2025 CVEs (page 48)
Page 48 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-64305 | Medium | 6.5 | 2026-01-07 | MicroServer copies parts of the system firmware to an unencrypted external SD card on boot, which contains user and vendor secrets. An attacker can utilize the… |
CVE-2025-61939 | High | 8.8 | 2026-01-07 | An unused function in MicroServer can start a reverse SSH connection to a vendor registered domain, without mutual authentication. An attacker on the local net… |
CVE-2025-66560 | Medium | 5.9 | 2026-01-07 | Quarkus is a Cloud Native, (Linux) Container First framework for writing Java applications. Prior to versions 3.31.0, 3.27.2, and 3.20.5, a vulnerability exist… |
CVE-2025-61782 | Medium | 5.4 | 2026-01-07 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exi… |
CVE-2025-61492 | Critical | 10.0 | 2026-01-07 | A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to execute arbitrary commands via a crafted… |
CVE-2025-58441 | Medium | 6.5 | 2026-01-07 | Knowage is an open source analytics and business intelligence suite. Prior to version 8.1.37, there is a blind server-side request forgery vulnerability. The v… |
CVE-2025-4677 | Medium | 6.5 | 2026-01-07 | Insufficient Session Expiration vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects WebPro SNMP Card PowerV… |
CVE-2025-67366 | High | 7.5 | 2026-01-07 | @sylphxltd/filesystem-mcp v0.5.8 is an MCP server that provides file content reading functionality. Version 0.5.8 of filesystem-mcp contains a critical path tr… |
CVE-2025-67364 | High | 7.5 | 2026-01-07 | fast-filesystem-mcp version 3.4.0 contains a critical path traversal vulnerability in its file operation tools including fast_read_file. This vulnerability ari… |
CVE-2025-66837 | Medium | 6.8 | 2026-01-07 | A file upload vulnerability in ARIS 10.0.23.0.3587512 allows attackers to execute arbitrary code via uploading a crafted PDF file/Malware |
CVE-2025-66786 | High | 7.5 | 2026-01-07 | OpenAirInterface CN5G AMF<=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to… |
CVE-2025-66686 | Medium | 6.1 | 2026-01-07 | A stored Cross-Site Scripting (XSS) vulnerability exists in Perch CMS version 3.2. An authenticated attacker with administrative privileges can inject maliciou… |
CVE-2025-65805 | High | 7.5 | 2026-01-07 | OpenAirInterface CN5G AMF<=v2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote attackers can launch a denial-of-service… |
CVE-2025-61489 | Medium | 6.5 | 2026-01-07 | A command injection vulnerability in the shell_exec function of sonirico mcp-shell v0.3.1 allows attackers to execute arbitrary commands via supplying a crafte… |
CVE-2025-4676 | High | 8.8 | 2026-01-07 | Incorrect Implementation of Authentication Algorithm vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects We… |
CVE-2025-4675 | Medium | 6.5 | 2026-01-07 | Improper Check for Unusual or Exceptional Conditions vulnerability in ABB WebPro SNMP Card PowerValue, ABB WebPro SNMP Card PowerValue UL.This issue affects We… |
CVE-2025-12543 | Critical | 9.6 | 2026-01-07 | A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications. The Undertow library fails to properly val… |
CVE-2025-66838 | Medium | 6.5 | 2026-01-07 | In Aris v10.0.23.0.3587512 and before, the file upload functionality does not enforce any rate limiting or throttling, allowing users to upload files at an unr… |
CVE-2025-62327 | Medium | 4.9 | 2026-01-07 | In HCL DevOps Deploy 8.1.2.0 through 8.1.2.3, a user with LLM configuration privileges may be able to recover a credential previously saved for performing auth… |
CVE-2025-49335 | Medium | 4.9 | 2026-01-07 | Server-Side Request Forgery (SSRF) vulnerability in minnur External Media external-media allows Server Side Request Forgery.This issue affects External Media… |
CVE-2025-6225 | | 2026-01-07 | Kieback&Peter Neutrino-GLT product is used for building management. It's web component "SM70 PHWEB" is vulnerable to shell command injection via login form. Th… | |
CVE-2025-15479 | Medium | 5.4 | 2026-01-07 | Stored cross-site scripting (XSS, CWE-79) in the survey content and administration functionality in Data Illusion Zumbrunn NGSurvey Enterprise Edition 3.6.4 on… |
