2025 CVEs (page 5)
Page 5 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-71359 | High | 8.1 | 2026-07-04 | picklescan before 0.0.29 fails to detect malicious pickle payloads that utilize lib2to3.pgen2.grammar.Grammar.loads in the reduce method, allowing remote code… |
CVE-2025-71356 | High | 8.1 | 2026-07-04 | picklescan before 0.0.28 fails to detect malicious torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression function calls in pickle files. At… |
CVE-2025-71353 | High | 8.1 | 2026-07-04 | picklescan before 0.0.28 fails to detect malicious pickle files that exploit torch._dynamo.guards.GuardBuilder.get function in reduce methods. Attackers can cr… |
CVE-2025-71347 | High | 8.1 | 2026-07-04 | picklescan before 0.0.33 fails to detect malicious pickle files using numpy.f2py.crackfortran.param_eval function in reduce methods, allowing attackers to bypa… |
CVE-2025-71345 | High | 8.1 | 2026-07-04 | picklescan before 0.0.30 fails to detect malicious pickle files that invoke torch.utils.bottleneck.__main__.run_autograd_prof function. Attackers can embed und… |
CVE-2025-71343 | High | 8.1 | 2026-07-04 | picklescan before 0.0.30 fails to detect malicious pickle files that exploit lib2to3.pgen2.pgen.ParserGenerator.make_label function in the reduce method. Attac… |
CVE-2025-71342 | High | 8.1 | 2026-07-04 | picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.run.Executive.runcode in reduce methods. Attackers can embed undetected code in p… |
CVE-2025-71385 | Medium | 6.1 | 2026-07-02 | Netdata before 2.3.1 reflects the user-supplied love query parameter of the api/v2/ilove.svg and api/v3/ilove.svg endpoints verbatim into the generated SVG doc… |
CVE-2025-69156 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Kids Zone - Children WordPress Theme <= 5.4 versions. |
CVE-2025-69155 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Fitness Zone WordPress Theme <= 5.7 versions. |
CVE-2025-69154 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in SpaLab | Beauty Salon WordPress Theme <= 6.7 versions. |
CVE-2025-69153 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Trendy Travel <= 6.7 versions. |
CVE-2025-69152 | High | 7.1 | 2026-07-02 | Unauthenticated Cross Site Scripting (XSS) in Artale | Wedding Photography WordPress <= 2.2.2 versions. |
CVE-2025-69134 | High | 7.5 | 2026-07-02 | Unauthenticated Arbitrary Content Deletion in OpenAI Chatbot for WordPress – Helper <= 1.1.4 versions. |
CVE-2025-69133 | High | 7.5 | 2026-07-02 | Subscriber Local File Inclusion in Tourmaster <= 5.4.5 versions. |
CVE-2025-69132 | Medium | 6.5 | 2026-07-02 | Subscriber Sensitive Data Exposure in Corpkit <= 1.0.5 versions. |
CVE-2025-69094 | High | 8.5 | 2026-07-02 | Subscriber SQL Injection in Unicamp <= 2.2.2 versions. |
CVE-2025-66076 | Medium | 5.3 | 2026-07-02 | Unauthenticated Broken Access Control in Woostify Sites Library <= 1.6.2 versions. |
CVE-2025-58902 | High | 8.1 | 2026-07-02 | Unauthenticated Local File Inclusion in Lighthouse <= 1.2.12 versions. |
CVE-2025-23351 | Critical | 9.0 | 2026-07-01 | NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bo… |
CVE-2025-23350 | Critical | 9.0 | 2026-07-01 | NVIDIA ConnectX and BlueField contain a vulnerability in the command interface where a local user with virtual function (VF) access may cause a write out of bo… |
CVE-2025-15646 | Critical | 9.8 | 2026-07-01 | HTML::Gumbo versions before 0.19 for Perl disclose heap memory via type confusion. Support for the <template> element was added to libgumbo 0.10.0 in 2015, bu… |
CVE-2025-15666 | Medium | 5.3 | 2026-07-01 | A security vulnerability has been detected in Open Asset Import Library Assimp up to 5.4.3. Affected by this vulnerability is the function Assimp::SceneCombine… |
CVE-2025-71381 | Medium | 6.5 | 2026-06-30 | Hono before 4.10.2 (fixed in 4.10.3) contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the… |
CVE-2025-71374 | High | 8.1 | 2026-06-30 | picklescan before 0.0.29 fails to detect the built-in python profile.Profile.run function when used in pickle reduce methods, allowing attackers to execute arb… |
