2025 CVEs (page 50)
Page 50 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-14979 | High | 7.8 | 2026-01-06 | AirVPN Eddie on MacOS contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root.This issue affects Eddie: 2.2… |
CVE-2025-46696 | Medium | 6.4 | 2026-01-06 | Dell Secure Connect Gateway (SCG) 5.0 Appliance and Application, version(s) versions 5.26 to 5.30, contain(s) an Execution with Unnecessary Privileges vulnerab… |
CVE-2025-14026 | High | 7.8 | 2026-01-06 | Forcepoint One DLP Client, version 23.04.5642 (and possibly newer versions), includes a restricted version of Python 2.5.4 that prevents use of the ctypes libr… |
CVE-2025-9637 | Medium | 6.5 | 2026-01-06 | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missi… |
CVE-2025-9318 | Medium | 6.5 | 2026-01-06 | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to time-based SQL Injection via the ‘is_linking’ parameter in… |
CVE-2025-14552 | Medium | 6.4 | 2026-01-06 | The MediaPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mpp-uploader shortcode in all versions up to, and including… |
CVE-2025-9294 | Medium | 4.3 | 2026-01-06 | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check… |
CVE-2025-5919 | Medium | 6.5 | 2026-01-06 | The Appointment Booking and Scheduling Calendar Plugin – WP Timetics plugin for WordPress is vulnerable to unauthorized access and modification of data due to… |
CVE-2025-13964 | Medium | 5.3 | 2026-01-06 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the catch_lp… |
CVE-2025-13766 | Medium | 5.4 | 2026-01-06 | The MasterStudy LMS WordPress Plugin – for Online Courses and Education plugin for WordPress is vulnerable to unauthorized modification and deletion of data du… |
CVE-2025-14371 | Medium | 4.3 | 2026-01-06 | The Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca… |
CVE-2025-13812 | Medium | 4.3 | 2026-01-06 | The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to unauthorized access of da… |
CVE-2025-12067 | Medium | 6.4 | 2026-01-06 | The Table Field Add-on for ACF and SCF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Cell Content in all versions up to, and… |
CVE-2025-4776 | Medium | 6.4 | 2026-01-06 | The Phlox theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `data-caption` HTML attribute in all versions up to, and including, 2.17.7 d… |
CVE-2025-13215 | Medium | 5.3 | 2026-01-06 | The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.17.13 via… |
CVE-2025-15001 | Critical | 9.8 | 2026-01-06 | The FS Registration Password plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.1. This… |
CVE-2025-14997 | High | 8.8 | 2026-01-06 | The BuddyPress Xprofile Custom Field Types plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delet… |
CVE-2025-14996 | Critical | 9.8 | 2026-01-06 | The AS Password Field In Default Registration Form plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and i… |
CVE-2025-14441 | Medium | 4.3 | 2026-01-06 | The Popupkit plugin for WordPress is vulnerable to arbitrary subscriber data deletion due to missing authorization on the DELETE `/subscribers` REST API endpoi… |
CVE-2025-14438 | Medium | 6.4 | 2026-01-06 | The Xagio SEO – AI Powered SEO plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.1.0.30 via the 'pixaba… |
CVE-2025-14120 | Medium | 6.4 | 2026-01-06 | The URL Image Importer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 1.0.7 due t… |
CVE-2025-14153 | Medium | 6.5 | 2026-01-06 | The Page Expire Popup/Redirection for WordPress plugin for WordPress is vulnerable to time-based SQL Injection via the 'id' shortcode attribute in all versions… |
CVE-2025-14034 | Medium | 5.3 | 2026-01-06 | The ilGhera Support System for WooCommerce plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check o… |
CVE-2025-13746 | Medium | 6.4 | 2026-01-06 | The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User's Display Name in all versions up to, and… |
CVE-2025-13652 | Medium | 6.5 | 2026-01-06 | The CBX Bookmark & Favorite plugin for WordPress is vulnerable to generic SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.0.4… |
CVE-2025-13409 | Medium | 4.9 | 2026-01-06 | The Form Vibes – Database Manager for Forms plugin for WordPress is vulnerable to SQL Injection via the 'params' parameter in all versions up to, and including… |
CVE-2025-11723 | Medium | 6.5 | 2026-01-06 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all vers… |
CVE-2025-11370 | Medium | 5.3 | 2026-01-06 | The Popup and Slider Builder by Depicter – Add Email collecting Popup, Popup Modal, Coupon Popup, Image Slider, Carousel Slider, Post Slider Carousel plugin fo… |
CVE-2025-12793 | High | 7.8 | 2026-01-06 | An uncontrolled DLL loading path vulnerability exists in AsusSoftwareManagerAgent. A local attacker may influence the application to load a DLL from an attacke… |
