2025 CVEs (page 53)
Page 53 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-15017 | | 2025-12-31 | A vulnerability exists in serial device servers where active debug code remains enabled in the UART interface. An attacker with physical access to the device c… | |
CVE-2025-15280 | High | 8.8 | 2025-12-31 | FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2025-15279 | High | 7.8 | 2025-12-31 | FontForge GUtils BMP File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2025-15278 | High | 7.8 | 2025-12-31 | FontForge GUtils XBM File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on… |
CVE-2025-15277 | High | 7.8 | 2025-12-31 | FontForge GUtils SGI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2025-15276 | High | 7.8 | 2025-12-31 | FontForge SFD File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitra… |
CVE-2025-15275 | High | 8.8 | 2025-12-31 | FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2025-15274 | High | 8.8 | 2025-12-31 | FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2025-15273 | High | 8.8 | 2025-12-31 | FontForge PFB File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod… |
CVE-2025-15272 | High | 8.8 | 2025-12-31 | FontForge SFD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code… |
CVE-2025-15271 | High | 8.8 | 2025-12-31 | FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr… |
CVE-2025-15270 | High | 8.8 | 2025-12-31 | FontForge SFD File Parsing Improper Validation of Array Index Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitr… |
CVE-2025-15269 | High | 8.8 | 2025-12-31 | FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |
CVE-2025-14783 | Medium | 4.3 | 2025-12-31 | The Easy Digital Downloads plugin for WordPress is vulnerable to Unvalidated Redirect in all versions up to, and including, 3.6.2. This is due to insufficient… |
CVE-2025-69277 | Medium | 4.5 | 2025-12-31 | libsodium before ad3004e, in atypical use cases involving certain custom cryptography or untrusted data to crypto_core_ed25519_is_valid_point, mishandles check… |
CVE-2025-68885 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in page-carbajal Custom Post Status custom-post-status allows Stored XSS.This issue affects Custom Post Status… |
CVE-2025-49354 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Mindstien Technologies Recent Posts From Each Category recent-posts-from-each-category allows Stored XSS.Thi… |
CVE-2025-49353 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in Marcin Kijak Noindex by Path noindex-by-path allows Stored XSS.This issue affects Noindex by Path: from n/a… |
CVE-2025-49345 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in mg12 WP-EasyArchives wp-easyarchives allows Stored XSS.This issue affects WP-EasyArchives: from n/a through… |
CVE-2025-49344 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in reneade SensitiveTagCloud sensitive-tag-cloud allows Stored XSS.This issue affects SensitiveTagCloud: from n… |
CVE-2025-49343 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in socialprofilr Social Profilr social-profilr-display-social-network-profile allows Stored XSS.This issue affe… |
CVE-2025-49342 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in merzedes Custom Style custom-style allows Stored XSS.This issue affects Custom Style: from n/a through <= 1… |
CVE-2025-14434 | Medium | 5.3 | 2025-12-31 | The Ultimate Post Kit Addons for Elementor WordPress plugin before 4.0.16 exposes multiple AJAX “load more” endpoints such as upk_alex_grid_loadmore_posts with… |
CVE-2025-13029 | High | 7.5 | 2025-12-31 | The Knowband Mobile App Builder WordPress plugin before 3.0.0 does not have authorisation when deleting users via its REST API, allowing unauthenticated attack… |
CVE-2025-59137 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in eleopard Behance Portfolio Manager portfolio-manager-powered-by-behance allows Stored XSS.This issue affects… |
CVE-2025-49346 | High | 7.1 | 2025-12-31 | Cross-Site Request Forgery (CSRF) vulnerability in peterwsterling Simple Archive Generator simple-archive-generator allows Stored XSS.This issue affects Simple… |
CVE-2025-15375 | Medium | 6.3 | 2025-12-31 | A flaw has been found in EyouCMS up to 1.7.7. The impacted element is the function unserialize of the file application/api/controller/Ajax.php of the component… |
CVE-2025-15374 | Low | 3.5 | 2025-12-31 | A vulnerability was detected in EyouCMS up to 1.7.7. The affected element is an unknown function of the file application/home/model/Ask.php of the component As… |