CVE-2025-47552 | Critical | 9.8 | 2026-01-07 | Deserialization of Untrusted Data vulnerability in Digital zoom studio DZS Video Gallery allows Object Injection.This issue affects DZS Video Gallery: from n/a… |
CVE-2025-46494 | High | 7.1 | 2026-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themesgrove WidgetKit Pro allows Reflected XSS.This issue… |
CVE-2025-46434 | Medium | 6.5 | 2026-01-07 | Missing Authorization vulnerability in POSIMYTH Innovation The Plus Addons for Elementor Pro theplus_elementor_addon allows Exploiting Incorrectly Configured A… |
CVE-2025-46256 | Medium | 6.4 | 2026-01-07 | Path Traversal: '.../...//' vulnerability in SigmaPlugin Advanced Database Cleaner PRO allows Path Traversal.This issue affects Advanced Database Cleaner PRO… |
CVE-2025-32303 | Critical | 9.3 | 2026-01-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla WPCHURCH allows Blind SQL Injection.This issue a… |
CVE-2025-9611 | | 2026-01-07 | Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS… | |
CVE-2025-69344 | Medium | 4.3 | 2026-01-07 | Missing Authorization vulnerability in themehunk Oneline Lite oneline-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-69333 | Medium | 4.3 | 2026-01-07 | Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-69082 | High | 7.1 | 2026-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Frenify Arlo arlo allows Reflected XSS.This issue affects… |
CVE-2025-69081 | High | 8.1 | 2026-01-07 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeREX Hope charity-is-hope allows P… |
CVE-2025-69080 | High | 8.1 | 2026-01-07 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JanStudio Gecko gecko allows PHP Local… |
CVE-2025-68637 | Critical | 9.1 | 2026-01-07 | The Uniffle HTTP client is configured to trust all SSL certificates and disables hostname verification by default. This insecure configuration exposes all RES… |
CVE-2025-47396 | High | 7.8 | 2026-01-07 | Memory corruption occurs when a secure application is launched on a device with insufficient memory. |
CVE-2025-47395 | Medium | 6.5 | 2026-01-07 | Transient DOS while parsing a WLAN management frame with a Vendor Specific Information Element. |
CVE-2025-47394 | High | 7.8 | 2026-01-07 | Memory corruption when copying overlapping buffers during memory operations due to incorrect offset calculations. |
CVE-2025-47393 | High | 7.8 | 2026-01-07 | Memory corruption when accessing resources in kernel driver. |
CVE-2025-47388 | High | 7.8 | 2026-01-07 | Memory corruption while passing pages to DSP with an unaligned starting address. |
CVE-2025-47380 | High | 7.8 | 2026-01-07 | Memory corruption while preprocessing IOCTLs in sensors. |
CVE-2025-47369 | Medium | 5.5 | 2026-01-07 | Information disclosure when a weak hashed value is returned to userland code in response to a IOCTL call to obtain a session ID. |
CVE-2025-47356 | High | 7.8 | 2026-01-07 | Memory Corruption when multiple threads concurrently access and modify shared resources. |
CVE-2025-47348 | High | 7.8 | 2026-01-07 | Memory corruption while processing identity credential operations in the trusted application. |
CVE-2025-47346 | High | 7.8 | 2026-01-07 | Memory corruption while processing a secure logging command in the trusted application. |
CVE-2025-47345 | High | 8.4 | 2026-01-07 | Cryptographic issue may occur while encrypting license data. |
CVE-2025-47344 | Medium | 6.7 | 2026-01-07 | Memory corruption while handling sensor utility operations. |
CVE-2025-47343 | High | 7.8 | 2026-01-07 | Memory corruption while processing a video session to set video parameters. |
CVE-2025-47339 | High | 7.8 | 2026-01-07 | Memory corruption while deinitializing a HDCP session. |
CVE-2025-47337 | Medium | 6.7 | 2026-01-07 | Memory corruption while accessing a synchronization object during concurrent operations. |
CVE-2025-47336 | Medium | 6.7 | 2026-01-07 | Memory corruption while performing sensor register read operations. |
CVE-2025-47335 | Medium | 6.7 | 2026-01-07 | Memory corruption while parsing clock configuration data for a specific hardware type. |
