2025 CVEs (page 63)
Page 63 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-68388 | Medium | 5.3 | 2025-12-18 | Allocation of resources without limits or throttling (CWE-770) allows an unauthenticated remote attacker to cause excessive allocation (CAPEC-130) of memory an… |
CVE-2025-68384 | Medium | 6.5 | 2025-12-18 | Allocation of Resources Without Limits or Throttling (CWE-770) in Elasticsearch can allow a low-privileged authenticated user to cause Excessive Allocation (CA… |
CVE-2025-68383 | Medium | 6.5 | 2025-12-18 | Improper Validation of Specified Index, Position, or Offset in Input (CWE-1285) in Filebeat Syslog parser and the Libbeat Dissect processor can allow a user to… |
CVE-2025-68382 | Medium | 6.5 | 2025-12-18 | Out-of-bounds read (CWE-125) allows an unauthenticated remote attacker to perform a buffer overflow (CAPEC-100) via the NFS protocol dissector, leading to a de… |
CVE-2025-68381 | Medium | 6.5 | 2025-12-18 | Improper Bounds Check (CWE-787) in Packetbeat can allow a remote unauthenticated attacker to exploit a Buffer Overflow (CAPEC-100) and reliably crash the appli… |
CVE-2025-65046 | Low | 3.1 | 2025-12-18 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2025-65041 | Critical | 10.0 | 2025-12-18 | Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network. |
CVE-2025-65037 | Critical | 10.0 | 2025-12-18 | Improper control of generation of code ('code injection') in Azure Container Apps allows an unauthorized attacker to execute code over a network. |
CVE-2025-64677 | High | 8.2 | 2025-12-18 | Improper neutralization of input during web page generation ('cross-site scripting') in Office Out-of-Box Experience allows an unauthorized attacker to perform… |
CVE-2025-64676 | High | 7.2 | 2025-12-18 | '.../...//' in Microsoft Purview allows an authorized attacker to execute code over a network. |
CVE-2025-64663 | Critical | 9.9 | 2025-12-18 | Custom Question Answering Elevation of Privilege Vulnerability |
CVE-2025-34452 | | 2025-12-18 | Streama versions 1.10.0 through 1.10.5 and prior to commit b7c8767 contain a combination of path traversal and server-side request forgery (SSRF) vulnerabiliti… | |
CVE-2025-34451 | High | 7.8 | 2025-12-18 | rofl0r/proxychains-ng versions up to and including 4.17 and prior to commit cc005b7 contain a stack-based buffer overflow vulnerability in the function proxy_f… |
CVE-2025-34450 | High | 7.8 | 2025-12-18 | merbanan/rtl_433 versions up to and including 25.02 and prior to commit 25e47f8 contain a stack-based buffer overflow vulnerability in the function parse_rfraw… |
CVE-2025-34449 | Critical | 9.1 | 2025-12-18 | Genymobile/scrcpy versions up to and including 3.3.3, prior to commit 3e40b24, contain a buffer overflow vulnerability in the sc_device_msg_deserialize() funct… |
CVE-2025-13427 | | 2025-12-18 | An authentication bypass vulnerability in Google Cloud Dialogflow CX Messenger allowed unauthenticated users to interact with restricted chat agents, gaining a… | |
CVE-2025-68161 | Medium | 4.8 | 2025-12-18 | The Socket Appender in Apache Log4j Core versions 2.0-beta9 through 2.25.2 does not perform TLS hostname verification of the peer certificate, even when the v… |
CVE-2025-67653 | Medium | 4.3 | 2025-12-18 | Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to determine the existence of arbitrary files. |
CVE-2025-63951 | High | 7.5 | 2025-12-18 | An insecure deserialization vulnerability exists in the rss-mp3.php script of the MiczFlor RPi-Jukebox-RFID project through commit 4b2334f0ae0e87c0568876fc41c4… |
CVE-2025-63950 | High | 7.5 | 2025-12-18 | An insecure deserialization vulnerability exists in the download.php script of the to3k Twittodon application through commit b1c58a7d1dc664b38deb486ca290779621… |
CVE-2025-63949 | Medium | 6.1 | 2025-12-18 | A Reflected Cross-Site Scripting (XSS) vulnerability in yohanawi Hotel Management System (commit 87e004a) allows a remote attacker to execute arbitrary web scr… |
CVE-2025-63948 | Medium | 5.4 | 2025-12-18 | A SQL Injection vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute arbitrary SQL commands via the dbname par… |
CVE-2025-63947 | Medium | 5.4 | 2025-12-18 | A Reflected Cross-Site Scripting (XSS) vulnerability exists in phpMsAdmin version 2.2 in the database_mode.php file. An attacker can execute arbitrary web scri… |
