2025 CVEs (page 47)
Page 47 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-50334 | High | 7.5 | 2026-01-08 | An issue in Technitium DNS Server v.13.5 allows a remote attacker to cause a denial of service via the rate-limiting component |
CVE-2025-68151 | High | 7.5 | 2026-01-08 | CoreDNS is a DNS server that chains plugins. Prior to version 1.14.0, multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack critical resource-… |
CVE-2025-67858 | | 2026-01-08 | A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configuration or further unspecified impa… | |
CVE-2025-67091 | Medium | 6.5 | 2026-01-08 | An issue in GL Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. GL.Inet AX1800 Version 4.6.4 & 4.6.8 in the GL.iNet custom opkg wrapper script located… |
CVE-2025-67090 | Medium | 5.1 | 2026-01-08 | The LuCI web interface on Gl Inet GL.Inet AX1800 Version 4.6.4 & 4.6.8 are vulnerable. Fix available in version 4.8.2 GL.Inet AX1800 Version 4.6.4 & 4.6.8 lack… |
CVE-2025-67089 | High | 8.1 | 2026-01-08 | A command injection vulnerability exists in the GL-iNet GL-AXT1800 router firmware v4.6.8. The vulnerability is present in the `plugins.install_package` RPC me… |
CVE-2025-63611 | High | 8.7 | 2026-01-08 | Cross-Site Scripting in phpgurukul Hostel Management System v2.1 user-provided complaint fields (Explain the Complaint) submitted via /register-complaint.php a… |
CVE-2025-67603 | | 2026-01-08 | A Improper Authorization vulnerability in Foomuuri llows arbitrary users to influence the firewall configuration.This issue affects Foomuuri: from ? before 0.3… | |
CVE-2025-66003 | | 2026-01-08 | An External Control of File Name or Path vulnerability in smb4k allowsl ocal users to perform a local root exploit via smb4k mounthelper if they can access and… | |
CVE-2025-66002 | | 2026-01-08 | An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability allows local users ton perform arbitrary unmounts via smb4… | |
CVE-2025-4596 | | 2026-01-08 | Asseco ADMX system is used for processing medical records. It allows logged in users to access medical files belonging to other users through manipulation of G… | |
CVE-2025-8307 | | 2026-01-08 | Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. Passwords of all users are stored… | |
CVE-2025-8306 | | 2026-01-08 | Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. A low privileged user is able to o… | |
CVE-2025-14025 | High | 8.5 | 2026-01-08 | A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operat… |
CVE-2025-69260 | High | 7.5 | 2026-01-08 | A message out-of-bounds read vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affected instal… |
CVE-2025-69259 | High | 7.5 | 2026-01-08 | A message unchecked NULL return value vulnerability in Trend Micro Apex Central could allow a remote attacker to create a denial-of-service condition on affect… |
CVE-2025-69258 | Critical | 9.8 | 2026-01-08 | A LoadLibraryEX vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to load an attacker-controlled DLL into a key executab… |
CVE-2025-62877 | Critical | 9.8 | 2026-01-08 | Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password if they are using the 1.5.x or 1.6.x interactive i… |
CVE-2025-66001 | High | 8.8 | 2026-01-08 | NeuVector supports login authentication through OpenID Connect. However, the TLS verification (which verifies the remote server's authenticity and integrity) f… |
CVE-2025-69169 | Medium | 5.4 | 2026-01-08 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Noor Alam Easy Media Download easy-media-download allows Reflect… |
CVE-2025-68892 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in gopiplus@hotmail.com Scroll rss excerpt scroll-rss-excerp… |
CVE-2025-68891 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ryan Sutana WP App Bar wp-app-bar allows Reflected XSS.Th… |
CVE-2025-68890 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hands01 e-shops e-shops-cart2 allows DOM-Based XSS.This i… |
CVE-2025-68889 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pinpoll Pinpoll pinpoll allows Reflected XSS.This issue a… |
CVE-2025-68887 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CMSJunkie - WordPress Business Directory Plugins WP-Busin… |
CVE-2025-68875 | Medium | 6.5 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in jcaruso001 Flaming Password Reset flaming-password-reset… |
CVE-2025-68874 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shahjada Visitor Stats Widget visitor-stats-widget allows… |
CVE-2025-68873 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in chloédigital PRIMER by chloédigital primer-by-chloedigita… |
CVE-2025-68867 | Medium | 6.5 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in anibalwainstein Effect Maker effect-maker allows DOM-Base… |
CVE-2025-67937 | High | 8.1 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Hendon hendon allows PHP… |
CVE-2025-67936 | High | 8.1 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Curly curly allows PHP L… |
CVE-2025-67935 | High | 8.1 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Optimize optimizewp allo… |
