2025 CVEs (page 6)
Page 6 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-55650 | Medium | 5.5 | 2026-06-15 | A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) vi… |
CVE-2025-55649 | Medium | 5.5 | 2026-06-15 | A NULL pointer dereference in the gf_media_map_esd function (media_tools/isom_tools.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS)… |
CVE-2025-55648 | Medium | 5.5 | 2026-06-15 | A heap buffer overflow in the gf_opus_parse_packet_header function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service… |
CVE-2025-55647 | Medium | 5.5 | 2026-06-15 | An Out-of-Memory in the mp4_mux_cenc_insert_pssh function (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supp… |
CVE-2025-55645 | Medium | 5.5 | 2026-06-15 | A heap buffer overflow in the gf_cenc_set_pssh function (isomedia/drm_sample.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via sup… |
CVE-2025-55644 | Medium | 5.5 | 2026-06-15 | A heap use-after-free in the gf_node_get_tag function (scenegraph/base_scenegraph.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) vi… |
CVE-2025-55643 | Medium | 5.5 | 2026-06-15 | A NULL pointer dereference in the TrackWriter handling component (filters/mux_isom.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) v… |
CVE-2025-55642 | Medium | 6.5 | 2026-06-15 | GPAC MP4Box v2.4 was discovered to contain a floating point exception in the avidmx_process function (isomedia/isom_write.c). |
CVE-2025-55641 | Medium | 5.5 | 2026-06-15 | A NULL pointer dereference in the gf_isom_copy_sample_info function (isomedia/isom_write.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (… |
CVE-2025-15659 | Medium | 6.5 | 2026-06-15 | Contributor Cross Site Scripting (XSS) in Elizaibots <= 1.0.2 versions. |
CVE-2025-15658 | Medium | 5.9 | 2026-06-15 | Administrator Cross Site Scripting (XSS) in WP Emmet <= 0.3.4 versions. |
CVE-2025-64215 | Medium | 6.5 | 2026-06-15 | Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects… |
CVE-2025-15546 | Medium | 5.4 | 2026-06-14 | The Iptanus File Upload WordPress plugin before 5.1.7 does not implement proper file handling when the duplicatepolicy setting is configured to "maintain both… |
CVE-2025-9033 | High | 7.8 | 2026-06-12 | Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Servic… |
CVE-2025-9032 | High | 7.8 | 2026-06-12 | Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of… |
CVE-2025-14098 | High | 7.8 | 2026-06-12 | Heap buffer out-of-bounds write vulnerability due to integer overflow in Avira Antivirus engine when scanning a malformed MS-DOS executable file may allow Loca… |
CVE-2025-7019 | Medium | 5.5 | 2026-06-12 | Stack overflow vulnerability in Avast Antivirus when scanning a malformed Office Open XML file may allow Denial-of-Service of the antivirus process. This issu… |
CVE-2025-7018 | Medium | 5.5 | 2026-06-12 | Null pointer dereference vulnerability in Avira Antivirus engine when scanning a malformed Windows PE file may allow Denial-of-Service of the antivirus engine… |
CVE-2025-7017 | High | 7.8 | 2026-06-12 | Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed Windows MSI file may allow Local Execution of Code or Denial-o… |
CVE-2025-7011 | High | 7.8 | 2026-06-12 | Heap out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed zip file containing XML may allow Local Execution of Code or Denial-of-Servi… |
CVE-2025-7010 | Medium | 5.5 | 2026-06-12 | Stack overflow vulnerability due to uncontrolled recursion in Avast Antivirus when scanning a malformed PDF file may allow Denial-of-Service of the antivirus p… |
CVE-2025-7009 | High | 7.8 | 2026-06-12 | Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Servic… |
CVE-2025-7008 | High | 7.8 | 2026-06-12 | Heap buffer out-of-bounds read vulnerability in Avast Antivirus when scanning a malformed Windows PE file with .NET metadata may allow Local Execution of Code… |
CVE-2025-7006 | Medium | 5.5 | 2026-06-12 | Use of stack memory after free vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Denial-of-Service of the antivirus process… |
CVE-2025-7005 | Medium | 5.5 | 2026-06-12 | Uncontrolled recursion vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Denial-of-Service of the antivirus process. This i… |
CVE-2025-7004 | High | 7.8 | 2026-06-12 | Heap buffer out-of-bounds write vulnerability in Avast Antivirus when scanning a malformed Windows PE file may allow Local Execution of Code or Denial-of-Servi… |
