2025 CVEs (page 6)
Page 6 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-61025 | High | 7.5 | 2026-06-23 | An issue in the sslr_qst_get component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2025-61023 | High | 7.5 | 2026-06-23 | An issue in the st_compare component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements. |
CVE-2025-61022 | High | 7.5 | 2026-06-23 | An issue in the sqlo_tb_col_preds component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL stateme… |
CVE-2025-61021 | High | 7.5 | 2026-06-23 | An issue in the sqlo_natural_join_cond component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL st… |
CVE-2025-61020 | High | 7.5 | 2026-06-23 | An issue in the sqlo_strip_in_join component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statem… |
CVE-2025-61019 | High | 7.5 | 2026-06-23 | An issue in the sqlo_key_part_best component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statem… |
CVE-2025-61018 | High | 7.5 | 2026-06-23 | An issue in the sqlo_place_dt_set component of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL stateme… |
CVE-2025-13162 | Medium | 4.4 | 2026-06-23 | Uncontrolled Search Path Element vulnerability in ABB Control Builder A, ABB 800xA for Advant Master. This issue affects Control Builder A: through 1.4/4; 800… |
CVE-2025-62180 | | 2026-06-23 | Pega Platform versions 8.3.0 through Infinity 25.1.2 are affected by an authorization weakness that may allow authenticated users to access certain additional… | |
CVE-2025-55639 | Medium | 6.5 | 2026-06-23 | GPAC MP4Box v2.4 was discovered to contain a NULL pointer dereference in the gf_isom_add_track_kind() function at isomedia/isom_write.c. This vulnerability all… |
CVE-2025-15619 | Low | 3.5 | 2026-06-23 | HCL Connections contains a broken access control vulnerability that may allow an unauthorized user to view data in a single specific scenario. |
CVE-2025-71376 | High | 8.1 | 2026-06-23 | picklescan before 0.0.29 fails to detect malicious pickle files using idlelib.autocomplete.AutoComplete.fetch_completions in reduce methods. Attackers can embe… |
CVE-2025-71370 | High | 8.1 | 2026-06-23 | picklescan before 0.0.28 fails to detect malicious torch.jit.unsupported_tensor_ops.execWrapper function calls embedded in pickle files. Attackers can craft ma… |
CVE-2025-71365 | High | 8.1 | 2026-06-23 | picklescan before 0.0.33 fails to detect malicious pickle files that invoke numpy.f2py.crackfortran.myeval function through the reduce method. Attackers can cr… |
CVE-2025-71341 | High | 8.1 | 2026-06-23 | picklescan before 0.0.29 fails to detect the profile.Profile.runctx function when analyzing pickle files, allowing attackers to embed undetected malicious code… |
CVE-2025-71337 | High | 8.3 | 2026-06-23 | Flowise before 3.0.10 (affected versions 3.0.7 and earlier) contains an unverified email change vulnerability. An authenticated user can change the account ema… |
CVE-2025-71358 | High | 8.1 | 2026-06-22 | picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.autocomplete.AutoComplete.get_entity function in reduce methods. Attackers… |
CVE-2025-71344 | High | 8.1 | 2026-06-22 | picklescan before 0.0.30 (affected versions 0.0.26 and earlier) fails to detect the ensurepip._run_pip built-in function when scanning pickle files, allowing a… |
CVE-2025-71339 | High | 8.1 | 2026-06-22 | Picklescan before 0.0.33 fails to detect the numpy.f2py.crackfortran._eval_length gadget in pickle __reduce__ methods, allowing arbitrary code execution. Attac… |
CVE-2025-66389 | High | 7.5 | 2026-06-22 | GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Theref… |
CVE-2025-33128 | Medium | 5.4 | 2026-06-22 | IBM Engineering Workflow Management 7.0.3 through 7.0.3 Interim Fix 020, and 7.1 through 7.1 Interim Fix 007 is vulnerable to cross-site scripting. This vulner… |
CVE-2025-2669 | Medium | 6.0 | 2026-06-22 | IBM Db2 on Cloud Pak for Data and Db2 Warehouse on Cloud Pak for Data versions 4.8, 5.0, 5.1, 5.2, 5.3 could allow a privileged user to perform operations and… |
CVE-2025-4994 | | 2026-06-22 | The SafeLine SL6 and SL6+ devices integrated into elevator emergency intercom systems are vulnerable to an authentication bypass. This vulnerability allows att… | |
CVE-2025-66336 | High | 8.1 | 2026-06-22 | Apache Doris MCP Server contains a SQL injection vulnerability in a metadata query path. A user-controlled database name is directly interpolated into a SQL qu… |
CVE-2025-62198 | Medium | 5.4 | 2026-06-22 | An authenticated user can perform XSS. This issue affects Apache Atlas versions 2.4.0 and earlier. Users are recommended to upgrade to version 2.5.0, which f… |
CVE-2025-71378 | High | 8.1 | 2026-06-21 | picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious… |
CVE-2025-71357 | High | 8.1 | 2026-06-21 | picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed und… |
