2025 CVEs (page 65)
Page 65 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-53710 | High | 7.5 | 2025-12-18 | Due to a product misconfiguration in certain deployment types, it was possible from different pods in the same namespace to communicate with each other. This i… |
CVE-2025-46268 | Medium | 6.3 | 2025-12-18 | Advantech WebAccess/SCADA is vulnerable to SQL injection, which may allow an attacker to execute arbitrary SQL commands. |
CVE-2025-14850 | High | 8.1 | 2025-12-18 | Advantech WebAccess/SCADA is vulnerable to directory traversal, which may allow an attacker to delete arbitrary files. |
CVE-2025-14849 | High | 8.8 | 2025-12-18 | Advantech WebAccess/SCADA is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute arbitrary code. |
CVE-2025-14848 | Medium | 4.3 | 2025-12-18 | Advantech WebAccess/SCADA is vulnerable to absolute directory traversal, which may allow an attacker to determine the existence of arbitrary files. |
CVE-2025-13911 | Medium | 6.4 | 2025-12-18 | Ignition by Inductive Automation, when installed with default OS service account settings, may expose the host system to an elevated code execution risk via… |
CVE-2025-67163 | Medium | 6.1 | 2025-12-18 | A stored cross-site scripting (XSS) vulnerability in Simple Machines Forum v2.1.6 allows attackers to execute arbitrary web scripts or HTML via injecting a cra… |
CVE-2025-65566 | High | 7.5 | 2025-12-18 | A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives a PFCP Ses… |
CVE-2025-64400 | Medium | 4.1 | 2025-12-18 | Control Panel provides an API for pre-registering into an enrollment and organization prior to a user's first login. The API for creating users checks that th… |
CVE-2025-14889 | Medium | 5.4 | 2025-12-18 | A security flaw has been discovered in Campcodes Advanced Voting Management System 1.0. The impacted element is an unknown function of the file /admin/voters_e… |
CVE-2025-67745 | High | 7.1 | 2025-12-18 | MyHoard is a daemon for creating, managing and restoring MySQL backups. Starting in version 1.0.1 and prior to version 1.3.0, in some cases, myhoard logs the w… |
CVE-2025-65568 | High | 7.5 | 2025-12-18 | A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. After PFCP association, a PFCP S… |
CVE-2025-65567 | High | 7.5 | 2025-12-18 | A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. After PFCP association, a specia… |
CVE-2025-65565 | High | 7.5 | 2025-12-18 | A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. After PFCP association is establ… |
CVE-2025-65564 | High | 7.5 | 2025-12-18 | A denial-of-service vulnerability exists in the omec-upf (upf-epc-pfcpiface) in version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives a PFCP Association S… |
CVE-2025-65563 | High | 7.5 | 2025-12-18 | A denial-of-service vulnerability exists in the omec-project UPF (component upf-epc/pfcpiface) up to at least version upf-epc-pfcpiface:2.1.3-dev. When the UPF… |
CVE-2025-65562 | High | 7.5 | 2025-12-18 | The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests. An unauthenticated remote attacker can send… |
CVE-2025-65561 | High | 7.5 | 2025-12-18 | An issue was discovered in function LocalNode.Sess in free5GC 4.1.0 allowing attackers to cause a denial of service or other unspecified impacts via crafted he… |
CVE-2025-65559 | High | 7.5 | 2025-12-18 | An issue was discovered in Open5GS 2.7.5-49-g465e90f, when processing a PFCP Session Establishment Request (type=50), the UPF crashes with a reachable assertio… |
CVE-2025-63387 | High | 7.5 | 2025-12-18 | Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint… |
CVE-2025-59949 | Medium | 5.3 | 2025-12-18 | FreshRSS is a free, self-hostable RSS aggregator. Versions prior to 1.27.1 have a logout cross-site request forgery vulnerability that can lead to denial of se… |
CVE-2025-56157 | Critical | 9.8 | 2025-12-18 | Default credentials in Dify thru 1.5.1. PostgreSQL username and password specified in the docker-compose.yaml file included in its source code. NOTE: the Suppl… |
CVE-2025-14885 | Medium | 6.3 | 2025-12-18 | A flaw has been found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /user_leads.php of the component Leads… |
CVE-2025-14739 | | 2025-12-18 | Access of Uninitialized Pointer vulnerability in TP-Link WR940N and WR941ND allows local unauthenticated attackers the ability to execute DoS attack and pote… | |
CVE-2025-14738 | High | 7.5 | 2025-12-18 | Improper authentication vulnerability in TP-Link WA850RE (httpd modules) allows unauthenticated attackers to download the configuration file.This issue affects… |