CVE-2025-7003 | High | 7.8 | 2026-06-12 | Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Servic… |
CVE-2025-7002 | High | 7.8 | 2026-06-12 | Heap buffer out-of-bounds read vulnerability in Avira Antivirus engine when scanning a malformed PDF file may allow Local Execution of Code or Denial-of-Servic… |
CVE-2025-46315 | High | 7.5 | 2026-06-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access protected user data. |
CVE-2025-46313 | Medium | 5.5 | 2026-06-11 | A logging issue was addressed with improved data redaction. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data. |
CVE-2025-46308 | Medium | 5.3 | 2026-06-11 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 18.4 and iPadOS 18.4, macOS Sequoia 15.4. An app may be able to… |
CVE-2025-46293 | Medium | 5.5 | 2026-06-11 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protected user data. |
CVE-2025-43339 | Medium | 5.5 | 2026-06-11 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. A malicious app may be able to access sensitive us… |
CVE-2025-43278 | Medium | 5.5 | 2026-06-11 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Sequoia 15.4. An app may be able to access protected user data. |
CVE-2025-31272 | High | 7.8 | 2026-06-11 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4. An app may be able to bypass launch constraint protections and execute… |
CVE-2025-30459 | Medium | 5.5 | 2026-06-11 | A privacy issue was addressed by removing the vulnerable code. This issue is fixed in macOS Sequoia 15.4. An app may be able to access sensitive user data. |
CVE-2025-30431 | Medium | 5.5 | 2026-06-11 | The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. A malicious app may be able… |
CVE-2025-24284 | High | 8.8 | 2026-06-11 | This issue was addressed with improved checks to prevent unauthorized actions. This issue is fixed in macOS Sequoia 15.4. An app may be able to break out of it… |
CVE-2025-24268 | Medium | 5.5 | 2026-06-11 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.4. An app may be able t… |
CVE-2025-24165 | Medium | 5.5 | 2026-06-11 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5, macOS Ventura 13.7.5. An app ma… |
CVE-2025-7064 | Medium | 6.6 | 2026-06-11 | Authentication bypass by primary weakness vulnerability in ABB Freelance. This issue affects Freelance: through 2013, 2013 SP1, 2016, 2016 SP1, 2019, 2019 SP1… |
CVE-2025-10238 | Medium | 6.7 | 2026-06-10 | During an internal security assessment, a potential out-of-bounds write vulnerability was discovered in the BIOS of some ThinkPad products could allow a privil… |
CVE-2025-10237 | Medium | 6.7 | 2026-06-10 | During an internal security assessment, a potential vulnerability was discovered in some ThinkPad embedded controller firmware that could allow a privileged lo… |
CVE-2025-71330 | High | 7.5 | 2026-06-10 | image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a spe… |
CVE-2025-71329 | High | 7.5 | 2026-06-10 | image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a spe… |
CVE-2025-6254 | Critical | 9.8 | 2026-06-10 | The Doctreat Core plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.6.8. This is due to the doctreat_process_r… |
CVE-2025-8444 | Medium | 6.4 | 2026-06-10 | The Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates plugin for WordPress is vulnerable to DOM-Based Stored Cross-Site Script… |
CVE-2025-66281 | High | 7.2 | 2026-06-10 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerab… |
CVE-2025-66280 | High | 7.2 | 2026-06-10 | An integer overflow or wraparound vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator… |
CVE-2025-66279 | High | 7.2 | 2026-06-10 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they… |
CVE-2025-66273 | High | 7.2 | 2026-06-10 | A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they… |
CVE-2025-62851 | Medium | 4.4 | 2026-06-10 | A path traversal vulnerability has been reported to affect License Center. If a local attacker gains an administrator account, they can then exploit the vulner… |
CVE-2025-62850 | High | 7.2 | 2026-06-10 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator accoun… |
CVE-2025-66276 | Critical | 9.8 | 2026-06-10 | QuTS hero is not affected. We have already fixed the vulnerability in the following version: QTS 5.2.7.3256 build 20250913 and later |