CVE-2025-15373 | Medium | 6.3 | 2025-12-31 | A security vulnerability has been detected in EyouCMS up to 1.7.7. Impacted is the function saveRemote of the file application/function.php. Such manipulation… |
CVE-2025-15372 | Low | 2.4 | 2025-12-31 | A weakness has been identified in youlaitech vue3-element-admin up to 3.4.0. This issue affects some unknown processing of the file src/views/system/notice/ind… |
CVE-2025-15223 | Medium | 4.3 | 2025-12-31 | A vulnerability was found in Philipinho Simple-PHP-Blog up to 94b5d3e57308bce5dfbc44c3edafa9811893d958. Impacted is an unknown function of the file /login.php… |
CVE-2025-68131 | High | 7.5 | 2025-12-31 | cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format. Starting in version 3.0.0 and prior to version 5… |
CVE-2025-15371 | High | 7.8 | 2025-12-31 | A vulnerability has been found in Tenda i24, 4G03 Pro, 4G05, 4G08, G0-8G-PoE, Nova MW5G and TEG5328F up to 65.10.15.6. Affected is an unknown function of the c… |
CVE-2025-11964 | Low | 1.9 | 2025-12-31 | On Windows only, if libpcap needs to convert a Windows error message to UTF-8 and the message includes characters that UTF-8 represents using 4 bytes, utf_16le… |
CVE-2025-11961 | Low | 1.9 | 2025-12-31 | pcap_ether_aton() is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string argument must be a wel… |
CVE-2025-62753 | High | 7.5 | 2025-12-30 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in MadrasThemes MAS Videos masvideos allo… |
CVE-2025-59131 | High | 7.1 | 2025-12-30 | Cross-Site Request Forgery (CSRF) vulnerability in hoernerfranz WP-CalDav2ICS wp-caldav2ics allows Stored XSS.This issue affects WP-CalDav2ICS: from n/a throug… |
CVE-2025-15114 | Critical | 9.8 | 2025-12-30 | Ksenia Security lares (legacy model) Home Automation version 1.6 contains a critical security flaw that exposes the alarm system PIN in the 'basisInfo' XML fil… |
CVE-2025-15113 | Critical | 9.3 | 2025-12-30 | Ksenia Security lares (legacy model) Home Automation version 1.6 contains an unprotected endpoint vulnerability that allows authenticated attackers to upload M… |
CVE-2025-15112 | Medium | 5.4 | 2025-12-30 | Ksenia Security lares (legacy model) version 1.6 contains a URL redirection vulnerability in the 'cmdOk.xml' script that allows attackers to manipulate the 're… |
CVE-2025-15111 | Critical | 9.8 | 2025-12-30 | Ksenia Security lares (legacy model) version 1.6 contains a default credentials vulnerability that allows unauthorized attackers to gain administrative access… |
CVE-2025-15360 | Medium | 4.7 | 2025-12-30 | A vulnerability was determined in newbee-mall-plus 2.0.0. This impacts the function Upload of the file src/main/java/ltd/newbee/mall/controller/common/UploadCo… |
CVE-2025-66723 | High | 7.5 | 2025-12-30 | inMusic Brands Engine DJ before 4.3.4 suffers from Insecure Permissions due to exposed HTTP service in the Remote Library, which allows attackers to access all… |
CVE-2025-61594 | High | 7.5 | 2025-12-30 | URI is a module providing classes to handle Uniform Resource Identifiers. In versions 0.12.4 and earlier (bundled in Ruby 3.2 series) 0.13.2 and earlier (bundl… |
CVE-2025-15357 | Medium | 6.3 | 2025-12-30 | A vulnerability was found in D-Link DI-7400G+ 19.12.25A1. This affects an unknown function of the file /msp_info.htm?flag=cmd. The manipulation of the argument… |
CVE-2025-15356 | High | 8.8 | 2025-12-30 | A vulnerability has been found in Tenda AC20 up to 16.03.08.12. The impacted element is the function sscanf of the file /goform/PowerSaveSet. The manipulation… |
CVE-2025-14987 | | 2025-12-30 | When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g. StartChildWorkflowExecuti… | |
CVE-2025-14986 | | 2025-12-30 | When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutio… | |
CVE-2025-69261 | High | 7.5 | 2025-12-30 | WasmEdge is a WebAssembly runtime. Prior to version 0.16.0-alpha.3, a multiplication in `WasmEdge/include/runtime/instance/memory.h` can wrap, causing `checkAc… |
CVE-2025-69257 | Medium | 6.7 | 2025-12-30 | theshit is a command-line utility that automatically detects and fixes common mistakes in shell commands. Prior to version 0.1.1, the application loads custom… |
CVE-2025-69210 | Medium | 5.4 | 2025-12-30 | FacturaScripts is open-source enterprise resource planning and accounting software. Prior to version 2025.7, a stored cross-site scripting (XSS) vulnerability… |
