critical | 9.3 | 2026-01-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla WPCHURCH allows Blind SQL Injection.This issue a… |
CVE-2025-9611 | | 2026-01-07 | Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS… | |
CVE-2025-69344 | Medium | 4.3 | 2026-01-07 | Missing Authorization vulnerability in themehunk Oneline Lite oneline-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-69333 | Medium | 4.3 | 2026-01-07 | Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-69082 | High | 7.1 | 2026-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frenify Arlo arlo allows Reflected XSS.This issue affects… |
CVE-2025-69081 | High | 8.1 | 2026-01-07 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Hope charity-is-hope allows P… |
CVE-2025-69080 | High | 8.1 | 2026-01-07 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JanStudio Gecko gecko allows PHP Local… |
CVE-2025-68637 | Critical | 9.1 | 2026-01-07 | The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default. This insecure configuration exposes all RES… |
CVE-2025-47396 | High | 7.8 | 2026-01-07 | Memory corruption occurs when a secure application is launched on a device with insufficient memory. |
CVE-2025-47395 | Medium | 6.5 | 2026-01-07 | Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element. |
CVE-2025-47394 | High | 7.8 | 2026-01-07 | Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations. |
CVE-2025-47393 | High | 7.8 | 2026-01-07 | Memory corruption when accessing resources in kernel driver. |
CVE-2025-47388 | High | 7.8 | 2026-01-07 | Memory corruption while passing pages to DSP with an unaligned starting address. |
CVE-2025-47380 | High | 7.8 | 2026-01-07 | Memory corruption while preprocessing IOCTLs in sensors. |
CVE-2025-47369 | Medium | 5.5 | 2026-01-07 | Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID. |
CVE-2025-47356 | High | 7.8 | 2026-01-07 | Memory Corruption when multiple threads concurrently access and modify shared resources. |
CVE-2025-47348 | High | 7.8 | 2026-01-07 | Memory corruption while processing identity credential operations in the trusted application. |
CVE-2025-47346 | High | 7.8 | 2026-01-07 | Memory corruption while processing a secure logging command in the trusted application. |
CVE-2025-47345 | High | 8.4 | 2026-01-07 | Cryptographic issue may occur while encrypting license data. |
CVE-2025-47344 | Medium | 6.7 | 2026-01-07 | Memory corruption while handling sensor utility operations. |
CVE-2025-47343 | High | 7.8 | 2026-01-07 | Memory corruption while processing a video session to set video parameters. |
CVE-2025-47339 | High | 7.8 | 2026-01-07 | Memory corruption while deinitializing a HDCP session. |
CVE-2025-47337 | Medium | 6.7 | 2026-01-07 | Memory corruption while accessing a synchronization object during concurrent operations. |
CVE-2025-47336 | Medium | 6.7 | 2026-01-07 | Memory corruption while performing sensor register read operations. |
CVE-2025-47335 | Medium | 6.7 | 2026-01-07 | Memory corruption while parsing clock configuration data for a specific hardware type. |
CVE-2025-47334 | Medium | 6.7 | 2026-01-07 | Memory corruption while processing shared command buffer packet between camera userspace and kernel. |
CVE-2025-47333 | Medium | 6.6 | 2026-01-07 | Memory corruption while handling buffer mapping operations in the cryptographic driver. |
CVE-2025-47332 | Medium | 6.7 | 2026-01-07 | Memory corruption while processing a config call from userspace. |
CVE-2025-47331 | Medium | 6.1 | 2026-01-07 | Information disclosure while processing a firmware event. |
CVE-2025-47330 | Medium | 5.5 | 2026-01-07 | Transient DOS while parsing video packets received from the video firmware. |
CVE-2025-32300 | High | 7.1 | 2026-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital zoom studio DZS Video Gallery allows Reflected XS… |
CVE-2025-31964 | Low | 2.2 | 2026-01-07 | Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability… |
CVE-2025-31963 | Low | 2.9 | 2026-01-07 | Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform una… |
CVE-2025-31962 | Low | 2.0 | 2026-01-07 | Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unautho… |
CVE-2025-31643 | High | 8.8 | 2026-01-07 | Incorrect Privilege Assignment vulnerability in Dasinfomedia WPCHURCH allows Privilege Escalation.This issue affects WPCHURCH: from n/a through 2.7.0. |
CVE-2025-15474 | | 2026-01-07 | AuntyFey Smart Combination Lock firmware versions as of 2025-12-24 contain a vulnerability that allows an unauthenticated attacker within Bluetooth Low Energy… | |
CVE-2025-15472 | High | 7.2 | 2026-01-07 | A flaw has been found in TRENDnet TEW-811DRU 1.0.2.0. This affects the function setDeviceURL of the file uapply.cgi of the component httpd . This manipulation… |
CVE-2025-15158 | High | 8.8 | 2026-01-07 | The WP Enable WebP plugin for WordPress is vulnerable to arbitrary file uploads due to improper file type validation in the 'wpse_file_and_ext_webp' function i… |
CVE-2025-15058 | Medium | 6.4 | 2026-01-07 | The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'table_currency' parameter in all versions up to, and in… |
CVE-2025-15018 | Critical | 9.8 | 2026-01-07 | The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11. This is due to… |
CVE-2025-15000 | Medium | 4.4 | 2026-01-07 | The Page Keys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page_key’ parameter in all versions up to, and including, 1.3.3 due to… |
CVE-2025-14999 | Medium | 4.3 | 2026-01-07 | The Latest Tabs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect… |
CVE-2025-14904 | Medium | 4.3 | 2026-01-07 | The Newsletter Email Subscribe plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4. This is due to incorrect… |
CVE-2025-14901 | Medium | 6.5 | 2026-01-07 | The Bit Form – Contact Form Plugin plugin for WordPress is vulnerable to unauthorized workflow execution due to missing authorization in the triggerWorkFlow fu… |