CVE-2025-59382 | | 2026-06-10 | QTS, QuTS hero, QuTScloud are not affected. We have already fixed the vulnerability in the following version: | |
CVE-2025-58468 | High | 8.8 | 2026-06-10 | A cross-site request forgery (CSRF) vulnerability has been reported to affect Notification Center. The remote attackers can then exploit the vulnerability to g… |
CVE-2025-71319 | High | 7.5 | 2026-06-09 | image-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a spe… |
CVE-2025-55659 | Medium | 6.5 | 2026-06-09 | A NULL pointer dereference in the ctts_box_write function (isomedia/box_code_base.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) vi… |
CVE-2025-55658 | Medium | 6.5 | 2026-06-09 | GPAC MP4Box v2.4 was discovered to contain a floating point exception in the gf_opus_parse_packet_header function (media_tools/av_parsers.c). bThis vulnerabili… |
CVE-2025-55657 | High | 7.5 | 2026-06-09 | A NULL pointer dereference in the gf_odf_vvc_cfg_write_bs function (odf/descriptors.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS)… |
CVE-2025-55651 | Medium | 5.5 | 2026-06-09 | A NULL pointer dereference in the gf_isom_get_user_data_count function (isomedia/isom_read.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service… |
CVE-2025-52293 | High | 7.5 | 2026-06-09 | A segmentation violaton in the gf_hevc_read_sps_bs_internal function (media_tools/av_parsers.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Servi… |
CVE-2025-52292 | High | 7.5 | 2026-06-09 | A stack buffer overflow in the filein_process function (in_file.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via supplying a craf… |
CVE-2025-54509 | | 2026-06-09 | Improper access control for register interface in the Input-Output Memory Management Unit (IOMMU) could allow a privileged attacker to cause non-coherent acces… | |
CVE-2025-67862 | Medium | 6.7 | 2026-06-09 | An Internal Asset Exposed to Unsafe Debug Access Level or State vulnerability [CWE-1244] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.2, FortiOS 7.4.0 t… |
CVE-2025-40808 | Medium | 6.1 | 2026-06-09 | A vulnerability has been identified in SIPROTEC 5 6MD84 (CP300) (All versions), SIPROTEC 5 6MD85 (CP200) (All versions), SIPROTEC 5 6MD85 (CP300) (All versions… |
CVE-2025-10263 | Critical | 9.1 | 2026-06-09 | Arm C1-Ultra, C1-Premium, Neoverse V3 & V3AE, Neoverse V2, Neoverse V1, Neoverse-N2, Neoverse-N1, Cortex-X925, Cortex-X4, Cortex-X3, Cortex-X2, Cortex-X1 & X1C… |
CVE-2025-62858 | Medium | 6.5 | 2026-06-09 | A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administrator account, they c… |
CVE-2025-71315 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: drm/vkms: Convert to DRM's vblank timer Replace vkms' vblank timer with the DRM implement… |
CVE-2025-12656 | Low | 3.8 | 2026-06-06 | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory deletion due to insufficient file path va… |
CVE-2025-71318 | Critical | 9.8 | 2026-06-05 | NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remote, unauthenticated attacker can directly request administr… |
CVE-2025-71317 | Critical | 9.8 | 2026-06-05 | NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access. A remote, unauthenticated attacker… |
CVE-2025-5090 | Medium | 6.5 | 2026-06-05 | CVX is not resilient to unexpected messages from a connected switch. This leads to agent crashes on CVX causing instability in the CVX cluster. An attacker cou… |
CVE-2025-5089 | Medium | 6.5 | 2026-06-05 | In a CVX cluster, an EOS switch connected to a CVX server is not resilient to certain malformed messages received from the connected CVX server. Similarly, the… |
CVE-2025-5088 | High | 8.3 | 2026-06-05 | An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that this would require an attacker to have bot… |
CVE-2025-59174 | Medium | 6.5 | 2026-06-05 | Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability where an attacker sending a large volume of specially crafted messages may… |
CVE-2025-8873 | High | 7.5 | 2026-06-04 | On affected platforms running Arista EOS with IPsec configured, a specially crafted packet can cause the dataplane to stop processing all IPsec traffic. The co… |
CVE-2025-71316 | Critical | 9.8 | 2026-06-04 | SQLite 'sqldiff.exe' does not securely handle the way the Microsoft Windows C runtime converts Unicode characters to ANSI codepages. An attacker could use the… |