CVE-2025-20807 | Medium | 6.7 | 2026-01-06 | In dpe, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already o… |
CVE-2025-20806 | Medium | 6.7 | 2026-01-06 | In dpe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained… |
CVE-2025-20805 | Medium | 6.7 | 2026-01-06 | In dpe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained… |
CVE-2025-20804 | Medium | 6.7 | 2026-01-06 | In dpe, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained… |
CVE-2025-20803 | Medium | 6.7 | 2026-01-06 | In dpe, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has already obt… |
CVE-2025-20802 | Medium | 6.7 | 2026-01-06 | In geniezone, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already ob… |
CVE-2025-20801 | High | 7.0 | 2026-01-06 | In seninf, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obt… |
CVE-2025-20800 | High | 7.8 | 2026-01-06 | In mminfra, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2025-20799 | High | 7.8 | 2026-01-06 | In c2ps, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtaine… |
CVE-2025-20798 | High | 7.8 | 2026-01-06 | In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2025-20797 | High | 7.8 | 2026-01-06 | In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2025-20796 | High | 7.8 | 2026-01-06 | In imgsys, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege if a malicious actor has… |
CVE-2025-20795 | High | 7.8 | 2026-01-06 | In KeyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has… |
CVE-2025-20794 | Medium | 6.5 | 2026-01-06 | In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base… |
CVE-2025-20793 | Medium | 6.5 | 2026-01-06 | In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base… |
CVE-2025-20787 | Medium | 6.7 | 2026-01-06 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-20786 | Medium | 6.7 | 2026-01-06 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-20785 | Medium | 6.7 | 2026-01-06 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-20784 | Medium | 6.7 | 2026-01-06 | In display, there is a possible memory corruption due to uninitialized data. This could lead to local escalation of privilege if a malicious actor has already… |
CVE-2025-20783 | Medium | 6.7 | 2026-01-06 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2025-20782 | Medium | 6.7 | 2026-01-06 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2025-20781 | High | 7.8 | 2026-01-06 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-20780 | High | 7.8 | 2026-01-06 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-20779 | High | 7.0 | 2026-01-06 | In display, there is a possible use after free due to a race condition. This could lead to local escalation of privilege if a malicious actor has already obtai… |
CVE-2025-20778 | High | 7.8 | 2026-01-06 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2025-20762 | Medium | 6.5 | 2026-01-06 | In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base… |
CVE-2025-20761 | Medium | 6.5 | 2026-01-06 | In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base… |
CVE-2025-20760 | Medium | 6.5 | 2026-01-06 | In Modem, there is a possible read of uninitialized heap data due to an uncaught exception. This could lead to remote denial of service, if a UE has connected… |
CVE-2025-15385 | Critical | 9.8 | 2026-01-06 | Insufficient Verification of Data Authenticity vulnerability in TECNO Mobile com.Afmobi.Boomplayer allows Authentication Bypass.This issue affects com.Afmobi.B… |
CVE-2025-15364 | High | 7.3 | 2026-01-06 | The Download Manager plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 3.3.40. This is due… |
CVE-2025-69197 | Medium | 6.5 | 2026-01-06 | Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity window. Us… |
CVE-2025-68954 | Medium | 5.4 | 2026-01-06 | Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is removed from a… |
CVE-2025-15444 | Critical | 9.8 | 2026-01-06 | Crypt::Sodium::XS module versions prior to 0.000042, for Perl, include a vulnerable version of libsodium libsodium <= 1.0.20 or a version of libsodium release… |
CVE-2025-69230 | Medium | 5.3 | 2026-01-06 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a lo… |
CVE-2025-69229 | Medium | 5.3 | 2026-01-06 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excess… |
CVE-2025-69228 | High | 7.5 | 2026-01-06 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an A… |
CVE-2025-69227 | High | 7.5 | 2026-01-06 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow for an infinite loop to occur when assert state… |
CVE-2025-69225 | Medium | 5.3 | 2026-01-06 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals… |
CVE-2025-69226 | Medium | 5.3 | 2026-01-05 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of abso… |
