2025 CVEs (page 70)
Page 70 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-68177 | | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: cpufreq/longhaul: handle NULL policy in longhaul_exit longhaul_exit() was calling cpufreq… | |
CVE-2025-68176 | | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: PCI: cadence: Check for the existence of cdns_pcie::ops before using it cdns_pcie::ops mi… | |
CVE-2025-68175 | High | 7.8 | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix streaming cleanup on release The current implementation uncondi… |
CVE-2025-68174 | High | 7.8 | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: amd/amdkfd: enhance kfd process check in switch partition current switch partition only c… |
CVE-2025-68173 | | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: ftrace: Fix softlockup in ftrace_module_enable A soft lockup was observed when loading am… | |
CVE-2025-68172 | | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: crypto: aspeed - fix double free caused by devm The clock obtained via devm_clk_get_enabl… | |
CVE-2025-68171 | High | 7.8 | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: x86/fpu: Ensure XFD state on signal delivery Sean reported [1] the following splat when r… |
CVE-2025-68170 | High | 7.8 | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: drm/radeon: Do not kfree() devres managed rdev Since the allocation of the drivers main s… |
CVE-2025-68169 | | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: netpoll: Fix deadlock in memory allocation under spinlock Fix a AA deadlock in refill_skb… | |
CVE-2025-68168 | High | 7.8 | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: jfs: fix uninitialized waitqueue in transaction manager The transaction manager initializ… |
CVE-2025-68167 | High | 7.8 | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: gpiolib: fix invalid pointer access in debugfs If the memory allocation in gpiolib_seq_st… |
CVE-2025-40363 | | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: net: ipv6: fix field-spanning memcpy warning in AH output Fix field-spanning memcpy warni… | |
CVE-2025-40362 | High | 8.8 | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: ceph: fix multifs mds auth caps issue The mds auth caps check should also validate the fs… |
CVE-2025-40360 | | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: drm/sysfb: Do not dereference NULL pointer in plane reset The plane state in __drm_gem_re… | |
CVE-2025-40359 | | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Fix KASAN global-out-of-bounds warning When running "perf mem record" com… | |
CVE-2025-40358 | High | 7.1 | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: riscv: stacktrace: Disable KASAN checks for non-current tasks Unwinding the stack of a ta… |
CVE-2025-40357 | | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: net/smc: fix general protection fault in __smc_diag_dump The syzbot report a crash: Oo… | |
CVE-2025-40356 | High | 7.8 | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: spi: rockchip-sfc: Fix DMA-API usage Use DMA-API dma_map_single() call for getting the DM… |
CVE-2025-40355 | | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: sysfs: check visibility before changing group attribute ownership Since commit 0c17270f9b… | |
CVE-2025-40354 | High | 7.8 | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: increase max link count and fix link->enc NULL pointer access [why] 1.)… |
CVE-2025-40353 | | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: arm64: mte: Do not warn if the page is already tagged in copy_highpage() The arm64 copy_h… | |
CVE-2025-40352 | | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init The lock-related… | |
CVE-2025-40351 | | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix KMSAN uninit-value issue in hfsplus_delete_cat() The syzbot reported issue i… | |
CVE-2025-40350 | Critical | 9.8 | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ XDP programs c… |
CVE-2025-40349 | High | 7.8 | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: hfs: validate record offset in hfsplus_bmap_alloc hfsplus_bmap_alloc can trigger a crash… |
CVE-2025-40348 | | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: slab: Avoid race on slab->obj_exts in alloc_slab_obj_exts If two competing threads enter… | |
CVE-2025-40347 | High | 7.5 | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: net: enetc: fix the deadlock of enetc_mdio_lock After applying the workaround for err0500… |
CVE-2025-40346 | | 2025-12-16 | In the Linux kernel, the following vulnerability has been resolved: arch_topology: Fix incorrect error check in topology_parse_cpu_capacity() Fix incorrect u… | |
CVE-2025-65076 | Medium | 6.1 | 2025-12-16 | WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-pri… |
CVE-2025-65075 | Medium | 6.5 | 2025-12-16 | WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-pri… |
CVE-2025-65074 | High | 7.2 | 2025-12-16 | WaveView client allows users to execute restricted set of predefined commands and scripts on the connected WaveStore Server. A malicious attacker with high-pri… |
CVE-2025-14780 | Medium | 6.3 | 2025-12-16 | A vulnerability was detected in Xiongwei Smart Catering Cloud Platform 2.1.6446.28761. The affected element is an unknown function of the file /dishtrade/dish_… |
CVE-2025-14443 | Medium | 6.4 | 2025-12-16 | A flaw was found in ose-openshift-apiserver. This vulnerability allows internal network enumeration, service discovery, limited information disclosure, and pot… |