CVE-2025-67934 | High | 8.1 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Wellspring wellspring al… |
CVE-2025-67933 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in taskbuilder Taskbuilder taskbuilder allows Reflected XSS… |
CVE-2025-67932 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in purethemes Listeo Core listeo-core allows Reflected XSS.T… |
CVE-2025-67931 | High | 7.5 | 2026-01-08 | Insertion of Sensitive Information Into Sent Data vulnerability in AITpro BulletProof Security bulletproof-security allows Retrieve Embedded Sensitive Data.Thi… |
CVE-2025-67930 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vernon Systems Limited eHive Search ehive-search allows R… |
CVE-2025-67928 | Critical | 9.3 | 2026-01-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in themesuite Automotive Listings automotive allows Blind SQ… |
CVE-2025-67927 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Spencer Haws Link Whisper Free link-whisper allows Reflec… |
CVE-2025-67926 | Medium | 6.5 | 2026-01-08 | Missing Authorization vulnerability in Shahjahan Jewel Fluent Support fluent-support allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-67925 | High | 7.5 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zozothemes Corpkit corpkit allows PHP… |
CVE-2025-67924 | Critical | 9.9 | 2026-01-08 | Unrestricted Upload of File with Dangerous Type vulnerability in zozothemes Corpkit corpkit allows Upload a Web Shell to a Web Server.This issue affects Corpki… |
CVE-2025-67922 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflec… |
CVE-2025-67921 | High | 8.5 | 2026-01-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VanKarWai Lobo lobo allows Blind SQL Injection.This issue… |
CVE-2025-67920 | High | 8.1 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Neo Ocular neoocular all… |
CVE-2025-67919 | Medium | 6.5 | 2026-01-08 | Authorization Bypass Through User-Controlled Key vulnerability in WofficeIO Woffice Core woffice-core allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-67918 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WofficeIO Woffice woffice allows Reflected XSS.This issue… |
CVE-2025-67917 | Medium | 6.5 | 2026-01-08 | Missing Authorization vulnerability in shinetheme Traveler traveler allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-67916 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Astoundify Jobify jobify allows Reflected XSS.This issue… |
CVE-2025-67915 | High | 8.8 | 2026-01-08 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Arraytics Timetics timetics allows Authentication Abuse.This issue affects Timetics… |
CVE-2025-67914 | High | 7.7 | 2026-01-08 | Path Traversal: '.../...//' vulnerability in beeteam368 VidMov vidmov allows Path Traversal.This issue affects VidMov: from n/a through <= 2.3.8. |
CVE-2025-67913 | Medium | 6.5 | 2026-01-08 | Missing Authorization vulnerability in Aruba.it Dev Aruba HiSpeed Cache aruba-hispeed-cache allows Accessing Functionality Not Properly Constrained by ACLs.Thi… |
CVE-2025-67911 | Critical | 9.8 | 2026-01-08 | Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object Injection.This issue affects Newsletters: from… |
CVE-2025-67910 | Critical | 9.1 | 2026-01-08 | Unrestricted Upload of File with Dangerous Type vulnerability in contentstudio Contentstudio contentstudio allows Upload a Web Shell to a Web Server.This issue… |
CVE-2025-27004 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup Famous - Responsive Image And Video Grid Gal… |
CVE-2025-27002 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LambertGroup CountDown With Image or Video Background cou… |
CVE-2025-23993 | Critical | 9.3 | 2026-01-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in RiceTheme Felan Framework felan-framework allows SQL Inje… |
CVE-2025-23504 | Critical | 9.8 | 2026-01-08 | Authentication Bypass Using an Alternate Path or Channel vulnerability in RiceTheme Felan Framework felan-framework allows Authentication Abuse.This issue affe… |
CVE-2025-22728 | High | 8.5 | 2026-01-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap (theme's plugin) workreap allows SQL… |
CVE-2025-22726 | Medium | 6.4 | 2026-01-08 | Server-Side Request Forgery (SSRF) vulnerability in _nK nK Themes Helper nk-themes-helper allows Server Side Request Forgery.This issue affects nK Themes Helpe… |
CVE-2025-22725 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in loopus WP Virtual Assistant VirtualAssistant allows Store… |
CVE-2025-22715 | High | 7.5 | 2026-01-08 | Missing Authorization vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows Exploiting In… |
CVE-2025-22713 | High | 8.5 | 2026-01-08 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in vanquish WooCommerce Orders & Customers Exporter woocomme… |
CVE-2025-22712 | High | 8.1 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QantumThemes Typify typify allows PHP… |
CVE-2025-22708 | High | 8.1 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Mitech mitech allows PHP Loc… |
CVE-2025-22707 | High | 8.1 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Moody tm-moody allows PHP Lo… |
