2025 CVEs (page 68)
Page 68 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-14314 | High | 8.5 | 2025-12-18 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Roxnor PopupKit popup-builder-block allows Blind SQL Inje… |
CVE-2025-13498 | Medium | 4.3 | 2025-12-18 | The Download Manager plugin for WordPress is vulnerable to unauthorized access of sensitive information in all versions up to, and including, 3.3.32. This is d… |
CVE-2025-12976 | Medium | 6.4 | 2025-12-18 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events_list_gro… |
CVE-2025-10019 | Medium | 6.5 | 2025-12-18 | Authorization Bypass Through User-Controlled Key vulnerability in codepeople Contact Form Email contact-form-to-email allows Exploiting Incorrectly Configured… |
CVE-2025-68463 | Medium | 4.9 | 2025-12-18 | Bio.Entrez in Biopython through 186 allows doctype XXE. |
CVE-2025-68462 | Low | 3.2 | 2025-12-18 | Freedombox before 25.17.1 does not set proper permissions for the backups-data directory, allowing the reading of dump files of databases. |
CVE-2025-68459 | High | 7.2 | 2025-12-18 | RG - AP180, Indoor Wall Plate Wireless AP AP180 series provided by Ruijie Networks Co., Ltd. contain an OS command injection vulnerability. An arbitrary OS com… |
CVE-2025-47387 | High | 7.8 | 2025-12-18 | Memory Corruption when processing IOCTLs for JPEG data without verification. |
CVE-2025-47382 | High | 7.8 | 2025-12-18 | Memory corruption while loading an invalid firmware in boot loader. |
CVE-2025-47372 | Critical | 9.0 | 2025-12-18 | Memory Corruption when a corrupted ELF image with an oversized file size is read into a buffer without authentication. |
CVE-2025-47350 | High | 7.8 | 2025-12-18 | Memory corruption while handling concurrent memory mapping and unmapping requests from a user-space application. |
CVE-2025-47325 | Medium | 6.5 | 2025-12-18 | Information disclosure while processing system calls with invalid parameters. |
CVE-2025-47323 | High | 7.8 | 2025-12-18 | Memory corruption while routing GPR packets between user and root when handling large data packet. |
CVE-2025-47322 | High | 7.8 | 2025-12-18 | Memory corruption while handling IOCTL calls to set mode. |
CVE-2025-47321 | High | 7.8 | 2025-12-18 | Memory corruption while copying packets received from unix clients. |
CVE-2025-47320 | High | 7.8 | 2025-12-18 | Memory corruption while processing MFC channel configuration during music playback. |
CVE-2025-47319 | Medium | 6.7 | 2025-12-18 | Information disclosure while exposing internal TA-to-TA communication APIs to HLOS |
CVE-2025-27063 | High | 7.8 | 2025-12-18 | Memory corruption during video playback when video session open fails with time out error. |
CVE-2025-68461 | High | 7.2 | 2025-12-18 | Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document. |
CVE-2025-68460 | High | 7.2 | 2025-12-18 | Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer. |
CVE-2025-12885 | Medium | 6.4 | 2025-12-18 | The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sanitize_pdf_src… |
CVE-2025-14856 | Medium | 6.3 | 2025-12-18 | A security vulnerability has been detected in y_project RuoYi up to 4.8.1. The affected element is an unknown function of the file /monitor/cache/getnames. Suc… |
CVE-2025-14841 | Low | 3.3 | 2025-12-18 | A flaw has been found in OFFIS DCMTK up to 3.6.9. The impacted element is the function DcmQueryRetrieveIndexDatabaseHandle::startFindRequest/DcmQueryRetrieveIn… |
CVE-2025-14837 | Medium | 4.7 | 2025-12-18 | A vulnerability has been found in ZZCMS 2025. Affected by this issue is the function stripfxg of the file /admin/siteconfig.php of the component Backend Websit… |
CVE-2025-14202 | | 2025-12-18 | A vulnerability in the file upload at bookmark + asset rendering pipeline allows an attacker to upload a malicious SVG file with JavaScript content. When an au… | |
CVE-2025-68435 | Critical | 9.1 | 2025-12-17 | Zerobyte is a backup automation tool Zerobyte versions prior to 0.18.5 and 0.19.0 contain an authentication bypass vulnerability where authentication middlewar… |
CVE-2025-68434 | High | 8.8 | 2025-12-17 | Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and pr… |
CVE-2025-68433 | High | 7.7 | 2025-12-17 | Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre. The Zed IDE loads Model Context Protocol (MCP) configuratio… |
