2025 CVEs (page 49)
Page 49 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-68953 | High | 7.5 | 2026-01-05 | Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include requests that are vulnerable to path traversal… |
CVE-2025-68456 | Critical | 9.1 | 2026-01-05 | Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger databa… |
CVE-2025-68455 | High | 7.2 | 2026-01-05 | Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated… |
CVE-2025-68454 | High | 8.8 | 2026-01-05 | Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated… |
CVE-2025-68437 | Medium | 6.8 | 2026-01-05 | Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, the Craft CMS GraphQL `save_<VolumeNa… |
CVE-2025-68436 | Medium | 6.5 | 2026-01-05 | Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, authenticated users on a Craft instal… |
CVE-2025-68428 | High | 7.5 | 2026-01-05 | jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allow… |
CVE-2025-67732 | Medium | 6.5 | 2026-01-05 | Dify is an open-source LLM app development platform. Prior to version 1.11.0, the API key is exposed in plaintext to the frontend, allowing non-administrator u… |
CVE-2025-66648 | High | 7.2 | 2026-01-05 | vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user… |
CVE-2025-65110 | High | 8.1 | 2026-01-05 | Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to versions 6.1.2 and 5.6.3, a… |
CVE-2025-61916 | High | 7.9 | 2026-01-05 | Spinnaker is an open source, multi-cloud continuous delivery platform. Versions prior to 2025.1.6, 2025.2.3, and 2025.3.0 are vulnerable to server-side request… |
CVE-2025-64425 | High | 8.1 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, an… |
CVE-2025-64424 | High | 8.8 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a… |
CVE-2025-64423 | High | 8.8 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a… |
CVE-2025-64422 | Medium | 4.3 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify vstarting with version 4.0.0-beta.434, the /logi… |
CVE-2025-67427 | Medium | 6.5 | 2026-01-05 | A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP r… |
CVE-2025-67419 | High | 7.5 | 2026-01-05 | A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET… |
CVE-2025-64421 | High | 8.0 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a… |
CVE-2025-64420 | Critical | 9.9 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434… |
CVE-2025-64419 | Critical | 9.6 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from doc… |
CVE-2025-67397 | Critical | 9.1 | 2026-01-05 | An issue in Passy v.1.6.3 allows a remote authenticated attacker to execute arbitrary commands via a crafted HTTP request using a specific payload injection. |
CVE-2025-53966 | High | 8.4 | 2026-01-05 | An issue was discovered in Samsung Mobile Processor Exynos 1380, 1480, 2400, and 1580. Incorrect Handling of the NL80211 vendor command leads to a buffer overf… |
CVE-2025-52517 | Medium | 5.9 | 2026-01-05 | An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. A race condition in the iss… |
CVE-2025-52516 | Medium | 6.2 | 2026-01-05 | An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. An invalid kernel address d… |
CVE-2025-52515 | Medium | 5.1 | 2026-01-05 | An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. A race condition in the iss… |
CVE-2025-49495 | High | 8.4 | 2026-01-05 | An issue was discovered in the WiFi driver in Samsung Mobile Processor Exynos 1380, 1480, 2400, 1580. Mishandling of an NL80211 vendor command leads to a buffe… |
CVE-2025-43706 | High | 7.5 | 2026-01-05 | An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2400, 1580, 9110, W920, W930, Modem 5123… |
CVE-2025-27807 | Critical | 9.1 | 2026-01-05 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580… |
CVE-2025-65922 | Medium | 4.3 | 2026-01-05 | PLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to be embedded within malicious iframes. While this does not lead… |
CVE-2025-61781 | High | 7.1 | 2026-01-05 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation "WorkspacePop… |
CVE-2025-59955 | Medium | 5.7 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.8 h… |
CVE-2025-59158 | High | 8.0 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.6 a… |
CVE-2025-59157 | Critical | 9.9 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, the Git Repository field… |
CVE-2025-59156 | High | 8.8 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, a Remote Code Execution… |
CVE-2025-55204 | High | 8.8 | 2026-01-05 | muffon is a cross-platform music streaming client for desktop. Versions prior to 2.3.0 have a one-click Remote Code Execution (RCE) vulnerability in. An attack… |
CVE-2025-67316 | Medium | 5.4 | 2026-01-05 | An issue in realme Internet browser v.45.13.4.1 allows a remote attacker to execute arbitrary code via a crafted webpage in the built-in HeyTap/ColorOS browser… |