CVE-2025-62004 | High | 7.5 | 2025-12-18 | BullWall Server Intrusion Protection (SIP) services are initialized after login services during system startup. A local, authenticated attacker can log in afte… |
CVE-2025-62003 | High | 7.5 | 2025-12-18 | BullWall Server Intrusion Protection has a noticeable configuration-dependent delay before the MFA check for RDP connections. A remote, authenticated attacker… |
CVE-2025-62002 | Medium | 4.3 | 2025-12-18 | BullWall Ransomware Containment considers the number of files modified to trigger detection. An authenticated attacker could encrypt a single (possibly large)… |
CVE-2025-62001 | High | 8.8 | 2025-12-18 | BullWall Ransomware Containment supports configurable file and directory exclusions such as '$RECYCLE.BIN' to balance monitoring scope and performance. Certain… |
CVE-2025-62000 | High | 7.1 | 2025-12-18 | BullWall Ransomware Containment may not always detect an encrypted file. This issue affects a specific file inspection method that evaluates file content based… |
CVE-2025-59529 | Medium | 5.5 | 2025-12-18 | Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In versions up to and including 0.9-rc2, the simpl… |
CVE-2025-53710 | High | 7.5 | 2025-12-18 | Due to a product misconfiguration in certain deployment types, it was possible from different pods in the same namespace to communicate with each other. This i… |
CVE-2025-46268 | Medium | 6.3 | 2025-12-18 | Advantech WebAccess/SCADA is vulnerable to SQL injection, which may allow an attacker to execute arbitrary SQL commands. |
CVE-2025-14850 | High | 8.1 | 2025-12-18 | Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to delete arbitrary files. |
CVE-2025-14849 | High | 8.8 | 2025-12-18 | Advantech WebAccess/SCADA is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute arbitrary code. |
CVE-2025-14848 | Medium | 4.3 | 2025-12-18 | Advantech WebAccess/SCADA is vulnerable to absolute directory traversal, which may allow an attacker to determine the existence of arbitrary files. |
CVE-2025-13911 | Medium | 6.4 | 2025-12-18 | The vulnerability affects Ignition SCADA applications where Python scripting is utilized for automation purposes. The vulnerability arises from the absence o… |
CVE-2025-67163 | Medium | 6.1 | 2025-12-18 | A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML via injecting a cra… |
CVE-2025-65566 | High | 7.5 | 2025-12-18 | A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives a PFCP Ses… |
CVE-2025-64400 | Medium | 4.1 | 2025-12-18 | Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. The API for creating users checks that th… |
CVE-2025-14889 | Medium | 5.4 | 2025-12-18 | A security flaw has been discovered in Campcodes Advanced Voting Management System 1.0. The impacted element is an unknown function of the file /admin/voters_e… |
CVE-2025-67745 | High | 7.1 | 2025-12-18 | MyHoard is a daemon for creating, managing and restoring MySQL backups. Starting in version 1.0.1 and prior to version 1.3.0, in some cases, myhoard logs the w… |
CVE-2025-65568 | High | 7.5 | 2025-12-18 | A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. After PFCP association, a PFCP S… |
CVE-2025-65567 | High | 7.5 | 2025-12-18 | A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. After PFCP association, a specia… |
CVE-2025-65565 | High | 7.5 | 2025-12-18 | A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. After PFCP association is establ… |
CVE-2025-65564 | High | 7.5 | 2025-12-18 | A denial-of-service vulnerability exists in the omec-upf (upf-epc-pfcpiface) in version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives a PFCP Association S… |
CVE-2025-65563 | High | 7.5 | 2025-12-18 | A denial-of-service vulnerability exists in the omec-project UPF (component upf-epc/pfcpiface) up to at least version upf-epc-pfcpiface:2.1.3-dev. When the UPF… |
CVE-2025-65562 | High | 7.5 | 2025-12-18 | The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests. An unauthenticated remote attacker can send… |
CVE-2025-65561 | High | 7.5 | 2025-12-18 | An issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to cause a denial of service or other unspecified impacts via crafted he… |
CVE-2025-65559 | High | 7.5 | 2025-12-18 | An issue was discovered in Open5GS 2.7.5-49-g465e90f, when processing a PFCP Session Establishment Request (type=50), the UPF crashes with a reachable assertio… |
CVE-2025-63387 | High | 7.5 | 2025-12-18 | Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint… |
