2025 CVEs (page 51)
Page 51 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-59955 | Medium | 5.7 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.8 h… |
CVE-2025-59158 | High | 8.0 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Coolify versions prior to and including v4.0.0-beta.420.6 a… |
CVE-2025-59157 | Critical | 9.9 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, the Git Repository field… |
CVE-2025-59156 | High | 8.8 | 2026-01-05 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to version 4.0.0-beta.420.7, a Remote Code Execution… |
CVE-2025-55204 | High | 8.8 | 2026-01-05 | muffon is a cross-platform music streaming client for desktop. Versions prior to 2.3.0 have a one-click Remote Code Execution (RCE) vulnerability in. An attack… |
CVE-2025-67316 | Medium | 5.4 | 2026-01-05 | An issue in realme Internet browser v.45.13.4.1 allows a remote attacker to execute arbitrary code via a crafted webpage in the built-in HeyTap/ColorOS browser… |
CVE-2025-59467 | High | 7.5 | 2026-01-05 | A Cross-Site Scripting (XSS) vulnerability in the UCRM Argentina AFIP invoices Plugin (v1.2.0 and earlier) could allow privilege escalation if an Administrator… |
CVE-2025-57836 | High | 7.8 | 2026-01-05 | An issue was discovered in Samsung Magician 6.3.0 through 8.3.2 on Windows. The installer creates a temporary folder with weak permissions during installation… |
CVE-2025-53344 | Medium | 4.3 | 2026-01-05 | Cross-Site Request Forgery (CSRF) vulnerability in ThimPress Thim Core allows Cross Site Request Forgery.This issue affects Thim Core: from n/a through 2.3.3. |
CVE-2025-52519 | High | 7.1 | 2026-01-05 | An issue was discovered in the Camera in Samsung Mobile Processor and Wearable Processor Exynos 1330, 1380, 1480, 2400, 1580, and 2500. Improper validation of… |
CVE-2025-46255 | High | 7.5 | 2026-01-05 | Missing Authorization vulnerability in Marketing Fire LLC LoginWP - Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Logi… |
CVE-2025-39561 | Medium | 6.5 | 2026-01-05 | Missing Authorization vulnerability in Marketing Fire, LLC LoginWP - Pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Log… |
CVE-2025-39497 | Medium | 6.5 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dokan Dokan Pro allows Stored XSS.This issue affects Doka… |
CVE-2025-39484 | Critical | 9.3 | 2026-01-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Waituk Entrada allows SQL Injection.This issue affects En… |
CVE-2025-10933 | | 2026-01-05 | An integer underflow vulnerability in the Silicon Labs Z-Wave Protocol Controller can lead to out of bounds memory reads. | |
CVE-2025-67303 | High | 7.5 | 2026-01-05 | An issue in ComfyUI-Manager prior to version 3.38 allowed remote attackers to potentially manipulate its configuration and critical data. This was due to the a… |
CVE-2025-65328 | Medium | 6.5 | 2026-01-05 | Mega-Fence (webgate-lib.*) 25.1.914 and prior trusts the first value of the X-Forwarded-For (XFF) header as the client IP without validating a trusted proxy ch… |
CVE-2025-14346 | Critical | 9.8 | 2026-01-05 | WHILL Model C2 Electric Wheelchairs and Model F Power Chairs do not enforce authentication for Bluetooth connections. An attacker within range can pair with th… |
CVE-2025-66376 | High | 7.2 | 2026-01-05 | Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives in an HTM… |
CVE-2025-15029 | Critical | 9.8 | 2026-01-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQ… |
CVE-2025-15026 | Critical | 9.8 | 2026-01-05 | Missing Authentication for Critical Function vulnerability in Centreon Infra Monitoring centreon-awie (Awie import module) allows Accessing Functionality Not P… |
CVE-2025-68280 | Medium | 6.5 | 2026-01-05 | Improper Restriction of XML External Entity Reference vulnerability in Apache SIS. It is possible to write XML files in such a way that, when parsed by Apac… |
CVE-2025-12513 | Medium | 6.8 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hosts configuration for… |
CVE-2025-12511 | Medium | 6.8 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (DSM extenstio configura… |
CVE-2025-69087 | High | 8.1 | 2026-01-05 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes FreeAgent freeagent allows P… |
CVE-2025-68865 | Critical | 9.3 | 2026-01-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Infility Infility Global infility-global allows SQL Injec… |