CVE-2025-68432 | High | 7.7 | 2025-12-17 | Zed, a code editor, has an aribtrary code execution vulnerability in versions prior to 0.218.2-pre. The Zed IDE loads Language Server Protocol (LSP) configurat… |
CVE-2025-68429 | High | 7.3 | 2025-12-17 | Storybook is a frontend workshop for building user interface components and pages in isolation. A vulnerability present starting in versions 7.0.0 and prior to… |
CVE-2025-68147 | High | 8.1 | 2025-12-17 | Open Source Point of Sale (opensourcepos) is a web based point of sale application written in PHP using CodeIgniter framework. Starting in version 3.4.0 and pr… |
CVE-2025-68145 | Critical | 9.1 | 2025-12-17 | In mcp-server-git versions prior to 2025.12.17, when the server is started with the --repository flag to restrict operations to a specific repository path, it… |
CVE-2025-68144 | High | 7.1 | 2025-12-17 | In mcp-server-git versions prior to 2025.12.17, the git_diff and git_checkout functions passed user-controlled arguments directly to git CLI commands without s… |
CVE-2025-68143 | High | 8.8 | 2025-12-17 | Model Context Protocol Servers is a collection of reference implementations for the model context protocol (MCP). In mcp-server-git versions prior to 2025.9.25… |
CVE-2025-66029 | High | 7.6 | 2025-12-17 | Open OnDemand provides remote web access to supercomputers. In versions 4.0.8 and prior, the Apache proxy allows sensitive headers to be passed to origin serve… |
CVE-2025-14836 | Low | 2.7 | 2025-12-17 | A flaw has been found in ZZCMS 2025. Affected by this vulnerability is an unknown functionality of the file /reg/user_save.php of the component User Data Stora… |
CVE-2025-14834 | Medium | 6.3 | 2025-12-17 | A weakness has been identified in code-projects Simple Stock System 1.0. This affects an unknown function of the file /checkuser.php. Executing a manipulation… |
CVE-2025-14833 | High | 7.3 | 2025-12-17 | A security flaw has been discovered in code-projects Online Appointment Booking System 1.0. The impacted element is an unknown function of the file /admin/dele… |
CVE-2025-68401 | Medium | 4.8 | 2025-12-17 | ChurchCRM is an open-source church management system. Prior to version 6.0.0, the application stores user-supplied HTML/JS without sufficient sanitization/enco… |
CVE-2025-68400 | High | 8.8 | 2025-12-17 | ChurchCRM is an open-source church management system. A SQL Injection vulnerability exists in the legacy endpoint `/Reports/ConfirmReportEmail.php` in ChurchCR… |
CVE-2025-68399 | Medium | 5.4 | 2025-12-17 | ChurchCRM is an open-source church management system. In versions prior to 6.5.4, there is a Stored Cross-Site Scripting (XSS) vulnerability within the GroupEd… |
CVE-2025-68275 | Medium | 4.8 | 2025-12-17 | ChurchCRM is an open-source church management system. Versions prior to 6.5.3 have a stored cross-site scripting vulnerability on the pages `View Active People… |
CVE-2025-68129 | Medium | 6.8 | 2025-12-17 | Auth0-PHP is a PHP SDK for Auth0 Authentication and Management APIs. In applications built with the Auth0-PHP SDK, the audience validation in access tokens is… |
CVE-2025-68118 | Critical | 9.1 | 2025-12-17 | FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.20.0, a vulnerability exists in FreeRDP’s certificate handling code on Wind… |
CVE-2025-68114 | Medium | 4.8 | 2025-12-17 | Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, an unchecked vsnprintf return in SStream_concat lets a malicious cs_opt_mem.vsnprintf… |
CVE-2025-68112 | Critical | 9.6 | 2025-12-17 | ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability in ChurchCRM's Event Attendee Editor allows aut… |
CVE-2025-68111 | High | 7.2 | 2025-12-17 | ChurchCRM is an open-source church management system. In versions prior to 6.5.3, a SQL injection vulnerability exists in the `eGive.php` file within the "ReIm… |
CVE-2025-68110 | Critical | 9.9 | 2025-12-17 | ChurchCRM is an open-source church management system. Versions prior to 6.5.3 may disclose database information in an error message including the host, ip, use… |
CVE-2025-68109 | Critical | 9.1 | 2025-12-17 | ChurchCRM is an open-source church management system. In versions prior to 6.5.3, the Database Restore functionality does not validate the content or file exte… |