CVE-2025-47334 | Medium | 6.7 | 2026-01-07 | Memory corruption while processing shared command buffer packet between camera userspace and kernel. |
CVE-2025-47333 | Medium | 6.6 | 2026-01-07 | Memory corruption while handling buffer mapping operations in the cryptographic driver. |
CVE-2025-47332 | Medium | 6.7 | 2026-01-07 | Memory corruption while processing a config call from userspace. |
CVE-2025-47331 | Medium | 6.1 | 2026-01-07 | Information disclosure while processing a firmware event. |
CVE-2025-47330 | Medium | 5.5 | 2026-01-07 | Transient DOS while parsing video packets received from the video firmware. |
CVE-2025-32300 | High | 7.1 | 2026-01-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Digital zoom studio DZS Video Gallery allows Reflected XS… |
CVE-2025-31964 | Low | 2.2 | 2026-01-07 | Improper service binding configuration in internal service components in HCL BigFix IVR version 4.2 allows a privileged attacker to impact service availability… |
CVE-2025-31963 | Low | 2.9 | 2026-01-07 | Improper authentication and missing CSRF protection in the local setup interface component in HCL BigFix IVR version 4.2 allows a local attacker to perform una… |
CVE-2025-31962 | Low | 2.0 | 2026-01-07 | Insufficient session expiration in the Web UI authentication component in HCL BigFix IVR version 4.2 allows an authenticated attacker to gain prolonged unautho… |
CVE-2025-31643 | High | 8.8 | 2026-01-07 | Incorrect Privilege Assignment vulnerability in Dasinfomedia WPCHURCH allows Privilege Escalation.This issue affects WPCHURCH: from n/a through 2.7.0. |
CVE-2025-15474 | | 2026-01-07 | AuntyFey Smart Combination Lock firmware versions as of 2025-12-24 contain a vulnerability that allows an unauthenticated attacker within Bluetooth Low Energy… | |
CVE-2025-15472 | High | 7.2 | 2026-01-07 | A flaw has been found in TRENDnet TEW-811DRU 1.0.2.0. This affects the function setDeviceURL of the file uapply.cgi of the component httpd . This manipulation… |
CVE-2025-15158 | High | 8.8 | 2026-01-07 | The WP Enable WebP plugin for WordPress is vulnerable to arbitrary file uploads due to improper file type validation in the 'wpse_file_and_ext_webp' function i… |
CVE-2025-15058 | Medium | 6.4 | 2026-01-07 | The Responsive Pricing Table plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'table_currency' parameter in all versions up to, and in… |
CVE-2025-15018 | Critical | 9.8 | 2026-01-07 | The Optional Email plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 1.3.11. This is due to… |
CVE-2025-15000 | Medium | 4.4 | 2026-01-07 | The Page Keys plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘page_key’ parameter in all versions up to, and including, 1.3.3 due to… |
CVE-2025-14999 | Medium | 4.3 | 2026-01-07 | The Latest Tabs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect… |
CVE-2025-14904 | Medium | 4.3 | 2026-01-07 | The Newsletter Email Subscribe plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.4. This is due to incorrect… |
CVE-2025-14901 | Medium | 6.5 | 2026-01-07 | The Bit Form – Contact Form Plugin plugin for WordPress is vulnerable to unauthorized workflow execution due to missing authorization in the triggerWorkFlow fu… |
CVE-2025-14891 | Medium | 6.4 | 2026-01-07 | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayName' parameter in all versions up to, a… |
CVE-2025-14888 | Medium | 4.4 | 2026-01-07 | The Simple User Meta Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user meta value field in all versions up to, and includin… |
CVE-2025-14887 | Medium | 4.4 | 2026-01-07 | The twinklesmtp – Email Service Provider For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's sender settings in all ve… |
CVE-2025-14875 | Medium | 6.1 | 2026-01-07 | The HBLPAY Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘cusdata’ parameter in all versions up… |
CVE-2025-14867 | Medium | 6.5 | 2026-01-07 | The Flashcard plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 0.9 via the 'source' attribute of the 'flashcard' shor… |
CVE-2025-14845 | Medium | 4.3 | 2026-01-07 | The NS IE Compatibility Fixer plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to, and including, 2.1.5. This is due… |
