2025 CVEs (page 7)
Page 7 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-14774 | High | 7.4 | 2026-06-03 | Incorrect Authorization vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24. |
CVE-2025-14773 | High | 8.0 | 2026-06-03 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24. |
CVE-2025-14772 | High | 8.8 | 2026-06-03 | Authorization bypass through User-Controlled key vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24. |
CVE-2025-14771 | Critical | 9.9 | 2026-06-03 | Files or directories accessible to external parties vulnerability in ABB T-MAC Plus. This issue affects T-MAC Plus: 4.0-24. |
CVE-2025-15654 | High | 7.1 | 2026-06-03 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fox-themes Prague allows Reflected XSS. This issue affec… |
CVE-2025-15653 | Medium | 6.8 | 2026-06-02 | Dräger Zeus Infinity Empowered (Zeus IE) and Zeus RS C500 anesthesia workstations contain a local security vulnerability that allows unauthorized individuals w… |
CVE-2025-64390 | High | 7.4 | 2026-06-02 | A privilege escalation vulnerability exists in PlayStation 4 firmware versions 13.00 through 13.02. The BD-J (Blu-ray Disc Java) sandbox can be escaped through… |
CVE-2025-69369 | High | 8.1 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Racquet allows PHP Local F… |
CVE-2025-68886 | High | 8.1 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in androThemes Cookiteer allows PHP Local… |
CVE-2025-58897 | High | 8.1 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Fermentio allows PHP Local… |
CVE-2025-58707 | High | 8.1 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Spin allows PHP Local File… |
CVE-2025-58705 | High | 8.1 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Crafti allows PHP Local Fi… |
CVE-2025-58024 | High | 7.5 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in UnboundStudio Accordion FAQ allows PHP… |
CVE-2025-53440 | High | 8.1 | 2026-06-02 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Confidant allows PHP Local… |
CVE-2025-53346 | Medium | 4.3 | 2026-06-02 | Missing Authorization vulnerability in ThimPress Thim Core allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Thim Co… |
CVE-2025-53345 | High | 8.8 | 2026-06-02 | Missing Authorization vulnerability leading to code execution after installing malicious vulnerable plugin in ThimPress Thim Core. This issue affects Thim Cor… |
CVE-2025-53302 | Medium | 5.3 | 2026-06-02 | Missing Authorization vulnerability in Anton Shevchuk Constructor allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Construc… |
CVE-2025-53209 | Critical | 9.8 | 2026-06-02 | Incorrect Privilege Assignment vulnerability in Themeisle Masteriyo LMS PRO allows Privilege Escalation. This issue affects Masteriyo LMS PRO: from n/a throug… |
CVE-2025-52766 | Medium | 6.5 | 2026-06-02 | Missing Authorization vulnerability in Printeers Printeers Print & Ship allows Exploiting Incorrectly Configured Access Control Security Levels. This issue af… |
CVE-2025-52759 | High | 7.1 | 2026-06-02 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UnboundStudio Accordion FAQ allows Reflected XSS. This i… |
CVE-2025-5085 | Medium | 5.5 | 2026-06-02 | The WP Nano AD plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘blogrole_link’ parameter in all versions up to, and including, 1.31 d… |
CVE-2025-59614 | Medium | 6.7 | 2026-06-01 | Memory Corruption when sending random number generator command with insufficient output buffer size. |
CVE-2025-59613 | Medium | 6.7 | 2026-06-01 | Memory Corruption when output buffer size is smaller than input buffer size during data copying operation. |
CVE-2025-59612 | Medium | 6.7 | 2026-06-01 | Memory corruption in windows drivers while sending incorrect trusted application request |
CVE-2025-59611 | Medium | 6.7 | 2026-06-01 | Memory corruption in diagnostic services due to absence of input validation |
CVE-2025-59610 | Medium | 6.4 | 2026-06-01 | Memory Corruption when processing IOCTL requests with mismatched API versions due to concurrent modification of user-space buffer. |
CVE-2025-59609 | Medium | 5.5 | 2026-06-01 | Information Disclosure when processing advertisement frames with malformed MBSSID elements of insufficient length. |
CVE-2025-59606 | High | 7.8 | 2026-06-01 | Memory Corruption when writing to invalid memory locations occurs due to heap memory exhaustion during secure data initialization. |
CVE-2025-59605 | High | 7.8 | 2026-06-01 | Memory Corruption when processing device identifier strings that exceed the expected maximum length. |
CVE-2025-59604 | High | 7.8 | 2026-06-01 | Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer. |
CVE-2025-59601 | Medium | 6.5 | 2026-06-01 | Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device configuration. |
CVE-2025-48652 | High | 7.8 | 2026-06-01 | In performPreInstallChecks of InstallRepository.kt, there is a possible way to bypass MDM policy due to a logic error in the code. This could lead to local esc… |