CVE-2025-14737 | High | 8.0 | 2025-12-18 | Command Injection vulnerability in TP-Link WA850RE (httpd modules) allows authenticated adjacent attacker to inject arbitrary commands.This issue affects: ≤ WA… |
CVE-2025-66058 | Medium | 6.5 | 2025-12-18 | Missing Authorization vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-64355 | Medium | 6.5 | 2025-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows… |
CVE-2025-64282 | Medium | 4.3 | 2025-12-18 | Authorization Bypass Through User-Controlled Key vulnerability in RadiusTheme Radius Blocks radius-blocks allows Exploiting Incorrectly Configured Access Contr… |
CVE-2025-64236 | Critical | 9.8 | 2025-12-18 | Authentication Bypass Using an Alternate Path or Channel vulnerability in AmentoTech Tuturn allows Authentication Abuse.This issue affects Tuturn: from n/a bef… |
CVE-2025-64235 | Medium | 6.5 | 2025-12-18 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AmentoTech Tuturn allows Path Traversal.This issue affects Tutu… |
CVE-2025-63043 | Medium | 5.3 | 2025-12-18 | Authorization Bypass Through User-Controlled Key vulnerability in PickPlugins Post Grid and Gutenberg Blocks post-grid allows Exploiting Incorrectly Configured… |
CVE-2025-63002 | Medium | 5.3 | 2025-12-18 | Missing Authorization vulnerability in wpforchurch Sermon Manager sermon-manager-for-wordpress allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-62998 | Medium | 5.0 | 2025-12-18 | Insertion of Sensitive Information Into Sent Data vulnerability in WP Messiah WP AI CoPilot ai-co-pilot-for-wp allows Retrieve Embedded Sensitive Data.This iss… |
CVE-2025-62961 | Medium | 5.4 | 2025-12-18 | Missing Authorization vulnerability in sparklewpthemes Sparkle FSE sparkle-fse allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2025-62960 | Medium | 5.4 | 2025-12-18 | Missing Authorization vulnerability in sparklewpthemes Construction Light construction-light allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-14896 | High | 7.5 | 2025-12-18 | due to insufficient sanitazation in Vega’s `convert()` function when `safeMode` is enabled and the spec variable is an array. An attacker can craft a malicious… |
CVE-2025-14884 | High | 7.2 | 2025-12-18 | A vulnerability was detected in D-Link DIR-605 202WWB03. Affected by this issue is some unknown functionality of the component Firmware Update Service. Perform… |
CVE-2025-14879 | Critical | 9.8 | 2025-12-18 | A weakness has been identified in Tenda WH450 1.0.0.18. Affected is an unknown function of the file /goform/onSSIDChange of the component HTTP Request Handler… |
CVE-2025-68469 | Low | 3.3 | 2025-12-18 | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to version 7.1.1-14, ImageMagick crashes when processing a… |
CVE-2025-68278 | High | 8.8 | 2025-12-18 | Tina is a headless content management system. In tinacms prior to version 3.1.1, tinacms uses the gray-matter package in an insecure way allowing attackers tha… |
CVE-2025-64724 | High | 7.3 | 2025-12-18 | Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS is installed with world-writable file permissions on sensit… |
CVE-2025-64723 | Medium | 4.4 | 2025-12-18 | Arduino IDE is an integrated development environment. Prior to version 2.3.7, Arduino IDE for macOS was configured with overly permissive security entitlements… |
CVE-2025-63390 | Medium | 5.3 | 2025-12-18 | An authentication bypass vulnerability exists in AnythingLLM v1.8.5 in via the /api/workspaces endpoint. The endpoint fails to implement proper authentication… |
CVE-2025-63389 | Critical | 9.8 | 2025-12-18 | A critical authentication bypass vulnerability exists in Ollama platform's API endpoints in versions prior to and including v0.12.3. The platform exposes multi… |
CVE-2025-63388 | Critical | 9.1 | 2025-12-18 | A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/system-features endpoint. The endpoint implemen… |
CVE-2025-63386 | Critical | 9.1 | 2025-12-18 | A Cross-Origin Resource Sharing (CORS) misconfiguration vulnerability exists in Dify v1.9.1 in the /console/api/setup endpoint. The endpoint implements an inse… |
CVE-2025-14878 | Critical | 9.8 | 2025-12-18 | A security flaw has been discovered in Tenda WH450 1.0.0.18. This impacts an unknown function of the file /goform/wirelessRestart of the component HTTP Request… |
CVE-2025-14877 | High | 7.3 | 2025-12-18 | A vulnerability was identified in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /admin/add_retailer.php. The manipulat… |
