2025 CVEs (page 61)
Page 61 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-68332 | | 2025-12-22 | In the Linux kernel, the following vulnerability has been resolved: comedi: c6xdigio: Fix invalid PNP driver unregistration The Comedi low-level driver "c6xd… | |
CVE-2025-68331 | | 2025-12-22 | In the Linux kernel, the following vulnerability has been resolved: usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transf… | |
CVE-2025-68330 | | 2025-12-22 | In the Linux kernel, the following vulnerability has been resolved: iio: accel: bmc150: Fix irq assumption regression The code in bmc150-accel-core.c uncondi… | |
CVE-2025-68329 | | 2025-12-22 | In the Linux kernel, the following vulnerability has been resolved: tracing: Fix WARN_ON in tracing_buffers_mmap_close for split VMAs When a VMA is split (e… | |
CVE-2025-68328 | | 2025-12-22 | In the Linux kernel, the following vulnerability has been resolved: firmware: stratix10-svc: fix bug in saving controller data Fix the incorrect usage of pla… | |
CVE-2025-68327 | | 2025-12-22 | In the Linux kernel, the following vulnerability has been resolved: usb: renesas_usbhs: Fix synchronous external abort on unbind A synchronous external abort… | |
CVE-2025-68326 | | 2025-12-22 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Fix stack_depot usage Add missing stack_depot_init() call when CONFIG_DRM_XE_… | |
CVE-2025-67443 | Medium | 6.1 | 2025-12-22 | Schlix CMS before v2.2.9-5 is vulnerable to Cross Site Scripting (XSS). Due to lack of javascript sanitization in the login form, incorrect login attempts in l… |
CVE-2025-10021 | | 2025-12-22 | A Use of Uninitialized Variable vulnerability exists in Open Design Alliance Drawings SDK static versions (mt) before 2026.12. Static object `COdaMfcAppApp the… | |
CVE-2025-67826 | High | 7.7 | 2025-12-22 | An issue was discovered in K7 Ultimate Security 17.0.2045. A Local Privilege Escalation (LPE) vulnerability in the K7 Ultimate Security antivirus can be exploi… |
CVE-2025-61740 | | 2025-12-22 | Authentication issue that does not verify the source of a packet which could allow an attacker to create a denial-of-service condition or modify the configurat… | |
CVE-2025-26379 | | 2025-12-22 | Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets. | |
CVE-2025-14018 | High | 7.3 | 2025-12-22 | Unquoted Search Path or Element vulnerability in NetBT Consulting Services Inc. E-Fatura allows Leveraging/Manipulating Configuration File Search Paths, Redire… |
CVE-2025-14273 | High | 7.2 | 2025-12-22 | Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 with the Jira plugin enabled and Mattermost Jira plugin versions… |
CVE-2025-8460 | Medium | 6.8 | 2025-12-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Notification rules, Ope… |
CVE-2025-61739 | | 2025-12-22 | Due to Nonce reuse, attackers can perform reply attack or decrypt captured packets. | |
CVE-2025-61738 | | 2025-12-22 | Under certain circumstances, attacker can capture the network key, read or write encrypted packets on the PowerG network. | |
CVE-2025-54890 | Medium | 6.8 | 2025-12-22 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Centreon Infra Monitoring (Hostgroup configuration… |
CVE-2025-12514 | High | 7.2 | 2025-12-22 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring - Open-tickets (Notification ru… |
CVE-2025-62880 | Medium | 4.3 | 2025-12-22 | Cross-Site Request Forgery (CSRF) vulnerability in Kunal Custom 404 Pro custom-404-pro allows Cross Site Request Forgery.This issue affects Custom 404 Pro: fro… |
CVE-2025-62107 | Medium | 4.3 | 2025-12-22 | Cross-Site Request Forgery (CSRF) vulnerability in PluginOps Feather Login Page feather-login-page allows Cross Site Request Forgery.This issue affects Feather… |
CVE-2025-62094 | Medium | 6.5 | 2025-12-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in voidthemes Void Elementor WHMCS Elements For Elementor Pa… |
CVE-2025-8305 | Medium | 6.5 | 2025-12-22 | An authenticated local user can obtain information that allows claiming security policy rules of another user due to sensitive information being printed in pla… |
CVE-2025-8304 | Medium | 6.5 | 2025-12-22 | An authenticated local user can obtain information that allows claiming security policy rules of another user due to sensitive information being accessible in… |