CVE-2025-48649 | High | 7.8 | 2026-06-01 | In multiple locations, there is a possible way to reset user-selected permissions selections due to a permissions bypass. This could lead to local escalation o… |
CVE-2025-48648 | Medium | 5.5 | 2026-06-01 | In isSameApp of NotificationManagerService.java, there is a possible persistent dos due to resource exhaustion. This could lead to local denial of service with… |
CVE-2025-48616 | Low | 3.3 | 2026-06-01 | In multiple functions of KeyguardViewMediator.java , there is a possible way to bypass lockdown mode with screen pinning due to a logic error in the code. This… |
CVE-2025-48595 | High | 8.4 | 2026-06-01 | In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no a… |
CVE-2025-48570 | High | 7.8 | 2026-06-01 | In multiple functions of PipTaskOrganizer.java, there is a possible way to launch an activity from the background due to a confused deputy. This could lead to… |
CVE-2025-32348 | High | 7.8 | 2026-06-01 | In multiple locations, there is a possible background activity launch due to a missing permission check. This could lead to local escalation of privilege with… |
CVE-2025-26418 | High | 7.8 | 2026-06-01 | In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account to a managed device d… |
CVE-2025-22426 | High | 7.8 | 2026-06-01 | In many functions of ComputerEngine.java, there is a possible way to access URIs across users due to a logic error in the code. This could lead to local escala… |
CVE-2025-22424 | High | 7.8 | 2026-06-01 | In multiple locations, there is a possible way to reveal images across users due to improper input validation. This could lead to local escalation of privilege… |
CVE-2025-70099 | High | 7.5 | 2026-06-01 | A NULL pointer dereference in the ext4_dir_en_get_name_len function in include/ext4_dir.h of lwext4 1.0.0 allows attackers to cause a denial of service by supp… |
CVE-2025-60495 | Medium | 5.5 | 2026-06-01 | A segmentation violation in the gf_media_get_color_info function (/media_tools/isom_tools.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a… |
CVE-2025-60486 | Medium | 5.5 | 2026-06-01 | A heap use-after-free in the dasher_process function (/filters/dasher.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (D… |
CVE-2025-60485 | Medium | 5.5 | 2026-06-01 | A segmentation violation in the gf_isom_apple_set_tag_ex function (/isomedia/isom_write.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a De… |
CVE-2025-60483 | Medium | 5.5 | 2026-06-01 | A NULL pointer dereference in the gf_ac4_pres_b_4_back_channels_present function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attac… |
CVE-2025-60481 | Medium | 5.5 | 2026-06-01 | A NULL pointer dereference in the gf_odf_ac4_cfg_dsi_v1 function (/odf/descriptors.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial… |
CVE-2025-55664 | Medium | 5.5 | 2026-06-01 | A heap buffer overflow in the m2tsdmx_send_packet function (filters/dmx_m2ts.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via sup… |
CVE-2025-41281 | High | 7.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Waterfall WF-500 RX Hos… |
CVE-2025-41280 | High | 7.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-23: Relative Path Traversal (Zip Slip) in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows attackers w… |
CVE-2025-41279 | High | 7.2 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebU… |
CVE-2025-41278 | High | 7.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-125: Out-of-bounds Read in Waterfall WF-500 RX Host in version 7.10.0.0 R2601141040 that allows attackers with access to… |
CVE-2025-41277 | Critical | 9.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Wa… |
CVE-2025-41276 | Critical | 9.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Wa… |
CVE-2025-41275 | Critical | 9.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Wa… |
CVE-2025-41274 | Critical | 9.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Wa… |
CVE-2025-41273 | Critical | 9.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Alternate Path or Channel in the Console WebUI in Waterfall WF-500 TX and RX Hosts in… |
CVE-2025-41272 | Critical | 9.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Wa… |
CVE-2025-41271 | High | 7.5 | 2026-05-29 | Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that… |
CVE-2025-41270 | Critical | 9.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Wa… |
CVE-2025-41269 | Critical | 9.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Wa… |
CVE-2025-41268 | Critical | 9.1 | 2026-05-29 | Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Administration WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R250217104… |
CVE-2025-41267 | High | 7.2 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebU… |
CVE-2025-41266 | High | 7.2 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebU… |
CVE-2025-41265 | High | 7.2 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebU… |
CVE-2025-12714 | Medium | 5.3 | 2026-05-29 | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the up… |
CVE-2025-11262 | High | 7.2 | 2026-05-29 | The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 0.9.0 d… |