CVE-2025-14823 | Medium | 5.3 | 2025-12-18 | In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azure Key Vault-related key, could be return… |
CVE-2025-9787 | Medium | 6.1 | 2025-12-18 | Zohocorp ManageEngine Applications Manager versions 177400 and below are vulnerable to Stored Cross-Site Scripting vulnerability in the NOC view. |
CVE-2025-7358 | High | 7.5 | 2025-12-18 | Use of Hard-coded Credentials vulnerability in Utarit Informatics Services Inc. SoliClub allows Authentication Abuse. This issue affects SoliClub: before 5.3… |
CVE-2025-7047 | Medium | 4.3 | 2025-12-18 | Missing Authorization vulnerability in Utarit Informatics Services Inc. SoliClub allows Privilege Abuse. This issue affects SoliClub: before 5.3.7. |
CVE-2025-68325 | | 2025-12-18 | In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop In cake_drop(), qdisc_tree… | |
CVE-2025-68324 | | 2025-12-18 | In the Linux kernel, the following vulnerability has been resolved: scsi: imm: Fix use-after-free bug caused by unfinished delayed work The delayed work item… | |
CVE-2025-68323 | | 2025-12-18 | In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: fix use-after-free caused by uec->work The delayed work uec->work is sc… | |
CVE-2025-65011 | | 2025-12-18 | In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) an unauthorised user can view configuration files by directly referencing the resource in que… | |
CVE-2025-65010 | | 2025-12-18 | WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) is vulnerable to Broken Access Control in initial configuration wizard.cgi endpoint. Malicious a… | |
CVE-2025-65009 | | 2025-12-18 | In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) admin password is stored in configuration file as plaintext and can be obtained by unauthoriz… | |
CVE-2025-65008 | | 2025-12-18 | In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) due to lack of validation in the langGet parameter in the adm.cgi endpoint, the malicious att… | |
CVE-2025-65007 | | 2025-12-18 | In WODESYS WD-R608U router (also known as WDR122B V2.0 and WDR28) due to lack of authentication in the configuration change module in the adm.cgi endpoint, the… | |
CVE-2025-64469 | High | 7.8 | 2025-12-18 | There is a stack-based buffer overflow vulnerability in NI LabVIEW in LVResFile::FindRsrcListEntry() when parsing a corrupted VI file. This vulnerability may… |
CVE-2025-64468 | High | 7.8 | 2025-12-18 | There is a use-after-free vulnerability in sentry!sentry_span_set_data() when parsing a corrupted VI file. This vulnerability may result in information disclo… |
CVE-2025-64467 | High | 7.8 | 2025-12-18 | There is an out of bounds read vulnerability in NI LabVIEW in LVResFile::FindRsrcListEntry() when parsing a corrupted VI file. This vulnerability may result i… |
CVE-2025-64466 | High | 7.8 | 2025-12-18 | There is an out of bounds read vulnerability in NI LabVIEW in lvre!ExecPostedProcRecPost() when parsing a corrupted VI file. This vulnerability may result in… |
CVE-2025-64465 | High | 7.8 | 2025-12-18 | There is an out of bounds read vulnerability in NI LabVIEW in lvre!DataSizeTDR() when parsing a corrupted VI file. This vulnerability may result in informatio… |
CVE-2025-64464 | High | 7.8 | 2025-12-18 | There is an out of bounds read vulnerability in NI LabVIEW in lvre!VisaWriteFromFile() when parsing a corrupted VI file. This vulnerability may result in info… |
CVE-2025-64463 | High | 7.8 | 2025-12-18 | There is an out of bounds read vulnerability in NI LabVIEW in LVResource::DetachResource() when parsing a corrupted VI file. This vulnerability may result in… |
CVE-2025-64462 | High | 7.8 | 2025-12-18 | There is an out of bounds read vulnerability in NI LabVIEW in LVResFile::RGetMemFileHandle() when parsing a corrupted VI file. This vulnerability may result i… |
CVE-2025-64461 | High | 7.8 | 2025-12-18 | There is an out of bounds write vulnerability in NI LabVIEW in mgocre_SH_25_3!RevBL() when parsing a corrupted VI file. This vulnerability may result in infor… |
CVE-2025-63757 | High | 7.5 | 2025-12-18 | Integer overflow vulnerability in the yuv2ya16_X_c_template function in libswscale/output.c in FFmpeg 8.0. |
CVE-2025-1031 | High | 7.5 | 2025-12-18 | Authorization Bypass Through User-Controlled Key vulnerability in Utarit Informatics Services Inc. SoliClub allows Functionality Misuse. This issue affects So… |
CVE-2025-1030 | High | 7.5 | 2025-12-18 | Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Utarit Informatics Services Inc. SoliClub allows Query System for Informatio… |