CVE-2025-59949 | Medium | 5.3 | 2025-12-18 | FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vulnerability that can lead to denial of se… |
CVE-2025-56157 | Critical | 9.8 | 2025-12-18 | Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Suppl… |
CVE-2025-14885 | Medium | 6.3 | 2025-12-18 | A flaw has been found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /user_leads.php of the component Leads… |
CVE-2025-14739 | | 2025-12-18 | Access of Uninitialized Pointer vulnerability in TP-Link WR940N and WR941ND allows local unauthenticated attackers the ability to execute DoS attack and pote… | |
CVE-2025-14738 | High | 7.5 | 2025-12-18 | Improper authentication vulnerability in TP-Link WA850RE (httpd modules) allows unauthenticated attackers to download the configuration file.This issue affects… |
CVE-2025-14737 | High | 8.0 | 2025-12-18 | Command Injection vulnerability in TP-Link WA850RE (httpd modules) allows authenticated adjacent attacker to inject arbitrary commands.This issue affects: ≤ WA… |
CVE-2025-66058 | Medium | 6.5 | 2025-12-18 | Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-64355 | Medium | 6.5 | 2025-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows… |
CVE-2025-64282 | Medium | 4.3 | 2025-12-18 | Authorization Bypass Through User-Controlled Key vulnerability in RadiusTheme Radius Blocks radius-blocks allows Exploiting Incorrectly Configured Access Contr… |
CVE-2025-64236 | Critical | 9.8 | 2025-12-18 | Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Tuturn allows Authentication Abuse.This issue affects Tuturn: from n/a bef… |
CVE-2025-64235 | Medium | 6.5 | 2025-12-18 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Tuturn allows Path Traversal.This issue affects Tutu… |
CVE-2025-63043 | Medium | 5.3 | 2025-12-18 | Authorization Bypass Through User-Controlled Key vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured… |
CVE-2025-63002 | Medium | 5.3 | 2025-12-18 | Missing Authorization vulnerability in wpforchurch Sermon Manager sermon-manager-for-wordpress allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-62998 | Medium | 5.0 | 2025-12-18 | Insertion of Sensitive Information Into Sent Data vulnerability in WP Messiah WP AI CoPilot ai-co-pilot-for-wp allows Retrieve Embedded Sensitive Data.This iss… |
CVE-2025-62961 | Medium | 5.4 | 2025-12-18 | Missing Authorization vulnerability in sparklewpthemes Sparkle FSE sparkle-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2025-62960 | Medium | 5.4 | 2025-12-18 | Missing Authorization vulnerability in sparklewpthemes Construction Light construction-light allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-14896 | High | 7.5 | 2025-12-18 | due to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and the spec variable is an array. An attacker can craft a malicious… |
CVE-2025-14884 | High | 7.2 | 2025-12-18 | A vulnerability was detected in D-Link DIR-605 202WWB03. Affected by this issue is some unknown functionality of the component Firmware Update Service. Perform… |
CVE-2025-14879 | Critical | 9.8 | 2025-12-18 | A weakness has been identified in Tenda WH450 1.0.0.18. Affected is an unknown function of the file /goform/onSSIDChange of the component HTTP Request Handler… |
CVE-2025-68469 | Low | 3.3 | 2025-12-18 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.1-14, ImageMagick crashes when processing a… |
CVE-2025-68278 | High | 8.8 | 2025-12-18 | Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers tha… |
CVE-2025-64724 | High | 7.3 | 2025-12-18 | Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS is installed with world-writable file permissions on sensit… |
CVE-2025-64723 | Medium | 4.4 | 2025-12-18 | Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with overly permissive security entitlements… |
CVE-2025-63390 | Medium | 5.3 | 2025-12-18 | An authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces endpoint. The endpoint fails to implement proper authentication… |
CVE-2025-63389 | Critical | 9.8 | 2025-12-18 | A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multi… |
CVE-2025-63388 | Critical | 9.1 | 2025-12-18 | A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint implemen… |
CVE-2025-63386 | Critical | 9.1 | 2025-12-18 | A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an inse… |