CVE-2025-11545 | | 2025-12-22 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Sharp Display Solutions projectors allows a attacker may improperly… | |
CVE-2025-11544 | | 2025-12-22 | Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauthorized firmware. | |
CVE-2025-15014 | Medium | 6.3 | 2025-12-22 | A security flaw has been discovered in loganhong php loganSite up to c035fb5c3edd0b2a5e32fd4051cbbc9e61a31426. This affects an unknown function of the file /in… |
CVE-2025-15013 | Medium | 5.3 | 2025-12-22 | A vulnerability was identified in floooh sokol up to 5d11344150973f15e16d3ec4ee7550a73fb995e0. The impacted element is the function _sg_validate_pipeline_desc… |
CVE-2025-15012 | High | 7.3 | 2025-12-22 | A vulnerability was determined in code-projects Refugee Food Management System 1.0. The affected element is an unknown function of the file /home/home.php. Thi… |
CVE-2025-12049 | Critical | 9.8 | 2025-12-22 | Missing Authentication for Critical Function vulnerability in Sharp Display Solutions Media Player MP-01 All Verisons allows a attacker may access to the web i… |
CVE-2025-11543 | Critical | 9.8 | 2025-12-22 | Improper Validation of Integrity Check Value vulnerability in Sharp Display Solutions projectors allows a attacker may create and run unauthorized firmware. |
CVE-2025-11542 | Critical | 9.8 | 2025-12-22 | Stack-based Buffer Overflow vulnerability in Sharp Display Solutions projectors allows a attacker may execute arbitrary commands and programs. |
CVE-2025-11541 | Critical | 9.8 | 2025-12-22 | Stack-based Buffer Overflow vulnerability in Sharp Display Solutions projectors allows a attacker may execute arbitrary commands and programs. |
CVE-2025-11540 | High | 7.5 | 2025-12-22 | Path Traversal vulnerability in Sharp Display Solutions projectors allows a attacker may access and read any files within the projector. |
CVE-2025-59301 | Medium | 4.0 | 2025-12-22 | Delta Electronics DVP15MC11T lacks proper validation of the modbus/tcp packets and can lead to denial of service. |
CVE-2025-15016 | Critical | 9.8 | 2025-12-22 | Enterprise Cloud Database developed by Ragic has a Hard-coded Cryptographic Key vulnerability, allowing unauthenticated remote attackers to exploit the fixed k… |
CVE-2025-15015 | High | 7.5 | 2025-12-22 | Enterprise Cloud Database developed by Ragic has a Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traver… |
CVE-2025-15011 | High | 7.3 | 2025-12-22 | A vulnerability was found in code-projects Simple Stock System 1.0. Impacted is an unknown function of the file /logout.php. The manipulation of the argument u… |
CVE-2025-15010 | Critical | 9.8 | 2025-12-22 | A vulnerability has been found in Tenda WH450 1.0.0.18. This issue affects some unknown processing of the file /goform/SafeUrlFilter. The manipulation of the a… |
CVE-2025-15009 | Medium | 6.3 | 2025-12-22 | A flaw has been found in liweiyi ChestnutCMS up to 1.5.8. This vulnerability affects the function FilenameUtils.getExtension of the file /dev-api/common/upload… |
CVE-2025-15008 | High | 7.3 | 2025-12-22 | A vulnerability was detected in Tenda WH450 1.0.0.18. This affects an unknown part of the file /goform/L7Port of the component HTTP Request Handler. Performing… |
CVE-2025-15007 | Critical | 9.8 | 2025-12-22 | A security vulnerability has been detected in Tenda WH450 1.0.0.18. Affected by this issue is some unknown functionality of the file /goform/L7Im of the compon… |
CVE-2025-15006 | Critical | 9.8 | 2025-12-22 | A weakness has been identified in Tenda WH450 1.0.0.18. Affected by this vulnerability is an unknown functionality of the file /goform/CheckTools of the compon… |
CVE-2025-15005 | Low | 3.7 | 2025-12-22 | A security flaw has been discovered in CouchCMS up to 2.4. Affected is an unknown function of the file couch/config.example.php of the component reCAPTCHA Hand… |
CVE-2025-15004 | Medium | 6.3 | 2025-12-22 | A vulnerability was identified in DedeCMS up to 5.7.118. This impacts an unknown function of the file /freelist_main.php. The manipulation of the argument orde… |
CVE-2025-15003 | Medium | 4.7 | 2025-12-22 | A vulnerability was found in SeaCMS up to 13.3. The impacted element is an unknown function of the file admin_video.php. Performing a manipulation of the argum… |
CVE-2025-15002 | High | 7.3 | 2025-12-21 | A vulnerability has been found in SeaCMS up to 13.3. The affected element is an unknown function of the file js/player/dmplayer/dmku/class/mysqli.class.php. Su… |