CVE-2025-68850 | High | 7.5 | 2026-01-05 | Missing Authorization vulnerability in codepeople Sell Downloads sell-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-68547 | High | 7.5 | 2026-01-05 | Missing Authorization vulnerability in wpweb Follow My Blog Post follow-my-blog-post allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-68044 | High | 8.6 | 2026-01-05 | Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorr… |
CVE-2025-68033 | High | 7.5 | 2026-01-05 | Insertion of Sensitive Information Into Sent Data vulnerability in Brecht Custom Related Posts custom-related-posts allows Retrieve Embedded Sensitive Data.Thi… |
CVE-2025-68029 | Medium | 6.3 | 2026-01-05 | Insertion of Sensitive Information Into Sent Data vulnerability in WP Swings Wallet System for WooCommerce wallet-system-for-woocommerce allows Retrieve Embedd… |
CVE-2025-68014 | Medium | 6.5 | 2026-01-05 | Insertion of Sensitive Information Into Sent Data vulnerability in awethemes AweBooking awebooking allows Retrieve Embedded Sensitive Data.This issue affects A… |
CVE-2025-31048 | Critical | 9.9 | 2026-01-05 | Unrestricted Upload of File with Dangerous Type vulnerability in Themify Shopo allows Upload a Web Shell to a Web Server.This issue affects Shopo: from n/a thr… |
CVE-2025-31047 | High | 8.8 | 2026-01-05 | Deserialization of Untrusted Data vulnerability in Themify Themify Edmin allows Object Injection.This issue affects Themify Edmin: from n/a through 2.0.0. |
CVE-2025-31046 | Medium | 4.3 | 2026-01-05 | Missing Authorization vulnerability in WPvibes AnyWhere Elementor Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2025-31044 | High | 8.5 | 2026-01-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Premium SEO Pack allows SQL Injection.This issue… |
CVE-2025-30633 | Critical | 9.3 | 2026-01-05 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AA-Team Amazon Native Shopping Recommendations allows SQL… |
CVE-2025-13056 | Medium | 6.8 | 2026-01-05 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Administration ACL menu… |
CVE-2025-12519 | Medium | 5.3 | 2026-01-05 | Missing Authorization vulnerability in Centreon Infra Monitoring (Administration parameters API endpoint modules) allows Accessing Functionality Not Properly C… |
CVE-2025-68766 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: irqchip/mchp-eic: Fix error code in mchp_eic_domain_alloc() If irq_domain_translate_twoce… | |
CVE-2025-68765 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: mt76: mt7615: Fix memory leak in mt7615_mcu_wtbl_sta_add() In mt7615_mcu_wtbl_sta_add()… | |
CVE-2025-68764 | High | 7.8 | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: NFS: Automounted filesystems should inherit ro,noexec,nodev,sync flags When a filesystem… |
CVE-2025-68763 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: crypto: starfive - Correctly handle return of sg_nents_for_len The return value of sg_nen… | |
CVE-2025-68762 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: net: netpoll: initialize work queue before error checks Prevent a kernel warning when net… | |
CVE-2025-68761 | High | 7.8 | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: hfs: fix potential use after free in hfs_correct_next_unused_CNID() This code calls hfs_b… |
CVE-2025-68760 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show In iommu_mmio_write(), it… | |
CVE-2025-68759 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: wifi: rtl818x: Fix potential memory leaks in rtl8180_init_rx_ring() In rtl8180_init_rx_ri… | |
CVE-2025-68758 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: backlight: led-bl: Add devlink to supplier LEDs LED Backlight is a consumer of one or mul… | |
CVE-2025-68757 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: drm/vgem-fence: Fix potential deadlock on release A timer that expires a vgem fence autom… | |
CVE-2025-68756 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock blk_mq_{add,d… | |
CVE-2025-68755 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: staging: most: remove broken i2c driver The MOST I2C driver has been completely broken fo… | |
CVE-2025-68754 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: rtc: amlogic-a4: fix double free caused by devm The clock obtained via devm_clk_get_enabl… | |