CVE-2025-71371 | High | 8.1 | 2026-06-30 | picklescan before 0.0.29 fails to detect malicious pickle files using code.InteractiveInterpreter.runcode in reduce methods. Attackers can craft pickle payload… |
CVE-2025-71368 | High | 8.1 | 2026-06-30 | picklescan before 0.0.30 fails to detect the doctest.debug_script function when analyzing pickle files, allowing attackers to execute arbitrary code. Remote at… |
CVE-2025-71363 | High | 8.1 | 2026-06-30 | picklescan before 0.0.30 fails to detect cProfile.run function calls in pickle reduce methods, allowing attackers to execute arbitrary code. Remote attackers c… |
CVE-2025-71355 | | 2026-06-30 | Picklescan before 0.0.25 fails to detect unsafe global functions in the Numpy library, allowing attackers to bypass static analysis and execute arbitrary code… | |
CVE-2025-71352 | High | 8.1 | 2026-06-30 | picklescan before 0.0.29 fails to detect the built-in Python trace.Trace.runctx function when used in pickle file reduce methods, allowing attackers to execute… |
CVE-2025-71350 | High | 8.1 | 2026-06-30 | picklescan before 0.0.28 fails to detect malicious pickle files using torch.utils.collect_env.run function in reduce methods. Attackers can embed undetected co… |
CVE-2025-71349 | High | 8.1 | 2026-06-30 | picklescan before 0.0.29 fails to detect the built-in trace.Trace.run function when analyzing pickle files, allowing attackers to embed undetected malicious co… |
CVE-2025-36359 | High | 8.1 | 2026-06-30 | IBM DevOps Automation 1.0.1 and IBM DevOps Loop 1.0.2 does not invalidate session IDs after expiration which could allow an authenticated user to impersonate a… |
CVE-2025-36336 | Medium | 5.9 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 transmits data in clear text that could allow an attacker to obtain sensitive information using man in… |
CVE-2025-36333 | Medium | 4.3 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to perform unauthorized actions due to the improper enforcement of b… |
CVE-2025-36328 | Medium | 4.3 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message… |
CVE-2025-36327 | Medium | 6.5 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to bypass security controls and perform unauthorized actions due to… |
CVE-2025-36324 | Medium | 4.3 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 s vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send u… |
CVE-2025-36323 | Medium | 5.4 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitr… |
CVE-2025-36321 | Medium | 5.7 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed… |
CVE-2025-36320 | Medium | 6.4 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed… |
CVE-2025-36319 | Medium | 4.3 | 2026-06-30 | IBM watsonx.data intelligence 5.2.0, 5.2.1, 5.2.2, 5.3.0 could allow an authenticated user to cause a temporary denial using a specially crafted HTTP request d… |
CVE-2025-12530 | Medium | 5.9 | 2026-06-30 | IBM watsonx.data intelligence 5.2.2, 5.3.0, 5.3.1, 5.3.1 through Patch 1 transmits data in clear text that could allow an attacker to obtain sensitive informat… |
CVE-2025-36372 | Medium | 5.5 | 2026-06-30 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information to an a… |
CVE-2025-53648 | Medium | 5.4 | 2026-06-30 | SQL misconfiguration in the Gravitino UI, in versions 1.0.0 and below, can allow a malicious user to read or truncate files. Users are recommended to upgrade t… |
CVE-2025-7406 | High | 7.8 | 2026-06-30 | Nokia MantaRay NM is vulnerable to a sudo privilege escalation vulnerability where a local attacker possessing administrative (local admin) privileges can esca… |
CVE-2025-24816 | Medium | 6.5 | 2026-06-30 | Nokia MantaRay is subject to an Improper Access Control vulnerability due to insufficient authorization within the API. Successful exploitation could allow an… |
CVE-2025-24815 | High | 7.8 | 2026-06-30 | Nokia MantaRay NM is subject to an unrestricted file upload vulnerability due to insufficient file type validation. Successful exploitation could allow an auth… |