CVE-2025-14878 | Critical | 9.8 | 2025-12-18 | A security flaw has been discovered in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/wirelessRestart of the component HTTP Request… |
CVE-2025-14877 | High | 7.3 | 2025-12-18 | A vulnerability was identified in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /admin/add_retailer.php. The manipulat… |
CVE-2025-14823 | Medium | 5.3 | 2025-12-18 | In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azure Key Vault-related key, could be return… |
CVE-2025-9787 | Medium | 6.1 | 2025-12-18 | Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross-Site Scripting vulnerability in the NOC view. |
CVE-2025-7358 | High | 7.5 | 2025-12-18 | Use of Hard-coded Credentials vulnerability in Utarit Informatics Services Inc. SoliClub allows Authentication Abuse. This issue affects SoliClub: before 5.3… |
CVE-2025-7047 | Medium | 4.3 | 2025-12-18 | Missing Authorization vulnerability in Utarit Informatics Services Inc. SoliClub allows Privilege Abuse. This issue affects SoliClub: before 5.3.7. |
CVE-2025-68325 | | 2025-12-18 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop In cake_drop(), qdisc_tree… | |
CVE-2025-68324 | | 2025-12-18 | In the Linux kernel, the following vulnerability has been resolved: scsi: imm: Fix use-after-free bug caused by unfinished delayed work The delayed work item… | |
CVE-2025-68323 | | 2025-12-18 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: fix use-after-free caused by uec->work The delayed work uec->work is sc… | |
CVE-2025-65011 | | 2025-12-18 | In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) an unauthorised user can view configuration files by directly referencing the resource in que… | |
CVE-2025-65010 | | 2025-12-18 | WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) is vulnerable to Broken Access Control in initial configuration wizard.cgi endpoint. Malicious a… | |
CVE-2025-65009 | | 2025-12-18 | In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) admin password is stored in configuration file as plaintext and can be obtained by unauthoriz… | |
CVE-2025-65008 | | 2025-12-18 | In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) due to lack of validation in the langGet parameter in the adm.cgi endpoint, the malicious att… | |
CVE-2025-65007 | | 2025-12-18 | In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) due to lack of authentication in the configuration change module in the adm.cgi endpoint, the… | |
CVE-2025-64469 | High | 7.8 | 2025-12-18 | There is a stack-based buffer overflow vulnerability in NI LabVIEW in LVResFile::FindRsrcListEntry() when parsing a corrupted VI file. This vulnerability may… |
CVE-2025-64468 | High | 7.8 | 2025-12-18 | There is a use-after-free vulnerability in sentry!sentry_span_set_data() when parsing a corrupted VI file. This vulnerability may result in information disclo… |
CVE-2025-64467 | High | 7.8 | 2025-12-18 | There is an out of bounds read vulnerability in NI LabVIEW in LVResFile::FindRsrcListEntry() when parsing a corrupted VI file. This vulnerability may result i… |
CVE-2025-64466 | High | 7.8 | 2025-12-18 | There is an out of bounds read vulnerability in NI LabVIEW in lvre!ExecPostedProcRecPost() when parsing a corrupted VI file. This vulnerability may result in… |
CVE-2025-64465 | High | 7.8 | 2025-12-18 | There is an out of bounds read vulnerability in NI LabVIEW in lvre!DataSizeTDR() when parsing a corrupted VI file. This vulnerability may result in informatio… |
CVE-2025-64464 | High | 7.8 | 2025-12-18 | There is an out of bounds read vulnerability in NI LabVIEW in lvre!VisaWriteFromFile() when parsing a corrupted VI file. This vulnerability may result in info… |
CVE-2025-64463 | High | 7.8 | 2025-12-18 | There is an out of bounds read vulnerability in NI LabVIEW in LVResource::DetachResource() when parsing a corrupted VI file. This vulnerability may result in… |
CVE-2025-64462 | High | 7.8 | 2025-12-18 | There is an out of bounds read vulnerability in NI LabVIEW in LVResFile::RGetMemFileHandle() when parsing a corrupted VI file. This vulnerability may result i… |
CVE-2025-64461 | High | 7.8 | 2025-12-18 | There is an out of bounds write vulnerability in NI LabVIEW in mgocre_SH_25_3!RevBL() when parsing a corrupted VI file. This vulnerability may result in infor… |
CVE-2025-63757 | High | 7.5 | 2025-12-18 | Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0. |