CVE-2025-62926 | Medium | 6.5 | 2025-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HappyDevs TempTool [Show Current Template Info] current-… |
CVE-2025-62901 | Medium | 6.5 | 2025-12-21 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in tormorten WP Microdata wp-microdata allows Stored XSS.Thi… |
CVE-2025-62955 | Medium | 4.3 | 2025-12-21 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in HappyDevs TempTool [Show Current Template Info] current-template-n… |
CVE-2025-14995 | High | 8.8 | 2025-12-21 | A vulnerability has been found in Tenda FH1201 1.2.0.14(408). Affected is the function sprintf of the file /goform/SetIpBind. Such manipulation of the argument… |
CVE-2025-14994 | High | 8.8 | 2025-12-21 | A flaw has been found in Tenda FH1201 and FH1206 1.2.0.14(408)/1.2.0.8(8155). This impacts the function strcat of the file /goform/webtypelibrary of the compon… |
CVE-2025-14855 | High | 7.2 | 2025-12-21 | The SureForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the form field parameters in all versions up to, and including, 2.2.0 due t… |
CVE-2025-14800 | High | 8.1 | 2025-12-21 | The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_file_to_upload… |
CVE-2025-14993 | High | 8.8 | 2025-12-21 | A vulnerability was detected in Tenda AC18 15.03.05.05. This affects the function sprintf of the file /goform/SetDlnaCfg of the component HTTP Request Handler… |
CVE-2025-9343 | High | 7.2 | 2025-12-21 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via ticket subjects in all versions u… |
CVE-2025-68644 | High | 7.4 | 2025-12-21 | Yealink RPS before 2025-06-27 allows unauthorized access to information, including AutoP URL addresses. This was fixed by deploying an enhanced authentication… |
CVE-2025-14992 | High | 8.8 | 2025-12-21 | A security vulnerability has been detected in Tenda AC18 15.03.05.05. The impacted element is the function strcpy of the file /goform/GetParentControlInfo of t… |
CVE-2025-14991 | Low | 2.4 | 2025-12-21 | A weakness has been identified in Campcodes Complete Online Beauty Parlor Management System 1.0. The affected element is an unknown function of the file /admin… |
CVE-2025-14990 | High | 7.3 | 2025-12-21 | A security flaw has been discovered in Campcodes Complete Online Beauty Parlor Management System 1.0. Impacted is an unknown function of the file /admin/view-a… |
CVE-2025-13693 | Medium | 6.4 | 2025-12-21 | The Image Photo Gallery Final Tiles Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Custom scripts' setting in all versions up… |
CVE-2025-13361 | Medium | 4.3 | 2025-12-21 | The Web to SugarCRM Lead plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing n… |
CVE-2025-13220 | Medium | 6.4 | 2025-12-21 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored… |
CVE-2025-12654 | Low | 2.7 | 2025-12-21 | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary directory creation in all versions up to, and inclu… |
CVE-2025-12398 | Medium | 6.1 | 2025-12-21 | The Product Table for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search_key' parameter in all versions up to, an… |
CVE-2025-14080 | Medium | 5.3 | 2025-12-21 | The Frontend Post Submission Manager Lite plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.5. This is due… |
CVE-2025-14071 | High | 7.5 | 2025-12-21 | The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.0.2 via d… |
CVE-2025-14054 | Medium | 4.4 | 2025-12-21 | The WC Builder – WooCommerce Page Builder for WPBakery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'heading_color' parameter (and… |
CVE-2025-14043 | Medium | 5.3 | 2025-12-21 | The Tainacan plugin for WordPress is vulnerable to unauthorized metadata section creation due to missing authorization checks in all versions up to, and includ… |
CVE-2025-13838 | Medium | 6.4 | 2025-12-21 | The WishSuite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_text' parameter of the 'wishsuite_button' shortcode in all vers… |
CVE-2025-12980 | High | 7.5 | 2025-12-21 | The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized access of data due to a missing ca… |
CVE-2025-11496 | Medium | 6.1 | 2025-12-21 | The Five Star Restaurant Reservations – WordPress Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rtb-name' parameter… |
CVE-2025-14989 | High | 7.3 | 2025-12-21 | A vulnerability was identified in Campcodes Complete Online Beauty Parlor Management System 1.0. This issue affects some unknown processing of the file /admin/… |