CVE-2025-1029 | High | 7.5 | 2025-12-18 | Use of Hard-coded Credentials vulnerability in Utarit Information Services Inc. SoliClub allows Read Sensitive Constants Within an Executable. This issue affe… |
CVE-2025-14861 | High | 8.8 | 2025-12-18 | Memory safety bugs present in Firefox 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
CVE-2025-14860 | Critical | 9.8 | 2025-12-18 | Use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox 146.0.1. |
CVE-2025-14744 | Medium | 6.5 | 2025-12-18 | Unicode RTLO characters could allow malicious websites to spoof filenames in the downloads UI for Firefox for iOS, potentially tricking users into saving files… |
CVE-2025-65000 | Medium | 5.3 | 2025-12-18 | SSH private keys of the "Remote alert handlers (Linux)" rule were exposed in the rule page's HTML source in Checkmk <= 2.4.0p18 and all versions of Checkmk 2.3… |
CVE-2025-40898 | High | 8.1 | 2025-12-18 | A path traversal vulnerability was discovered in the Import Arc data archive functionality due to insufficient validation of the input file. An authenticated u… |
CVE-2025-40893 | Medium | 6.1 | 2025-12-18 | A Stored HTML Injection vulnerability was discovered in the Asset List functionality due to improper validation of network traffic data. An unauthenticated att… |
CVE-2025-40892 | High | 8.9 | 2025-12-18 | A Stored Cross-Site Scripting vulnerability was discovered in the Reports functionality due to improper validation of an input parameter. An authenticated user… |
CVE-2025-40891 | Medium | 4.7 | 2025-12-18 | A Stored HTML Injection vulnerability was discovered in the Time Machine Snapshot Diff functionality due to improper validation of network traffic data. An una… |
CVE-2025-14618 | Medium | 4.3 | 2025-12-18 | The Sweet Energy Efficiency plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on the… |
CVE-2025-14437 | High | 7.5 | 2025-12-18 | The Hummingbird Performance plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.18.0 via the 'request'… |
CVE-2025-14277 | Medium | 4.3 | 2025-12-18 | The Prime Slider – Addons for Elementor plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.9 via the i… |
CVE-2025-13110 | Medium | 4.3 | 2025-12-18 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and incl… |
CVE-2025-10910 | | 2025-12-18 | A flaw in the binding process of Govee’s cloud platform and devices allows a remote attacker to bind an existing, online Govee device to the attacker’s account… | |
CVE-2025-40602 | Medium | 6.6 | 2025-12-18 | A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC). |
CVE-2025-64997 | Medium | 6.5 | 2025-12-18 | Insufficient permission validation in Checkmk versions prior to 2.4.0p17 and 2.3.0p42 allow low-privileged users to view agent information via the REST API, wh… |
CVE-2025-14364 | High | 8.8 | 2025-12-18 | The Demo Importer Plus plugin for WordPress is vulnerable to unauthorized modification of data, loss of data, and privilege escalation due to a missing capabil… |
CVE-2025-13730 | Medium | 6.4 | 2025-12-18 | The OpenID Connect Generic Client plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'openid_connect_generic_auth_url' shortcod… |
CVE-2025-13641 | High | 8.8 | 2025-12-18 | The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and includi… |
CVE-2025-14874 | High | 7.5 | 2025-12-18 | A flaw was found in Nodemailer. This vulnerability allows a denial of service (DoS) via a crafted email address header that triggers infinite recursion in the… |
CVE-2025-6326 | High | 8.1 | 2025-12-18 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Inset inset allows PHP Lo… |
CVE-2025-6324 | High | 7.1 | 2025-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MatrixAddons Easy Invoice easy-invoice allows DOM-Based X… |
CVE-2025-67546 | Medium | 6.5 | 2025-12-18 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in weDevs WP ERP erp allows Retrieve Embedded Sensitive Data.This issu… |
CVE-2025-66119 | High | 7.1 | 2025-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Hostel hostel allows Reflected XSS.This issue affects… |
CVE-2025-66118 | High | 7.1 | 2025-12-18 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Sprout Clients sprout-clients allows Reflected X… |
CVE-2025-66117 | High | 7.5 | 2025-12-18 | Missing Authorization vulnerability in Ays Pro Easy Form easy-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects E… |
CVE-2025-66116 | High | 7.5 | 2025-12-18 | Insertion of Sensitive Information Into Sent Data vulnerability in UserElements Ultimate Member Widgets for Elementor ultimate-member-widgets-for-elementor all… |