CVE-2025-65640 | Medium | 6.3 | 2026-06-04 | Cross Site Scripting (XSS) vulnerability in the "Task in Progress / Recent" page in Arket Globe Document Intelligence 5.0.0.559 due to improper sanitization of… |
CVE-2025-69755 | High | 8.2 | 2026-06-04 | An issue in Neterbit NW-431F Router vNW-431F-20241014-IR03 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted co… |
CVE-2025-67448 | High | 7.1 | 2026-06-04 | The SMS module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to stored XSS. The application does not properly sanitize user input in SMS me… |
CVE-2025-67447 | Critical | 9.8 | 2026-06-04 | The network diagnosis (ping) module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to OS command injection. The application does not properl… |
CVE-2025-67446 | Critical | 9.8 | 2026-06-04 | Improper Authentication (Authentication Bypass) exists in Neterbit NW-431F Router 20241014-IR03 and before. The router uses a weak/predictable cookie value for… |
CVE-2025-62338 | Low | 3.3 | 2026-06-04 | HCL BigFix Cloud Lifecycle Management is affected by lack of input validation. This low-level flaw allows unauthorized access and may lead to information expo… |
CVE-2025-59874 | High | 8.1 | 2026-06-04 | HCL Hive Telco Observability is affected by a Required directives missing from the CSP issue is detected in keycloak component of the web application. Missing… |
CVE-2025-46638 | High | 7.5 | 2026-06-04 | Dell BSAFE SSL-J contains an allocation of resources without limits or throttling vulnerability. An unauthenticated remote attacker could potentially exploit t… |
CVE-2025-52612 | High | 7.1 | 2026-06-04 | HCL iControl was affected by Export CSV - CSV Injection vulnerability. It is vulnerable to a reflected cross-site scripting vulnerability. This was caused by a… |
CVE-2025-52611 | Low | 3.1 | 2026-06-04 | HCL iControl v4.0.0 was affected by Unhandled Exception - Stack Trace Disclosure vulnerability. The error occurs due to an undefined property being accessed in… |
CVE-2025-52609 | Low | 3.7 | 2026-06-04 | HCL iControl was affected by Missing Security Headers vulnerability. which lead to cross-site scripting (XSS) attacks by enabling the built-in XSS filtering me… |
CVE-2025-52608 | Low | 3.1 | 2026-06-04 | HCL iControl was affected by Missing Cookie Attributes vulnerability. It was observed that the application is missing several critical cookie attributes, incl… |
CVE-2025-52606 | Medium | 4.3 | 2026-06-04 | HCL iControl was affected by Weak Input Validation vulnerability. This weakness is caused during implementation of an architectural security tactic. Received i… |
CVE-2025-12694 | High | 7.8 | 2026-06-04 | A local privilege escalation vulnerability exists in Forcepoint VPN Client that allows a local non-administrative user to escalate privileges to SYSTEM. This i… |
CVE-2025-71314 | Medium | 5.5 | 2026-06-03 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Recover from panthor_gpu_flush_caches() failures We have seen a few cases wh… |
CVE-2025-71313 | Medium | 5.5 | 2026-06-03 | In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Add missing NULL check for alloc_workqueue() alloc_workqueue() can return… |
CVE-2025-70101 | Medium | 6.5 | 2026-06-03 | An out-of-bounds read in the ext4_ext_binsearch_idx function in src/ext4_extent.c of the lwext4 1.0.0 library allows attackers to cause a denial of service by… |
CVE-2025-70100 | Medium | 5.5 | 2026-06-03 | A divide-by-zero vulnerability in the ext4_block_set_lb_size function in src/ext4_blockdev.c of the lwext4 1.0.0 library allows attackers to cause a denial of… |
CVE-2025-60477 | Medium | 5.0 | 2026-06-03 | A NULL pointer dereference in the gf_filter_pid_resolve_file_template_ex function (/filter_core/filter_pid.c) of GPAC Project/MP4Box before 26.02.0 allows atta… |
CVE-2025-41259 | | 2026-06-03 | SWUpdate before 2026.05 is affected by a time-of-check time-of-use (TOCTOU) race condition that allows local unprivileged attackers to escalate privileges to r… | |
CVE-2025-15656 | High | 8.8 | 2026-06-03 | Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalation. This issue affects School Management: from n/a through… |
CVE-2025-15655 | High | 7.6 | 2026-06-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla School Management allows SQL Injection. This is… |