CVE-2025-14042 | Medium | 6.4 | 2026-05-29 | The Automotive Car Dealership Business WordPress Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Project Details' custom field in Por… |
CVE-2025-11993 | High | 8.8 | 2026-05-29 | The WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8 via th… |
CVE-2025-48977 | Medium | 6.5 | 2026-05-28 | Relative Path Traversal vulnerability in Apache Ignite REST API. Authenticated REST API users can read any file on the server with "cmd=log" command and a log… |
CVE-2025-69600 | High | 7.8 | 2026-05-27 | Command injection in Raynet rvia RayVentory Scan Engine 12.6 Update 8 and previous versions allows adversaries to execute commands via getconfig, upload, inven… |
CVE-2025-67903 | Medium | 5.3 | 2026-05-27 | Northern.tech Mender Client 5 before 5.0.4 allows a Cryptographic signature verification bypass. |
CVE-2025-70116 | Medium | 4.3 | 2026-05-27 | A NULL pointer dereference in GPAC MP4Box: when parsing certain truncated MP4 files, an unknown/invalid stsd entry can result in missing descriptor fields (e.g… |
CVE-2025-68712 | Medium | 5.5 | 2026-05-27 | SpSoft AppLock (com.sp.protector.free) 7.9.40 for Android allows a local attacker with physical access to bypass fingerprint or PIN authentication. Although th… |
CVE-2025-70103 | High | 7.3 | 2026-05-27 | Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc. |
CVE-2025-71312 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix ntfs_mount_options leak in ntfs_fill_super() In ntfs_fill_super(), the fc->… |
CVE-2025-71311 | High | 8.2 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Initialize new folios before use KMSAN reports an uninitialized value in longes… |
CVE-2025-71309 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix deadlock in ni_read_folio_cmpr Syzbot reported a task hung in ni_readpage_c… |
CVE-2025-71308 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix potential NULL pointer dereference in context cleanup aie_destroy_cont… |
CVE-2025-71307 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix NULL pointer dereference on panthor_fw_unplug This patch removes the MCU… |
CVE-2025-71306 | High | 7.1 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: ima: Fix stack-out-of-bounds in is_bprm_creds_for_exec() KASAN reported a stack-out-of-bo… |
CVE-2025-71305 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: drm/display/dp_mst: Add protection against 0 vcpi When releasing a timeslot there is a sl… |
CVE-2025-71304 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: smack: /smack/doi: accept previously used values Writing to /smack/doi a value that has e… |
CVE-2025-71303 | Medium | 4.7 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix race condition when checking rpm_on When autosuspend is triggered, dri… |
CVE-2025-3633 | Medium | 5.4 | 2026-05-27 | IBM Cognos Analytics 11.2.0, 11.2.4, 12.0, and 12.1.0 and IBM Cognos Transformer 11.2.4, 12.0, and 12.1.0 are vulnerable to cross-site scripting (XSS). This vu… |
CVE-2025-0898 | Medium | 6.5 | 2026-05-27 | The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 1.4.7 via the Draw SVG widge… |
CVE-2025-66593 | Medium | 6.1 | 2026-05-27 | An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content and condu… |
CVE-2025-66592 | Medium | 6.1 | 2026-05-27 | An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restri… |
CVE-2025-52747 | High | 7.1 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jthemes Themebox - Digital Products Ecommerce allows Refl… |
CVE-2025-30028 | High | 8.6 | 2026-05-27 | A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files. |
CVE-2025-22741 | High | 7.1 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RiceTheme Felan Framework allows Reflected XSS. This iss… |
CVE-2025-14713 | High | 7.5 | 2026-05-27 | An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain u… |
CVE-2025-13593 | Medium | 6.1 | 2026-05-27 | Origin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows local users to write arbitrary files with restricted content and… |
CVE-2025-13392 | High | 8.1 | 2026-05-27 | Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-6… |
CVE-2025-13167 | Medium | 5.4 | 2026-05-27 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in contact functionality in Synology Contacts before 1.0.10-… |
CVE-2025-12686 | Critical | 9.8 | 2026-05-27 | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote… |
CVE-2025-10466 | Medium | 5.9 | 2026-05-27 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Safe Access in Synology Safe Access before 1.3.1-0329 all… |
CVE-2025-41670 | High | 7.8 | 2026-05-27 | A local user with low privileges may be able to influence the behavior of a privileged system service by manipulating configuration or application-related file… |
CVE-2025-41669 | High | 8.8 | 2026-05-27 | The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implem… |
CVE-2025-14481 | Medium | 4.3 | 2026-05-27 | The Yoast SEO plugin for WordPress is vulnerable to Insecure Direct Object References in all versions up to, and including, 26.5. This is due to insufficient a… |