CVE-2025-71351 | | 2026-06-21 | picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the __reduce__ method, allowing remote code execution. Attackers ca… | |
CVE-2025-71348 | High | 8.1 | 2026-06-21 | picklescan before 0.0.28 fails to detect malicious pickle files that invoke torch.utils._config_module.load_config function within reduce methods. Attackers ca… |
CVE-2025-71379 | Medium | 4.3 | 2026-06-20 | vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.p… |
CVE-2025-71331 | Medium | 6.1 | 2026-06-20 | Flowise before 3.0.8 contains a cross-site scripting (XSS) vulnerability caused by insufficient input filtering in chat messages and custom agent functions. An… |
CVE-2025-71326 | High | 7.8 | 2026-06-19 | AVAST Antivirus 25.11 contains an unquoted service path vulnerability in the SecureLine service that allows local non-privileged users to execute code with ele… |
CVE-2025-62821 | Critical | 9.1 | 2026-06-19 | Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving the reported data si… |
CVE-2025-7737 | High | 8.6 | 2026-06-19 | DoS Vulnerability in 10G iSCSI Interface of Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual Storage Platform E990, E1090, E1090H: befor… |
CVE-2025-15661 | Medium | 6.5 | 2026-06-18 | libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sftp.c that allows a m… |
CVE-2025-53114 | High | 7.5 | 2026-06-18 | CometD is a scalable comet implementation for web messaging. In versions 5.0.0 through 5.0.22, 6.0.0 through 6.0.18, 7.0.0 through 7.0.18, and 8.0.0 through 8… |
CVE-2025-32437 | | 2026-06-18 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, `MediaDurationBlock… | |
CVE-2025-32436 | | 2026-06-18 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, `AddAudioToVideoBlo… | |
CVE-2025-32424 | | 2026-06-18 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, ScreenshotWebPageBl… | |
CVE-2025-32422 | | 2026-06-18 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, `StepThroughItemsBl… | |
CVE-2025-32392 | | 2026-06-18 | AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.63, AutoGPT's LoopVideo… | |
CVE-2025-58175 | Medium | 6.5 | 2026-06-18 | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a GeoServer that uses `ENTITY_RESO… |
CVE-2025-52465 | High | 7.2 | 2026-06-18 | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows… |
CVE-2025-27511 | High | 7.2 | 2026-06-18 | GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an ad… |
CVE-2025-10560 | | 2026-06-18 | Worksnaps before version 1.6.20260201 contains hardcoded cloud credentials and related secret material in the Worksnaps client application binaries. The expose… | |
CVE-2025-71325 | Critical | 9.8 | 2026-06-17 | picklescan before 0.0.27 contains a parsing logic error in the _list_globals function when handling STACK_GLOBAL opcodes, failing to track arguments in the cor… |
CVE-2025-71323 | Critical | 9.8 | 2026-06-17 | picklescan before 0.0.33 fails to block the ctypes module, allowing attackers to achieve remote code execution by invoking direct syscalls and accessing raw me… |
CVE-2025-71322 | High | 8.8 | 2026-06-17 | PickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals list, allowing attackers to bypass security checks. Malicious actors can… |
CVE-2025-71321 | Critical | 9.8 | 2026-06-17 | picklescan before 0.0.33 contains an arbitrary file writing vulnerability that allows attackers to bypass the dangerous blocklist by using distutils.file_util… |
CVE-2025-71320 | Critical | 9.8 | 2026-06-17 | picklescan before 0.0.33 contains an incomplete deny-list that fails to block pydoc.locate and operator.methodcaller functions, allowing attackers to bypass se… |
CVE-2025-32748 | Medium | 4.3 | 2026-06-17 | Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain(s) a Host Header Injection vulnerability. An unauthenticated attacker with remote access could pot… |
CVE-2025-26240 | High | 8.4 | 2026-06-17 | In JazzCore python-pdfkit 1.0.0, the from_string method enables the execution of JavaScript code within the context of the server application and the exfiltrat… |
CVE-2025-69189 | High | 7.3 | 2026-06-17 | Missing Authorization vulnerability in EMV JobBank allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobBank: from n… |
CVE-2025-69175 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Line Agency <= 1.3.1 versions. |
CVE-2025-69174 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Etude <= 1.6 versions. |
CVE-2025-69170 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Eventicity <= 1.5 versions. |
CVE-2025-69166 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Gunslinger <= 1.7 versions. |
CVE-2025-69164 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Skyward <= 1.10 versions. |
CVE-2025-69158 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Granola <= 1.13 versions. |