CVE-2025-68753 | High | 7.1 | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-motu: add bounds check in put_user loop for DSP events In the DSP event ha… |
CVE-2025-68752 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: iavf: Implement settime64 with -EOPNOTSUPP ptp_clock_settime() assumes every ptp_clock ha… | |
CVE-2025-68751 | | 2026-01-05 | In the Linux kernel, the following vulnerability has been resolved: s390/fpu: Fix false-positive kmsan report in fpu_vstl() A false-positive kmsan report is… | |
CVE-2025-5965 | High | 7.2 | 2026-01-05 | In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup. Improper Neutralization of Special Element… |
CVE-2025-66518 | High | 8.8 | 2026-01-05 | Any client who can access to Apache Kyuubi Server via Kyuubi frontend protocols can bypass server-side config kyuubi.session.local.dir.allow.list and use local… |
CVE-2025-15240 | High | 8.8 | 2026-01-05 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has an Arbitrary File Upload vulnerability, allowing authenticated remote attackers to upload a… |
CVE-2025-15239 | Medium | 6.5 | 2026-01-05 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary… |
CVE-2025-15238 | Medium | 6.5 | 2026-01-05 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary… |
CVE-2025-15237 | Medium | 4.3 | 2026-01-05 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder name… |
CVE-2025-15236 | Medium | 4.3 | 2026-01-05 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Path Traversal vulnerability, allowing authenticated remote attackers to read folder name… |
CVE-2025-15235 | Medium | 6.5 | 2026-01-05 | QOCA aim AI Medical Cloud Platform developed by Quanta Computer has a Missing Authorization vulnerability, allowing authenticated remote attackers to modify sp… |
CVE-2025-15022 | | 2026-01-05 | Action captions in Vaadin accept HTML by default but were not sanitized, potentially allowing Cross-site Scripting (XSS) if caption content is derived from use… | |
CVE-2025-15462 | High | 8.8 | 2026-01-05 | A vulnerability has been found in UTT 进取 520W 1.7.7-180627. This issue affects the function strcpy of the file /goform/ConfigAdvideo. The manipulation of the a… |
CVE-2025-15461 | High | 8.8 | 2026-01-05 | A flaw has been found in UTT 进取 520W 1.7.7-180627. This vulnerability affects the function strcpy of the file /goform/formTaskEdit. Executing a manipulation of… |
CVE-2025-9543 | Low | 3.5 | 2026-01-05 | The FlexTable WordPress plugin before 3.19.2 does not sanitise and escape the imported links from Google Sheet cells, which could allow high privilege users s… |
CVE-2025-15460 | High | 8.8 | 2026-01-05 | A vulnerability was detected in UTT 进取 520W 1.7.7-180627. This affects the function strcpy of the file /goform/formPptpClientConfig. Performing a manipulation… |
CVE-2025-15459 | High | 8.8 | 2026-01-05 | A security vulnerability has been detected in UTT 进取 520W 1.7.7-180627. Affected by this issue is the function strcpy of the file /goform/formUser. Such manipu… |
CVE-2025-14124 | High | 8.6 | 2026-01-05 | The Team WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to u… |
CVE-2025-15458 | High | 7.3 | 2026-01-05 | A vulnerability was determined in bg5sbk MiniCMS up to 1.8. This affects an unknown function of the file /mc-admin/post-edit.php of the component Article Handl… |
CVE-2025-15457 | High | 7.3 | 2026-01-05 | A vulnerability was found in bg5sbk MiniCMS up to 1.8. The impacted element is an unknown function of the file /minicms/mc-admin/post.php of the component Tras… |
CVE-2025-15456 | High | 7.3 | 2026-01-05 | A vulnerability has been found in bg5sbk MiniCMS up to 1.8. The affected element is an unknown function of the file /mc-admin/page-edit.php of the component Pu… |
CVE-2025-15455 | Medium | 6.5 | 2026-01-05 | A flaw has been found in bg5sbk MiniCMS up to 1.8. Impacted is the function delete_page of the file /minicms/mc-admin/page.php of the component File Recovery R… |
CVE-2025-15454 | Low | 3.1 | 2026-01-05 | A vulnerability was detected in zhanglun lettura up to 0.1.22. This issue affects some unknown processing of the file src/components/ArticleView/ContentRender… |