CVE-2025-66823 | Medium | 5.4 | 2025-12-30 | An HTML Injection vulnerability in TrueConf server 5.5.2.10813 in the conference description field allows an attacker to inject arbitrary HTML in the Create/Ed… |
CVE-2025-50343 | Critical | 9.8 | 2025-12-30 | An issue was discovered in matio 1.5.28. A heap-based memory corruption can occur in Mat_VarCreateStruct() when the nfields value does not match the actual num… |
CVE-2025-15354 | High | 7.3 | 2025-12-30 | A flaw has been found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/add_admin.php. Executing ma… |
CVE-2025-15353 | High | 7.3 | 2025-12-30 | A vulnerability was detected in itsourcecode Society Management System 1.0. Impacted is the function edit_admin_query of the file /admin/edit_admin_query.php… |
CVE-2025-69256 | High | 7.5 | 2025-12-30 | The Serverless Framework is a framework for using AWS Lambda and other managed cloud services to build applications. Starting in version 4.29.0 and prior to ve… |
CVE-2025-66835 | High | 7.1 | 2025-12-30 | TrueConf Client 8.5.2 is vulnerable to DLL hijacking via crafted wfapi.dll allowing local attackers to execute arbitrary code within the user's context. |
CVE-2025-66834 | High | 7.3 | 2025-12-30 | A CSV Formula Injection vulnerability in TrueConf Server v5.5.2.10813 allows a normal user to inject malicious spreadsheet formulas into exported chat logs via… |
CVE-2025-66824 | High | 8.7 | 2025-12-30 | A Stored Cross-Site Scripting (XSS) vulnerability exists in the Meeting location field of the Create/Edit Conference functionality in TrueConf Server v5.5.2.10… |
CVE-2025-15264 | High | 7.3 | 2025-12-30 | A vulnerability was determined in FeehiCMS up to 2.1.1. Impacted is an unknown function of the file frontend/web/timthumb.php of the component TimThumb. Execut… |
CVE-2025-15263 | High | 7.3 | 2025-12-30 | A weakness has been identified in BiggiDroid Simple PHP CMS 1.0. Affected is an unknown function of the file /admin/login.php of the component Admin Login. Exe… |
CVE-2025-65411 | High | 7.5 | 2025-12-30 | A NULL pointer dereference in the src/path.c component of GNU Unrtf v0.21.10 allows attackers to cause a Denial of Service (DoS) via injecting a crafted payloa… |
CVE-2025-65409 | High | 7.5 | 2025-12-30 | A divide-by-zero in the encryption/decryption routines of GNU Recutils v1.9 allows attackers to cause a Denial of Service (DoS) via inputting an empty value as… |
CVE-2025-56332 | Critical | 9.1 | 2025-12-30 | Authentication Bypass in fosrl/pangolin v1.6.2 and before allows attackers to access Pangolin resource via Insecure Default Configuration |
CVE-2025-15262 | Medium | 4.7 | 2025-12-30 | A security flaw has been discovered in BiggiDroid Simple PHP CMS 1.0. This impacts an unknown function of the file /admin/edit.php of the component Site Logo H… |
CVE-2025-15258 | Low | 3.5 | 2025-12-30 | A weakness has been identified in Edimax BR-6208AC 1.02/1.03. Affected by this issue is the function formALGSetup of the file /goform/formALGSetup of the compo… |
CVE-2025-69204 | Medium | 5.3 | 2025-12-30 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, in the WriteSVGImage function, using… |
CVE-2025-68950 | Medium | 4.0 | 2025-12-30 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, Magick fails to check for circular re… |
CVE-2025-68926 | Critical | 9.8 | 2025-12-30 | RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded stati… |
CVE-2025-68618 | Medium | 5.3 | 2025-12-30 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.2-12, using Magick to read a malicious SVG… |
CVE-2025-66848 | Critical | 9.8 | 2025-12-30 | JD Cloud NAS routers AX1800 (4.3.1.r4308 and earlier), AX3000 (4.3.1.r4318 and earlier), AX6600 (4.5.1.r4533 and earlier), BE6500 (4.4.1.r4308 and earlier), ER… |
CVE-2025-66103 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in revmakx WPCal.io wpcal allows DOM-Based XSS.This issue af… |
CVE-2025-66094 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in dmccan Yada Wiki yada-wiki allows Stored XSS.This issue a… |
CVE-2025-65925 | Medium | 6.5 | 2025-12-30 | An issue was discovered in Zeroheight (SaaS) prior to 2025-06-13. A legacy user creation API pathway allowed accounts to be created without completing the inte… |
CVE-2025-62128 | Medium | 4.3 | 2025-12-30 | Missing Authorization vulnerability in SiteLock SiteLock Security – WP Hardening, Login Security & Malware Scans sitelock allows Exploiting Incorrectly Configu… |