CVE-2025-59467 | High | 7.5 | 2026-01-05 | A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator… |
CVE-2025-57836 | High | 7.8 | 2026-01-05 | An issue was discovered in Samsung Magician 6.3.0 through 8.3.2 on Windows. The installer creates a temporary folder with weak permissions during installation… |
CVE-2025-53344 | Medium | 4.3 | 2026-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress Thim Core allows Cross Site Request Forgery.This issue affects Thim Core: from n/a through 2.3.3. |
CVE-2025-52519 | High | 7.1 | 2026-01-05 | An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500. Improper validation of… |
CVE-2025-46255 | High | 7.5 | 2026-01-05 | Missing Authorization vulnerability in Marketing Fire LLC LoginWP - Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Logi… |
CVE-2025-39561 | Medium | 6.5 | 2026-01-05 | Missing Authorization vulnerability in Marketing Fire, LLC LoginWP - Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Log… |
CVE-2025-39497 | Medium | 6.5 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dokan Dokan Pro allows Stored XSS.This issue affects Doka… |
CVE-2025-39484 | Critical | 9.3 | 2026-01-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Waituk Entrada allows SQL Injection.This issue affects En… |
CVE-2025-10933 | | 2026-01-05 | An integer underflow vulnerability in the Silicon Labs Z-Wave Protocol Controller can lead to out of bounds memory reads. | |
CVE-2025-67303 | High | 7.5 | 2026-01-05 | An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the a… |
CVE-2025-65328 | Medium | 6.5 | 2026-01-05 | Mega-Fence (webgate-lib.*) 25.1.914 and prior trusts the first value of the X-Forwarded-For (XFF) header as the client IP without validating a trusted proxy ch… |
CVE-2025-14346 | Critical | 9.8 | 2026-01-05 | WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. An attacker within range can pair with th… |
CVE-2025-66376 | High | 7.2 | 2026-01-05 | Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTM… |
CVE-2025-15029 | Critical | 9.8 | 2026-01-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQ… |
CVE-2025-15026 | Critical | 9.8 | 2026-01-05 | Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module) allows Accessing Functionality Not P… |
CVE-2025-68280 | Medium | 6.5 | 2026-01-05 | Improper Restriction of XML External Entity Reference vulnerability in Apache SIS. It is possible to write XML files in such a way that, when parsed by Apac… |
CVE-2025-12513 | Medium | 6.8 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts configuration for… |
CVE-2025-12511 | Medium | 6.8 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (DSM extenstio configura… |
CVE-2025-69087 | High | 8.1 | 2026-01-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes FreeAgent freeagent allows P… |
CVE-2025-68865 | Critical | 9.3 | 2026-01-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infility Infility Global infility-global allows SQL Injec… |
CVE-2025-68850 | High | 7.5 | 2026-01-05 | Missing Authorization vulnerability in codepeople Sell Downloads sell-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-68547 | High | 7.5 | 2026-01-05 | Missing Authorization vulnerability in wpweb Follow My Blog Post follow-my-blog-post allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-68044 | High | 8.6 | 2026-01-05 | Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorr… |
CVE-2025-68033 | High | 7.5 | 2026-01-05 | Insertion of Sensitive Information Into Sent Data vulnerability in Brecht Custom Related Posts custom-related-posts allows Retrieve Embedded Sensitive Data.Thi… |
CVE-2025-68029 | Medium | 6.3 | 2026-01-05 | Insertion of Sensitive Information Into Sent Data vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Retrieve Embedd… |
CVE-2025-68014 | Medium | 6.5 | 2026-01-05 | Insertion of Sensitive Information Into Sent Data vulnerability in awethemes AweBooking awebooking allows Retrieve Embedded Sensitive Data.This issue affects A… |
CVE-2025-31048 | Critical | 9.9 | 2026-01-05 | Unrestricted Upload of File with Dangerous Type vulnerability in Themify Shopo allows Upload a Web Shell to a Web Server.This issue affects Shopo: from n/a thr… |
CVE-2025-31047 | High | 8.8 | 2026-01-05 | Deserialization of Untrusted Data vulnerability in Themify Themify Edmin allows Object Injection.This issue affects Themify Edmin: from n/a through 2.0.0. |
CVE-2025-31046 | Medium | 4.3 | 2026-01-05 | Missing Authorization vulnerability in WPvibes AnyWhere Elementor Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-31044 | High | 8.5 | 2026-01-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Premium SEO Pack allows SQL Injection.This issue… |
CVE-2025-30633 | Critical | 9.3 | 2026-01-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Native Shopping Recommendations allows SQL… |