CVE-2025-14842 | Medium | 6.1 | 2026-01-07 | The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to limited upload of files with a dangerous type in all versions up… |
CVE-2025-14835 | High | 7.1 | 2026-01-07 | The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘shortcode’ parameter in all versions up to, and including… |
CVE-2025-14804 | High | 7.7 | 2026-01-07 | The Frontend File Manager Plugin WordPress plugin before 23.5 did not validate a path parameter and ownership of the file, allowing any authenticated users, su… |
CVE-2025-14802 | Medium | 5.4 | 2026-01-07 | The LearnPress – WordPress LMS Plugin for WordPress is vulnerable to unauthorized file deletion in versions up to, and including, 4.3.2.2 via the /wp-json/lp/v… |
CVE-2025-14796 | Medium | 6.4 | 2026-01-07 | The My Album Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image titles in all versions up to, and including, 1.0.4. This is du… |
CVE-2025-14792 | Medium | 4.4 | 2026-01-07 | The Key Figures plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the kf_field_figure_default_color_render function in all versions up to… |
CVE-2025-14719 | Medium | 4.9 | 2026-01-07 | The Relevanssi WordPress plugin before 4.26.0, Relevanssi Premium WordPress plugin before 2.29.0 do not sanitize and escape a parameter before using it in a S… |
CVE-2025-14631 | Medium | 6.5 | 2026-01-07 | A NULL Pointer Dereference vulnerability in TP-Link Archer BE400 V1(802.11 modules) allows an adjacent attacker to cause a denial-of-service (DoS) by trigger… |
CVE-2025-14626 | Medium | 6.4 | 2026-01-07 | The QR Code for WooCommerce order emails, PDF invoices, packing slips plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortc… |
CVE-2025-14625 | Medium | 6.7 | 2026-01-07 | Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard on Windows (Nios II Command Shell modules), Altera Quartus Prime Lite on Window… |
CVE-2025-14614 | Medium | 6.7 | 2026-01-07 | Insecure Temporary File vulnerability in Altera Quartus Prime Standard Installer (SFX) on Windows, Altera Quartus Prime Lite Installer (SFX) on Windows… |
CVE-2025-14468 | Medium | 4.3 | 2026-01-07 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.9. This is due… |
CVE-2025-14465 | Medium | 4.3 | 2026-01-07 | The Sticky Action Buttons plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1. This is due to missing or… |
CVE-2025-14460 | Medium | 5.3 | 2026-01-07 | The Piraeus Bank WooCommerce Payment Gateway plugin for WordPress is vulnerable to unauthorized order status modification in all versions up to, and including… |
CVE-2025-14453 | Medium | 6.4 | 2026-01-07 | The My Album Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'style_css' shortcode attribute in all versions up to, and inclu… |
CVE-2025-14370 | Medium | 4.3 | 2026-01-07 | The Quote Comments plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0.0. This is due to missing authorizatio… |
CVE-2025-14352 | Medium | 5.3 | 2026-01-07 | The Awesome Hotel Booking plugin for WordPress is vulnerable to unauthorized modification of data due to incorrect authorization in the room-single.php shortco… |
CVE-2025-14147 | Medium | 6.4 | 2026-01-07 | The Easy GitHub Gist Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the gist shortcode in all versions… |
CVE-2025-14145 | Medium | 6.4 | 2026-01-07 | The Niche Hero | Beautifully-designed blocks in seconds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'spacing' parameter of the nh… |
CVE-2025-14144 | Medium | 6.4 | 2026-01-07 | The Mstoic Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'start' parameter of the ms_youtube_embeds shortcode in all ver… |
CVE-2025-14131 | Medium | 6.1 | 2026-01-07 | The WP Widget Changer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and i… |
CVE-2025-14130 | Medium | 6.1 | 2026-01-07 | The Post Like Dislike plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and i… |
CVE-2025-14128 | Medium | 6.1 | 2026-01-07 | The Stumble! for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to… |
CVE-2025-14127 | Medium | 6.1 | 2026-01-07 | The Testimonial Master plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` variable in all versions up to, and… |