CVE-2025-7386 | Medium | 6.8 | 2026-06-29 | Information exposure vulnerability in Hitachi Storage Navigator. This issue affects Hitachi Virtual Storage Platform 5100, 5200, 5500, 5600, 5100H, 5200H, 550… |
CVE-2025-2902 | High | 8.3 | 2026-06-29 | Improper Authorization Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual Storage Platform E390, E59… |
CVE-2025-0824 | Low | 3.7 | 2026-06-29 | Lack of validation for firmware update in Hitachi Hitachi Virtual Storage Platform One Block 23, 24, 26, 28. This issue affects Hitachi Virtual Storage Platfo… |
CVE-2025-59868 | Medium | 5.5 | 2026-06-27 | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to a sensitive data exposure vulnerability which could allow an attacker to exploit application inform… |
CVE-2025-32423 | | 2026-06-26 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.32, there is a DoS vuln… | |
CVE-2025-32394 | | 2026-06-26 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.32, there is a DoS vuln… | |
CVE-2025-11919 | Critical | 9.6 | 2026-06-26 | The default JVM can access files and directories under `/tmp/` including the `$TemporaryDirectory` of other users on the same cloud instance (`/tmp/UserTempora… |
CVE-2025-68075 | Medium | 6.5 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in BNE Testimonials <= 2.0.8 versions. |
CVE-2025-68074 | Medium | 6.5 | 2026-06-26 | Contributor Cross Site Scripting (XSS) in Image Carousel <= 1.0.0.41 versions. |
CVE-2025-68064 | High | 7.5 | 2026-06-26 | Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions. |
CVE-2025-68063 | High | 7.5 | 2026-06-26 | Contributor Local File Inclusion in Splash - Sport Club WordPress Theme for Basketball, Football, Hockey <= 4.4.3 versions. |
CVE-2025-68052 | High | 8.8 | 2026-06-26 | Unauthenticated Cross Site Request Forgery (CSRF) in Eagle Booking <= 1.3.4.3 versions. |
CVE-2025-66123 | Medium | 5.3 | 2026-06-26 | Unauthenticated Insecure Direct Object References (IDOR) in BookPro <= 1.1.0 versions. |
CVE-2025-64637 | Medium | 5.3 | 2026-06-26 | Unauthenticated Content Injection in Auros Core <= 5.3.1 versions. |
CVE-2025-64636 | Medium | 5.3 | 2026-06-26 | Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions. |
CVE-2025-63079 | Medium | 4.3 | 2026-06-26 | Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions. |
CVE-2025-63078 | Medium | 4.3 | 2026-06-26 | Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions. |
CVE-2025-63041 | Medium | 5.4 | 2026-06-26 | Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions. |
CVE-2025-64152 | Critical | 9.1 | 2026-06-26 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 1.0.0 befo… |
CVE-2025-55017 | Critical | 9.1 | 2026-06-26 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 befo… |
CVE-2025-7958 | | 2026-06-26 | A Code Injection vulnerability existed in Trellix Network Security CM and NX. A locally authenticated admin user can execute arbitrary code using the web inter… | |
CVE-2025-10268 | Medium | 5.3 | 2026-06-26 | The Printcart Web to Print Product Designer for WooCommerce WordPress plugin through 2.4.8 is vulnerable to path traversal which makes it possible for the atta… |
CVE-2025-71340 | High | 8.1 | 2026-06-25 | picklescan through 0.0.26 fails to detect malicious pickle files that invoke idlelib.pyshell.ModifiedInterpreter.runcode in __reduce__ methods. Attackers can e… |
CVE-2025-71338 | Critical | 10.0 | 2026-06-25 | Flowise through 2.2.7 fails to sanitize path segments in the document-store loader endpoint, allowing unauthenticated attackers to write files outside the stor… |
CVE-2025-71336 | Critical | 9.8 | 2026-06-25 | Flowise before 3.0.6 (affected versions 2.2.7-patch.1 and earlier) contains an unsandboxed remote code execution vulnerability in the Custom MCP feature, which… |
CVE-2025-71335 | High | 8.1 | 2026-06-25 | Flowise before 3.0.10 (affected versions 3.0.7 and earlier) fails to invalidate existing sessions and session tokens after a user changes their password. An at… |
CVE-2025-71334 | Critical | 9.8 | 2026-06-25 | Flowise before 3.0.6 (affected versions 2.2.8 and earlier) contains an arbitrary file access vulnerability due to missing validation that the chatflowId and ch… |