CVE-2025-67877 | High | 8.8 | 2025-12-17 | ChurchCRM is an open-source church management system. Versions prior to 6.5.3 have a SQL injection vulnerability in the `src/CartToFamily.php` file, specifical… |
CVE-2025-67876 | Medium | 5.4 | 2025-12-17 | ChurchCRM is an open-source church management system. A stored cross-site scripting (XSS) vulnerability exists in ChurchCRM versions 6.4.0 and prior that allow… |
CVE-2025-67875 | Medium | 5.4 | 2025-12-17 | ChurchCRM is an open-source church management system. A privilege escalation vulnerability exists in ChurchCRM prior to version 6.5.3. An authenticated user wi… |
CVE-2025-67873 | Medium | 4.8 | 2025-12-17 | Capstone is a disassembly framework. In versions 6.0.0-Alpha5 and prior, Skipdata length is not bounds-checked, so a user-provided skipdata callback can make c… |
CVE-2025-67794 | Medium | 6.1 | 2025-12-17 | An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 before 24.2.8, and 25.1 before 25.1.6. Directories and files created by the agent are created wi… |
CVE-2025-67791 | Critical | 9.8 | 2025-12-17 | An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 through 25.1.*. An incomplete configuration (agent authentication) in D… |
CVE-2025-14832 | High | 7.3 | 2025-12-17 | A vulnerability was identified in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /updateproduct.php?acti… |
CVE-2025-67793 | Critical | 9.8 | 2025-12-17 | An issue was discovered in DriveLock 24.1 through 24.1.*, 24.2 through 24.2.*, and 25.1 before 25.1.6. Users with the "Manage roles and permissions" privilege… |
CVE-2025-67792 | High | 7.8 | 2025-12-17 | An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged users can manipulate a DriveLock proces… |
CVE-2025-67790 | High | 7.5 | 2025-12-17 | An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. An unprivileged user could cause occasionally a Blue Scree… |
CVE-2025-67789 | Medium | 5.3 | 2025-12-17 | An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Authenticated users can retrieve the computer count of oth… |
CVE-2025-67493 | High | 7.5 | 2025-12-17 | Homarr is an open-source dashboard. Prior to version 1.45.3, it was possible to craft an input which allowed privilege escalation and getting access to groups… |
CVE-2025-66647 | Critical | 9.8 | 2025-12-17 | RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A v… |
CVE-2025-59849 | Medium | 4.7 | 2025-12-17 | Improper management of Content Security Policy in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow the execution of malicio… |
CVE-2025-55254 | Low | 3.7 | 2025-12-17 | Improper management of Path-relative stylesheet import in HCL BigFix Remote Control Lite Web Portal (versions 10.1.0.0326 and lower) may allow to execute malic… |
CVE-2025-53000 | High | 7.8 | 2025-12-17 | The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions of nbconvert up to and including 7.16… |
CVE-2025-46292 | Medium | 5.5 | 2025-12-17 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2. An app may be able… |
CVE-2025-46291 | High | 7.8 | 2025-12-17 | A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Tahoe 26.2. An app may bypass Gatekeeper checks. |
CVE-2025-46288 | Medium | 5.5 | 2025-12-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2, watchOS 26.2… |
CVE-2025-46283 | Medium | 5.5 | 2025-12-17 | A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2. An app may be able to… |
CVE-2025-46282 | Medium | 5.5 | 2025-12-17 | The issue was addressed with additional permissions checks. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. An app may be able to access sensitive user d… |
CVE-2025-46281 | High | 8.8 | 2025-12-17 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.2. An app may be able to bre… |
CVE-2025-46279 | Low | 3.3 | 2025-12-17 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2… |
CVE-2025-46278 | Medium | 5.5 | 2025-12-17 | The issue was addressed with improved handling of caches. This issue is fixed in macOS Tahoe 26.2. An app may be able to access protected user data. |
CVE-2025-46277 | Low | 3.3 | 2025-12-17 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, watchOS 26.2. An app may be able… |
CVE-2025-43541 | Medium | 4.3 | 2025-12-17 | A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2… |
CVE-2025-43536 | Medium | 4.3 | 2025-12-17 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26… |
CVE-2025-43535 | Medium | 4.3 | 2025-12-17 | The issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS Tahoe… |