CVE-2025-69157 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Gamic <= 1.15 versions. |
CVE-2025-69144 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Preservation <= 1.10 versions. |
CVE-2025-69140 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in SweetDate Core < 1.1.5 versions. |
CVE-2025-69130 | High | 8.8 | 2026-06-17 | Deserialization of Untrusted Data vulnerability in Pixel Makers Creative INC. Entrepreneur - Booking for Small Businesses WordPress Theme allows Object Injecti… |
CVE-2025-69128 | High | 8.6 | 2026-06-17 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in EMV JobCareer allows Path Traversal. This issue affects JobCar… |
CVE-2025-69127 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in Plumbing <= 1.6 versions. |
CVE-2025-69126 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Fortius <= 2.3.0 versions. |
CVE-2025-69123 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Snow Club <= 1.1 versions. |
CVE-2025-69120 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Dazzle <= 1.0.0 versions. |
CVE-2025-69115 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in LuxMed | Medicine & Healthcare Doctor WordPress Theme <= 1.2.2 versions. |
CVE-2025-69111 | Critical | 9.8 | 2026-06-17 | Unauthenticated PHP Object Injection in Reisen <= 1.4.1 versions. |
CVE-2025-69106 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Imba <= 1.5.0 versions. |
CVE-2025-68524 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Avante < 3.0.5 versions. |
CVE-2025-66391 | High | 8.8 | 2026-06-17 | In Citrix Cloud through 2025-11-10, an account with read-only access can trigger the beginning of a workflow for write operations, e.g., the system will send a… |
CVE-2025-60236 | Critical | 9.8 | 2026-06-17 | Deserialization of Untrusted Data vulnerability in EMV Creatify allows Object Injection. This issue affects Creatify: from n/a through 1.5. |
CVE-2025-60231 | Critical | 9.8 | 2026-06-17 | Deserialization of Untrusted Data vulnerability in EMV The Hospital nrghospital allows Object Injection. This issue affects The Hospital: from n/a through 1.8… |
CVE-2025-60230 | Critical | 9.8 | 2026-06-17 | Deserialization of Untrusted Data vulnerability in Themeton The Barber Shop allows Object Injection. This issue affects The Barber Shop: from n/a through 1.9. |
CVE-2025-60229 | Critical | 9.8 | 2026-06-17 | Deserialization of Untrusted Data vulnerability in Themeton Lagom allows Object Injection. This issue affects Lagom: from n/a through 2.0. |
CVE-2025-59554 | Critical | 9.3 | 2026-06-17 | Unauthenticated SQL Injection in Advanced Ads – Tracking < 3.0.7 versions. |
CVE-2025-15657 | Medium | 5.3 | 2026-06-17 | Unauthenticated Insecure Direct Object References (IDOR) in School Management <= 93.1.0 versions. |
CVE-2025-69179 | Critical | 9.8 | 2026-06-17 | Unauthenticated Privilege Escalation in Support Ticket Management System <= 1.9 versions. |
CVE-2025-69178 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Truemag <= 4.3.14.2 versions. |
CVE-2025-69177 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Roneous <= 2.1.5 versions. |
CVE-2025-69176 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in ITactics <= 1.0 versions. |
CVE-2025-69173 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Tipsy <= 1.1 versions. |
CVE-2025-69172 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Resurs <= 1.3 versions. |
CVE-2025-69171 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Orpheus <= 1.3 versions. |
CVE-2025-69168 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Spike <= 1.2 versions. |
CVE-2025-69167 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Eros <= 1.3 versions. |
CVE-2025-69165 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Choreo <= 1.6 versions. |
CVE-2025-69163 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in WineShop <= 3.17 versions. |
CVE-2025-69162 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Grecko <= 5.17 versions. |
CVE-2025-69161 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Snowy <= 1.13 versions. |
CVE-2025-69160 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Gita <= 1.11 versions. |
CVE-2025-69159 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Printo <= 1.11 versions. |
CVE-2025-69151 | High | 7.1 | 2026-06-17 | Unauthenticated Cross Site Scripting (XSS) in Grand Car Rental <= 3.7 versions. |
CVE-2025-69150 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Medeus <= 1.14 versions. |
CVE-2025-69149 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Top Dog <= 1.0.5 versions. |
CVE-2025-69148 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Quirky <= 1.23 versions. |
CVE-2025-69147 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Putter <= 1.17 versions. |
CVE-2025-69146 | High | 8.1 | 2026-06-17 | Unauthenticated Local File Inclusion in Dom <= 1.24 versions. |