CVE-2025-71333 | Critical | 9.8 | 2026-06-25 | Flowise through 2.2.4 contains an unauthenticated arbitrary file upload vulnerability in the /api/v1/attachments endpoint when storageType is set to local. Att… |
CVE-2025-71328 | High | 8.3 | 2026-06-25 | Flowise before 3.0.10 contains an unverified password change vulnerability. An authenticated user can change their account password through the account setting… |
CVE-2025-71327 | Critical | 9.1 | 2026-06-25 | Flowise contains an authentication bypass vulnerability in the unprotected /api/v1/account/register endpoint that allows unauthenticated attackers to create us… |
CVE-2025-71324 | High | 7.5 | 2026-06-25 | Flowise before 3.0.6 contains an arbitrary file read vulnerability in the chatId parameter of the /api/v1/get-upload-file and /api/v1/openai-assistants-file/do… |
CVE-2025-60465 | Medium | 6.1 | 2026-06-25 | A use-after-free in the gf_filter_pid_inst_swap function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial o… |
CVE-2025-60464 | High | 7.8 | 2026-06-25 | A use-after-free in the gf_sei_load_from_state_internal function (/filters/sei_load.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial… |
CVE-2025-60473 | Medium | 5.5 | 2026-06-25 | A NULL pointer dereference in the gf_filter_in_parent_chain function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to caus… |
CVE-2025-60466 | Medium | 5.0 | 2026-06-25 | A use-after-free in the gf_filter_pid_get_packet function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial… |
CVE-2025-60474 | High | 7.5 | 2026-06-24 | A buffer overflow in the gf_media_import function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Servi… |
CVE-2025-60467 | High | 7.5 | 2026-06-24 | A use-after-free in the gf_filter_pid_inst_swap_delete_task function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to caus… |
CVE-2025-60468 | Medium | 5.5 | 2026-06-24 | GPAC Multimedia Open Source Project GPAC Project/MP4Box 2.5-DEV-rev1593-gfe88c3545-master is affected by: Buffer Overflow. The impact is: cause a denial of ser… |
CVE-2025-64719 | Medium | 4.9 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a d… |
CVE-2025-60471 | Medium | 5.5 | 2026-06-24 | A use-after-free in the gf_filter_pid_reconfigure_task_discard function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to c… |
CVE-2025-71361 | High | 8.1 | 2026-06-24 | picklescan before 0.0.29 fails to detect malicious idlelib.calltip.Calltip.fetch_tip calls in pickle files, allowing remote code execution. Attackers can embed… |
CVE-2025-71354 | High | 8.1 | 2026-06-24 | picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods. Attackers can… |
CVE-2025-71332 | Medium | 6.5 | 2026-06-24 | Flowise through 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id value, an authentica… |
CVE-2025-64105 | | 2026-06-23 | FOSSBilling is a billing and client management system that automates invoicing, payments, and communication for online service businesses. Versions 0.6.21 thro… | |
CVE-2025-71382 | Medium | 6.5 | 2026-06-23 | MuPDF before 1.27.0-rc1 contains an uncontrolled recursion vulnerability in the EPUB CSS rendering engine that allows remote attackers to cause a denial of ser… |
CVE-2025-61029 | High | 7.5 | 2026-06-23 | An issue in the sqlo_untry component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2025-61024 | High | 7.5 | 2026-06-23 | An issue in the sqlo_try_in_loop component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statemen… |
CVE-2025-61028 | High | 7.5 | 2026-06-23 | An issue in the time_t_to_dt component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2025-61027 | High | 7.5 | 2026-06-23 | An issue in the t_set_push component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2025-61025 | High | 7.5 | 2026-06-23 | An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2025-61023 | High | 7.5 | 2026-06-23 | An issue in the st_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2025-61022 | High | 7.5 | 2026-06-23 | An issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL stateme… |