CVE-2025-62112 | Medium | 4.3 | 2025-12-30 | Cross-Site Request Forgery (CSRF) vulnerability in Merv Barrett Import into Easy Property Listings easy-property-listings-xml-csv-import allows Cross Site Requ… |
CVE-2025-59129 | High | 7.6 | 2025-12-30 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in appointify Appointify appointify allows Blind SQL Injecti… |
CVE-2025-52835 | Critical | 9.6 | 2025-12-30 | Cross-Site Request Forgery (CSRF) vulnerability in ConoHa by GMO WING WordPress Migrator wing-migrator allows Upload a Web Shell to a Web Server.This issue aff… |
CVE-2025-15257 | High | 7.3 | 2025-12-30 | A security flaw has been discovered in Edimax BR-6208AC 1.02/1.03. Affected by this vulnerability is the function formRoute of the file /gogorm/formRoute of th… |
CVE-2025-15256 | High | 7.3 | 2025-12-30 | A vulnerability was identified in Edimax BR-6208AC 1.02/1.03. Affected is the function formStaDrvSetup of the file /goform/formStaDrvSetup of the component Web… |
CVE-2025-67746 | Medium | 4.3 | 2025-12-30 | Composer is a dependency manager for PHP. In versions on the 2.x branch prior to 2.2.26 and 2.9.3, attackers controlling remote sources that Composer downloads… |
CVE-2025-66080 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Conf… |
CVE-2025-64528 | Medium | 5.3 | 2025-12-30 | Discourse is an open source discussion platform. Prior to versions 3.5.3, 2025.11.1, and 2025.12.0, an attacker who knows part of a username can find the user… |
CVE-2025-64190 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows DOM-Based XSS.Th… |
CVE-2025-63027 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webcreations907 WBC907 Core wbc907-core allows Stored XSS… |
CVE-2025-62746 | Medium | 6.5 | 2025-12-30 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeFlavors Featured Video for WordPress – VideographyWP… |
CVE-2025-61557 | High | 7.5 | 2025-12-30 | nixseparatedebuginfod before v0.4.1 is vulnerable to Directory Traversal. |
CVE-2025-15255 | Critical | 9.8 | 2025-12-30 | A vulnerability was determined in Tenda W6-S 1.0.0.4(510). This impacts an unknown function of the file /bin/httpd of the component R7websSsecurityHandler. Exe… |
CVE-2025-15254 | Medium | 6.3 | 2025-12-30 | A vulnerability was found in Tenda W6-S 1.0.0.4(510). This affects the function TendaAte of the file /goform/ate of the component ATE Service. Performing a man… |
CVE-2025-15253 | High | 8.8 | 2025-12-30 | A vulnerability has been found in Tenda M3 1.0.0.13(4903). The impacted element is an unknown function of the file /goform/exeCommand. Such manipulation of the… |
CVE-2025-15252 | High | 8.8 | 2025-12-30 | A flaw has been found in Tenda M3 1.0.0.13(4903). The affected element is the function formSetRemoteDhcpForAp of the file /goform/setDhcpAP. This manipulation… |
CVE-2025-15251 | Medium | 5.6 | 2025-12-30 | A vulnerability was detected in beecue FastBee up to 2.1. Impacted is the function getRootElement of the file springboot/fastbee-server/sip-server/src/main/jav… |
CVE-2025-15250 | Medium | 4.7 | 2025-12-30 | A security vulnerability has been detected in 08CMS Novel System up to 3.4. This issue affects some unknown processing of the file admina/mtpls.inc.php of the… |
CVE-2025-15249 | Low | 3.5 | 2025-12-30 | A weakness has been identified in zhujunliang3 work_platform up to 6bc5a50bb527ce27f7906d11ea6ec139beb79c31. This vulnerability affects unknown code of the com… |
CVE-2025-15248 | Low | 3.5 | 2025-12-30 | A security flaw has been discovered in sunhailin12315 product-review 商品评价系统 up to 91ead6890b4065bb45b7602d0d73348e75cb4639. This affects an unknown part of the… |
CVE-2025-14426 | Medium | 4.3 | 2025-12-30 | The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'edit_rating' function… |
CVE-2025-15247 | High | 7.3 | 2025-12-30 | A vulnerability was identified in gmg137 snap7-rs up to 153d3e8c16decd7271e2a5b2e3da4d6f68589424. Affected by this issue is the function snap7_rs::client::S7Cl… |
CVE-2025-15246 | Medium | 6.3 | 2025-12-30 | A vulnerability was determined in aizuda snail-job up to 1.7.0 on macOS. Affected by this vulnerability is the function FurySerializer.deserialize of the compo… |
CVE-2025-14509 | High | 7.2 | 2025-12-30 | The Lucky Wheel for WooCommerce – Spin a Sale plugin for WordPress is vulnerable to PHP Code Injection in all versions up to, and including, 1.1.13. This is du… |
CVE-2025-69093 | Medium | 5.3 | 2025-12-30 | Missing Authorization vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This… |