CVE-2025-13056 | Medium | 6.8 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Administration ACL menu… |
CVE-2025-12519 | Medium | 5.3 | 2026-01-05 | Missing Authorization vulnerability in Centreon Infra Monitoring (Administration parameters API endpoint modules) allows Accessing Functionality Not Properly C… |
CVE-2025-68766 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() If irq_domain_translate_twoce… | |
CVE-2025-68765 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() In mt7615_mcu_wtbl_sta_add()… | |
CVE-2025-68764 | High | 7.8 | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags When a filesystem… |
CVE-2025-68763 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Correctly handle return of sg_nents_for_len The return value of sg_nen… | |
CVE-2025-68762 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: net: netpoll: initialize work queue before error checks Prevent a kernel warning when net… | |
CVE-2025-68761 | High | 7.8 | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: hfs: fix potential use after free in hfs_correct_next_unused_CNID() This code calls hfs_b… |
CVE-2025-68760 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show In iommu_mmio_write(), it… | |
CVE-2025-68759 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() In rtl8180_init_rx_ri… | |
CVE-2025-68758 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: backlight: led-bl: Add devlink to supplier LEDs LED Backlight is a consumer of one or mul… | |
CVE-2025-68757 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: drm/vgem-fence: Fix potential deadlock on release A timer that expires a vgem fence autom… | |
CVE-2025-68756 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock blk_mq_{add,d… | |
CVE-2025-68755 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: staging: most: remove broken i2c driver The MOST I2C driver has been completely broken fo… | |
CVE-2025-68754 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: rtc: amlogic-a4: fix double free caused by devm The clock obtained via devm_clk_get_enabl… | |
CVE-2025-68753 | High | 7.1 | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-motu: add bounds check in put_user loop for DSP events In the DSP event ha… |
CVE-2025-68752 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: iavf: Implement settime64 with -EOPNOTSUPP ptp_clock_settime() assumes every ptp_clock ha… | |
CVE-2025-68751 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: s390/fpu: Fix false-positive kmsan report in fpu_vstl() A false-positive kmsan report is… | |
CVE-2025-5965 | High | 7.2 | 2026-01-05 | In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup. Improper Neutralization of Special Element… |
CVE-2025-66518 | High | 8.8 | 2026-01-05 | Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local… |
CVE-2025-15240 | High | 8.8 | 2026-01-05 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload a… |
CVE-2025-15239 | Medium | 6.5 | 2026-01-05 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary… |
CVE-2025-15238 | Medium | 6.5 | 2026-01-05 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary… |
CVE-2025-15237 | Medium | 4.3 | 2026-01-05 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder name… |
CVE-2025-15236 | Medium | 4.3 | 2026-01-05 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder name… |
CVE-2025-15235 | Medium | 6.5 | 2026-01-05 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Missing Authorization vulnerability, allowing authenticated remote attackers to modify sp… |
CVE-2025-15022 | | 2026-01-05 | Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting (XSS) if caption content is derived from use… | |
CVE-2025-15462 | High | 8.8 | 2026-01-05 | A vulnerability has been found in UTT 进取 520W 1.7.7-180627. This issue affects the function strcpy of the file /goform/ConfigAdvideo. The manipulation of the a… |
CVE-2025-15461 | High | 8.8 | 2026-01-05 | A flaw has been found in UTT 进取 520W 1.7.7-180627. This vulnerability affects the function strcpy of the file /goform/formTaskEdit. Executing a manipulation of… |
CVE-2025-9543 | Low | 3.5 | 2026-01-05 | The FlexTable WordPress plugin before 3.19.2 does not sanitise and escape the imported links from Google Sheet cells, which could allow high privilege users s… |
CVE-2025-15460 | High | 8.8 | 2026-01-05 | A vulnerability was detected in UTT 进取 520W 1.7.7-180627. This affects the function strcpy of the file /goform/formPptpClientConfig. Performing a manipulation… |
CVE-2025-15459 | High | 8.8 | 2026-01-05 | A security vulnerability has been detected in UTT 进取 520W 1.7.7-180627. Affected by this issue is the function strcpy of the file /goform/formUser. Such manipu… |
CVE-2025-14124 | High | 8.6 | 2026-01-05 | The Team WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to u… |