CVE-2025-69224 | Medium | 6.5 | 2026-01-05 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggli… |
CVE-2025-69223 | High | 7.5 | 2026-01-05 | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against… |
CVE-2025-68953 | High | 7.5 | 2026-01-05 | Frappe is a full-stack web application framework. Versions 14.99.5 and below and 15.0.0 through 15.80.1 include requests that are vulnerable to path traversal… |
CVE-2025-68456 | Critical | 9.1 | 2026-01-05 | Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger databa… |
CVE-2025-68455 | High | 7.2 | 2026-01-05 | Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated… |
CVE-2025-68454 | High | 8.8 | 2026-01-05 | Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated… |
CVE-2025-68437 | Medium | 6.8 | 2026-01-05 | Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, the Craft CMS GraphQL `save_<VolumeNa… |
CVE-2025-68436 | Medium | 6.5 | 2026-01-05 | Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16, authenticated users on a Craft instal… |
CVE-2025-68428 | High | 7.5 | 2026-01-05 | jsPDF is a library to generate PDFs in JavaScript. Prior to version 4.0.0, user control of the first argument of the loadFile method in the node.js build allow… |
CVE-2025-67732 | Medium | 6.5 | 2026-01-05 | Dify is an open-source LLM app development platform. Prior to version 1.11.0, the API key is exposed in plaintext to the frontend, allowing non-administrator u… |
CVE-2025-66648 | High | 7.2 | 2026-01-05 | vega-functions provides function implementations for the Vega expression language. Prior to version 6.1.1, for sites that allow users to supply untrusted user… |
CVE-2025-65110 | High | 8.1 | 2026-01-05 | Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Prior to versions 6.1.2 and 5.6.3, a… |
CVE-2025-61916 | High | 7.9 | 2026-01-05 | Spinnaker is an open source, multi-cloud continuous delivery platform. Versions prior to 2025.1.6, 2025.2.3, and 2025.3.0 are vulnerable to server-side request… |
CVE-2025-64425 | High | 8.1 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, an… |
CVE-2025-64424 | High | 8.8 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a… |
CVE-2025-64423 | High | 8.8 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a… |
CVE-2025-64422 | Medium | 4.3 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify vstarting with version 4.0.0-beta.434, the /logi… |
CVE-2025-67427 | Medium | 6.5 | 2026-01-05 | A Blind Server-Side Request Forgery (SSRF) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to force the server to initiate an HTTP r… |
CVE-2025-67419 | High | 7.5 | 2026-01-05 | A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaust the application server's resources via the "GET… |
CVE-2025-64421 | High | 8.0 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions up to and including v4.0.0-beta.434, a… |
CVE-2025-64420 | Critical | 9.9 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. In Coolify versions prior to and including v4.0.0-beta.434… |
CVE-2025-64419 | Critical | 9.6 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.445, parameters coming from doc… |
CVE-2025-67397 | Critical | 9.1 | 2026-01-05 | An issue in Passy v.1.6.3 allows a remote authenticated attacker to execute arbitrary commands via a crafted HTTP request using a specific payload injection. |
CVE-2025-53966 | High | 8.4 | 2026-01-05 | An issue was discovered in Samsung Mobile Processor Exynos 1380, 1480, 2400, and 1580. Incorrect Handling of the NL80211 vendor command leads to a buffer overf… |
CVE-2025-52517 | Medium | 5.9 | 2026-01-05 | An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. A race condition in the iss… |
CVE-2025-52516 | Medium | 6.2 | 2026-01-05 | An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. An invalid kernel address d… |
CVE-2025-52515 | Medium | 5.1 | 2026-01-05 | An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, 2500. A race condition in the iss… |
CVE-2025-49495 | High | 8.4 | 2026-01-05 | An issue was discovered in the WiFi driver in Samsung Mobile Processor Exynos 1380, 1480, 2400, 1580. Mishandling of an NL80211 vendor command leads to a buffe… |
CVE-2025-43706 | High | 7.5 | 2026-01-05 | An issue was discovered in L2 in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2400, 1580, 9110, W920, W930, Modem 5123… |
CVE-2025-27807 | Critical | 9.1 | 2026-01-05 | An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 1580… |
CVE-2025-65922 | Medium | 4.3 | 2026-01-05 | PLANKA 2.0.0 lacks X-Frame-Options and CSP frame-ancestors headers, allowing the application to be embedded within malicious iframes. While this does not lead… |
CVE-2025-61781 | High | 7.1 | 2026-01-05 | OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.1, the GraphQL mutation "WorkspacePop… |