CVE-2025-15453 | Medium | 6.3 | 2026-01-05 | A security vulnerability has been detected in milvus up to 2.6.7. This vulnerability affects the function expr.Exec of the file pkg/util/expr/expr.go of the co… |
CVE-2025-15452 | Low | 2.4 | 2026-01-05 | A weakness has been identified in xnx3 wangmarket up to 4.9. This affects the function variableList of the file /admin/system/variableList.do of the component… |
CVE-2025-15451 | Low | 2.4 | 2026-01-05 | A security flaw has been discovered in xnx3 wangmarket up to 4.9. Affected by this issue is some unknown functionality of the file /admin/system/variableSave.d… |
CVE-2025-15450 | Medium | 6.3 | 2026-01-05 | A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected by this vulnerability is the function findOrderH… |
CVE-2025-5591 | Medium | 5.4 | 2026-01-05 | Kentico Xperience 13 is vulnerable to a stored cross-site scripting attack via a form component, allowing an attacker to hijack a victim user’s session and per… |
CVE-2025-15449 | Medium | 5.4 | 2026-01-05 | A vulnerability was determined in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. Affected is the function delete of the file src/main/ja… |
CVE-2025-15448 | Medium | 6.3 | 2026-01-05 | A vulnerability was found in cld378632668 JavaMall up to 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. This impacts the function Upload of the file src/main/java/c… |
CVE-2025-15443 | Medium | 4.7 | 2026-01-04 | A vulnerability was identified in CRMEB up to 5.6.1. This issue affects some unknown processing of the file /adminapi/product/product_export. Such manipulation… |
CVE-2025-15442 | Medium | 4.7 | 2026-01-04 | A vulnerability was determined in CRMEB up to 5.6.1. This vulnerability affects unknown code of the file /adminapi/export/product_list. This manipulation of th… |
CVE-2025-14830 | Medium | 4.9 | 2026-01-04 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in JFrog Artifactory (Workers) allows Cross-Site Scri… |
CVE-2025-3660 | Medium | 6.5 | 2026-01-04 | Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains a broken access control vulnerability that allows authenticated users to access other users'… |
CVE-2025-3654 | Medium | 5.3 | 2026-01-04 | Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an information disclosure vulnerability that allows unauthorized access to device hardware in… |
CVE-2025-3653 | High | 7.3 | 2026-01-04 | Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an improper access control vulnerability that allows unauthorized device manipulation by acce… |
CVE-2025-3652 | Medium | 5.3 | 2026-01-04 | Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an information disclosure vulnerability that allows unauthorized access to private audio reco… |
CVE-2025-3646 | High | 7.3 | 2026-01-04 | Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authorization bypass vulnerability that allows unauthorized users to add users as shared o… |
CVE-2025-15115 | Medium | 6.5 | 2026-01-04 | Petlibro Smart Pet Feeder Platform versions up to 1.7.31 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any us… |
CVE-2025-64125 | | 2026-01-03 | A vulnerability in Nuvation Energy nCloud VPN Service allowed Network Boundary Bridging.This issue affected the nCloud VPN Service and was fixed on 2025-12-1 (… | |
CVE-2025-64124 | High | 8.8 | 2026-01-03 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows… |
CVE-2025-64123 | Critical | 9.8 | 2026-01-02 | Unintended Proxy or Intermediary vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Network Boundary Bridging.This issue affects Multi-Stack… |
CVE-2025-64122 | Medium | 5.5 | 2026-01-02 | Insufficiently Protected Credentials vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Signature Spoofing by Key Theft.This issue affects Mu… |
CVE-2025-64121 | Critical | 9.8 | 2026-01-02 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Authentication Bypass.This issue… |
CVE-2025-64120 | High | 8.8 | 2026-01-02 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows… |
CVE-2025-64119 | | 2026-01-02 | A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This issue affects Battery Management System: through 2.3.9. | |
CVE-2025-69417 | Medium | 5.0 | 2026-01-02 | In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via… |
CVE-2025-69416 | Medium | 5.0 | 2026-01-02 | In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via… |