CVE-2025-34290 | | 2025-12-20 | Versa SASE Client for Windows versions released between 7.8.7 and 7.9.4 contain a local privilege escalation vulnerability in the audit log export functionalit… | |
CVE-2025-7782 | High | 7.6 | 2025-12-20 | The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to unauthorized modification of data due to a missing capability check on the '… |
CVE-2025-7733 | Medium | 4.3 | 2025-12-20 | The WP JobHunt plugin for WordPress, used by the JobCareer theme, is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 7.7 v… |
CVE-2025-14298 | Medium | 5.4 | 2025-12-20 | The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `thegem_te_search` shortcode in… |
CVE-2025-12492 | Medium | 5.3 | 2025-12-20 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Sensit… |
CVE-2025-13619 | Critical | 9.8 | 2025-12-20 | The Flex Store Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.0. This is due to the 'fsUserHandle… |
CVE-2025-12820 | Medium | 5.3 | 2025-12-20 | The Pure WC Variation Swatches WordPress plugin through 1.1.7 does not have an authorization check when updating its settings, which could allow any authentica… |
CVE-2025-14735 | Medium | 4.4 | 2025-12-20 | The "Amazon affiliate lite Plugin" plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1… |
CVE-2025-14734 | Medium | 5.4 | 2025-12-20 | The Amazon affiliate lite Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to m… |
CVE-2025-14721 | Medium | 5.5 | 2025-12-20 | The Responsive and Swipe slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rsSlider shortcode in all versions up to, an… |
CVE-2025-14633 | Medium | 5.3 | 2025-12-20 | The F70 Lead Document Download plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'file_download' funct… |
CVE-2025-14591 | High | 7.5 | 2025-12-20 | In Delphix Continuous Compliance version 2025.3.0 and later, following a recent bug fix to correctly handle CR+LF (Windows and DOS) End-of-Record (EOR) charact… |
CVE-2025-14168 | Medium | 4.3 | 2025-12-20 | The WP DB Booster plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing nonce va… |
CVE-2025-14164 | Medium | 4.3 | 2025-12-20 | The Quran Gateway plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing nonce vali… |
CVE-2025-13624 | Medium | 6.1 | 2025-12-20 | The Overstock Affiliate Links plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up… |
CVE-2025-13365 | Medium | 6.1 | 2025-12-20 | The WP Hallo Welt plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.4. This is due to missing or incorre… |
CVE-2025-13329 | Critical | 9.8 | 2025-12-20 | The File Uploader for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the callback function for… |
CVE-2025-12898 | Medium | 5.3 | 2025-12-20 | The Pretty Google Calendar plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the pgcal_ajax_handler() func… |
CVE-2025-12581 | Medium | 6.1 | 2025-12-20 | The Attachments Handler plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 1.1.7 due to insuffi… |
CVE-2025-8065 | Medium | 6.5 | 2025-12-20 | A stack-based buffer overflow vulnerability was identified in the ONVIF SOAP XML Parser in Tapo C200 v3 and C520WS v2.6. When processing XML tags with namespac… |
CVE-2025-14300 | High | 8.1 | 2025-12-20 | The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the s… |
CVE-2025-14299 | Medium | 6.5 | 2025-12-20 | The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on th… |
CVE-2025-68613 | Critical | 9.9 | 2025-12-19 | n8n is an open source workflow automation platform. Versions starting with 0.211.0 and prior to 1.120.4, 1.121.1, and 1.122.0 contain a critical Remote Code Ex… |
CVE-2025-68481 | Medium | 5.9 | 2025-12-19 | FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tok… |
CVE-2025-67712 | Medium | 4.7 | 2025-12-19 | There is an HTML injection issue in Esri ArcGIS Web AppBuilder developer edition versions prior to 2.30 that allows a remote, unauthenticated attacker to poten… |
CVE-2025-14968 | High | 7.3 | 2025-12-19 | A security flaw has been discovered in code-projects Simple Stock System 1.0. Affected by this issue is some unknown functionality of the file /market/update.p… |
CVE-2025-14967 | High | 7.3 | 2025-12-19 | A vulnerability was identified in itsourcecode Student Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /candidate… |