CVE-2025-22509 | High | 8.1 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in TMRW-studio Atlas atlas allows PHP Loc… |
CVE-2025-15224 | Low | 3.1 | 2026-01-08 | When doing SSH-based transfers using either SCP or SFTP, and asked to do public key authentication, curl would wrongly still ask and authenticate using a local… |
CVE-2025-15079 | Medium | 5.3 | 2026-01-08 | When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not prese… |
CVE-2025-14984 | Medium | 6.4 | 2026-01-08 | The Gutenverse Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file upload in all versions up to, and including, 2.3.2. This is… |
CVE-2025-14819 | Medium | 5.3 | 2026-01-08 | When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA… |
CVE-2025-14524 | Medium | 5.3 | 2026-01-08 | When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer performs a cross-protocol redirect to a second URL that uses an IMAP, LDAP, POP3… |
CVE-2025-14431 | High | 8.1 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in THEMELOGI Navian navian allows PHP Loc… |
CVE-2025-14430 | High | 8.1 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local… |
CVE-2025-14429 | High | 8.1 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove AeroLand aeroland allows PHP… |
CVE-2025-14360 | High | 7.5 | 2026-01-08 | Missing Authorization vulnerability in Kaira Blockons blockons allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Blockons: fro… |
CVE-2025-14359 | High | 8.1 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in brandexponents Oshine allows PHP Local… |
CVE-2025-14358 | High | 7.5 | 2026-01-08 | Missing Authorization vulnerability in sizam REHub Framework rehub-framework allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects… |
CVE-2025-14017 | Medium | 6.3 | 2026-01-08 | When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread would inadvertently change them globally and therefo… |
CVE-2025-13504 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins Real Estate Pro real-estate-pro allows Reflecte… |
CVE-2025-13034 | Medium | 5.9 | 2026-01-08 | When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool, curl should check the public key of the server certificate to… |
CVE-2025-12551 | High | 7.1 | 2026-01-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e-plugins ListingHub listinghub allows Reflected XSS.This… |
CVE-2025-12550 | High | 8.1 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes OchaHouse ochahouse allows P… |
CVE-2025-12549 | High | 8.1 | 2026-01-08 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Rozy - Flower Shop rozy allo… |
CVE-2025-13679 | Medium | 6.5 | 2026-01-08 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the… |
CVE-2025-14275 | Medium | 6.4 | 2026-01-08 | The Jeg Elementor Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.0.1 due to insufficient input s… |
CVE-2025-12640 | Medium | 4.3 | 2026-01-08 | The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to Unauthorized Arbitrary Media… |
CVE-2025-15346 | | 2026-01-08 | A vulnerability in the handling of verify_mode = CERT_REQUIRED in the wolfssl Python package (wolfssl-py) causes client certificate requirements to not be full… | |
CVE-2025-69262 | High | 7.5 | 2026-01-07 | pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc config… |
CVE-2025-62224 | Medium | 5.5 | 2026-01-07 | User interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an authorized attacker to perform spoofing over a network. |
CVE-2025-69264 | High | 8.8 | 2026-01-07 | pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 sec… |
CVE-2025-69263 | High | 7.5 | 2026-01-07 | pnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies (and git-hosted tarballs) in the lockfile without integrity hashes. This… |
CVE-2025-69222 | Critical | 9.1 | 2026-01-07 | LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 is prone to a server-side request forgery (SSRF) vulnerability due to missing restrict… |
CVE-2025-13151 | High | 7.5 | 2026-01-07 | Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_o… |
CVE-2025-12776 | Medium | 5.4 | 2026-01-07 | The Report Builder component of the application stores user input directly in a web page and displays it to other users, which raised concerns about a possible… |
CVE-2025-69255 | Medium | 4.0 | 2026-01-07 | RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.77, a malformed gRPC GetMetrics request causes get_metri… |
CVE-2025-69221 | Medium | 4.3 | 2026-01-07 | LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control when querying agent permissions. An authenticat… |
CVE-2025-69220 | High | 7.1 | 2026-01-07 | LibreChat is a ChatGPT clone with additional features. Version 0.8.1-rc2 does not enforce proper access control for file uploads to an agents file context and… |
CVE-2025-68705 | Critical | 9.8 | 2026-01-07 | RustFS is a distributed object storage system built in Rust. In versions 1.0.0-alpha.13 to 1.0.0-alpha.78, RustFS contains a path traversal vulnerability in th… |
CVE-2025-66620 | High | 8.0 | 2026-01-07 | An unused webshell in MicroServer allows unlimited login attempts, with sudo rights on certain files and directories. An attacker with admin access to MicroSer… |