CVE-2025-43533 | Medium | 5.7 | 2025-12-17 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 18.7.5 and iPadOS 18.7.5, iOS 26.2 and iPadOS 26.2, macOS Sequoia 15.7.4, macOS… |
CVE-2025-43531 | Low | 3.1 | 2025-12-17 | A race condition was addressed with improved state handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2, macOS… |
CVE-2025-43529 | High | 8.8 | 2025-12-17 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26… |
CVE-2025-43526 | Critical | 9.8 | 2025-12-17 | This issue was addressed with improved URL validation. This issue is fixed in Safari 26.2, macOS Tahoe 26.2. On a Mac with Lockdown Mode enabled, web content o… |
CVE-2025-43514 | Medium | 5.5 | 2025-12-17 | The issue was addressed with improved handling of caches. This issue is fixed in macOS Tahoe 26.2. An app may be able to access protected user data. |
CVE-2025-43501 | Medium | 4.3 | 2025-12-17 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in Safari 26.2, iOS 18.7.3 and iPadOS 18.7.3, iOS 26.2 and iPadOS 26.2… |
CVE-2025-43475 | Medium | 5.5 | 2025-12-17 | A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26.2 and iPadOS 26.2. An app may be able to access user-sensitive data. |
CVE-2025-43428 | Critical | 9.8 | 2025-12-17 | A configuration issue was addressed with additional restrictions. This issue is fixed in iOS 26.2 and iPadOS 26.2, macOS Tahoe 26.2, visionOS 26.2. Photos in t… |
CVE-2025-14764 | Medium | 5.3 | 2025-12-17 | Missing cryptographic key commitment in the Amazon S3 Encryption Client for Go may allow a user with write access to the S3 bucket to introduce a new EDK that… |
CVE-2025-14763 | Medium | 5.3 | 2025-12-17 | Missing cryptographic key commitment in the Amazon S3 Encryption Client for Java may allow a user with write access to the S3 bucket to introduce a new EDK tha… |
CVE-2025-14762 | Medium | 5.3 | 2025-12-17 | Missing cryptographic key commitment in the AWS SDK for Ruby may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to differ… |
CVE-2025-14761 | Medium | 5.3 | 2025-12-17 | Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to differe… |
CVE-2025-67787 | Critical | 9.6 | 2025-12-17 | An issue was discovered in 25.1.2 before 25.1.5. A Cross Site Scripting (XSS) issue in DriveLock Operations Center allows for session takeover over a network. |
CVE-2025-67781 | Critical | 9.9 | 2025-12-17 | An issue was discovered in DriveLock 24.1 before 24.1.6, 24.2 before 24.2.7, and 25.1 before 25.1.5. Local unprivileged users can manipulate privileged process… |
CVE-2025-67074 | Medium | 6.5 | 2025-12-17 | A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service… |
CVE-2025-67073 | Critical | 9.8 | 2025-12-17 | A Buffer overflow vulnerability in function fromAdvSetMacMtuWan of bin httpd in Tenda AC10V4.0 V16.03.10.20 allows remote attackers to cause denial of service… |
CVE-2025-66646 | High | 7.5 | 2025-12-17 | RIOT is an open-source microcontroller operating system, designed to match the requirements of Internet of Things (IoT) devices and other embedded devices. A v… |
CVE-2025-66397 | High | 8.3 | 2025-12-17 | ChurchCRM is an open-source church management system. Prior to version 6.5.3, the allowRegistration, acceptKiosk, reloadKiosk, and identifyKiosk functions in t… |
CVE-2025-66396 | High | 7.2 | 2025-12-17 | ChurchCRM is an open-source church management system. Prior to version 6.5.3, a SQL injection vulnerability exists in the `src/UserEditor.php` file. When an ad… |
CVE-2025-65233 | Medium | 6.1 | 2025-12-17 | Reflected cross-site scripting (XSS) in SLiMS (slims9_bulian) before 9.6.0 via improper handling of $_SERVER['PHP_SELF' ] in index.php/sysconfig.inc.php, which… |
CVE-2025-34442 | High | 7.5 | 2025-12-17 | AVideo versions prior to 20.1 disclose absolute filesystem paths via multiple public API endpoints. Returned metadata includes full server paths to media files… |
CVE-2025-34441 | High | 7.5 | 2025-12-17 | AVideo versions prior to 20.1 expose sensitive user information through an unauthenticated public API endpoint. Responses include emails, usernames, administra… |
CVE-2025-34440 | Medium | 6.1 | 2025-12-17 | AVideo versions prior to 20.1 contain an open redirect vulnerability caused by insufficient validation of the siteRedirectUri parameter during user registratio… |