CVE-2025-13741 | Medium | 4.3 | 2025-12-16 | The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin for WordPress is vulnerable to unauthoriz… |
CVE-2025-13474 | High | 7.5 | 2025-12-16 | Authorization Bypass Through User-Controlled Key vulnerability in Menulux Software Inc. Mobile App allows Exploitation of Trusted Identifiers. This issue affe… |
CVE-2025-11220 | Medium | 6.4 | 2025-12-16 | The Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Text Path widget in all versions up to, and including, 3.33.3… |
CVE-2025-0836 | Medium | 6.3 | 2025-12-16 | Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management Server to have full read/write access to… |
CVE-2025-14002 | High | 8.1 | 2025-12-16 | The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak… |
CVE-2025-68088 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Huger for Elementor huger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-68087 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Modalier for Elementor modalier-elementor allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-68086 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Reformer for Elementor reformer-elementor allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-68085 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Buttoner for Elementor buttoner-elementor allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-68084 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in Nitesh Ultimate Auction ultimate-auction allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-68083 | Medium | 5.4 | 2025-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Meks Meks Quick Plugin Disabler meks-quick-plugin-disabler allows Cross Site Request Forgery.This issue affe… |
CVE-2025-68082 | Medium | 5.4 | 2025-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in SEMrush CY LTD Semrush Content Toolkit semrush-contentshake allows Cross Site Request Forgery.This issue aff… |
CVE-2025-68080 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal User Avatar - Reloaded user-avatar-reloaded al… |
CVE-2025-68079 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNectar Salient Shortcodes salient-shortcodes allows… |
CVE-2025-68078 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNectar Salient Portfolio salient-portfolio allows St… |
CVE-2025-68077 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Stockholm stockholm allows Stored XSS.This… |
CVE-2025-68076 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Stockholm Core stockholm-core allows Stored… |
CVE-2025-68071 | Medium | 6.5 | 2025-12-16 | Authorization Bypass Through User-Controlled Key vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured… |
CVE-2025-68070 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vektor,Inc. VK Google Job Posting Manager vk-google-job-p… |
CVE-2025-68068 | High | 7.5 | 2025-12-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Stockholm stockholm allo… |
CVE-2025-68067 | High | 7.5 | 2025-12-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Stockholm Core stockholm… |
CVE-2025-68066 | High | 7.5 | 2025-12-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PenciDesign Soledad soledad allows PHP… |
CVE-2025-68065 | High | 7.5 | 2025-12-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LiquidThemes Hub Core allows PHP Local… |
CVE-2025-68062 | High | 7.5 | 2025-12-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MinimogWP minimog allows PHP… |
CVE-2025-68061 | High | 7.5 | 2025-12-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove EduMall edumall allows PHP L… |
CVE-2025-68056 | High | 8.5 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LBG Zoominoutslider lbg_zoominoutslider allo… |
CVE-2025-68055 | High | 8.5 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection… |
CVE-2025-68054 | High | 8.5 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup CountDown With Image or Video Background cou… |
CVE-2025-68053 | High | 8.5 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup xPromoter top_bar_promoter allows Blind SQL… |
CVE-2025-67999 | High | 7.6 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stefano Lissa Newsletter newsletter allows Blind SQL Inje… |
CVE-2025-67989 | Medium | 5.4 | 2025-12-16 | Server-Side Request Forgery (SSRF) vulnerability in LMPixels Kerge kerge allows Server Side Request Forgery.This issue affects Kerge: from n/a through <= 4.1.3. |
CVE-2025-67986 | Medium | 5.9 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins Document Library Lite document-library-lite… |
CVE-2025-67985 | Medium | 5.3 | 2025-12-16 | Authorization Bypass Through User-Controlled Key vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Exploiting Incorrectly Confi… |
CVE-2025-67983 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-st… |
CVE-2025-67976 | Medium | 6.5 | 2025-12-16 | Missing Authorization vulnerability in Bob Watu Quiz watu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watu Quiz… |
CVE-2025-67965 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in favethemes Homey Core homey-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-67962 | High | 7.6 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AIOSEO Plugin Team Broken Link Checker broken-link-checke… |
CVE-2025-67951 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Addons for Elementor wpzoom-elementor-addon… |
CVE-2025-67950 | High | 8.5 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allow… |
CVE-2025-67948 | Medium | 4.3 | 2025-12-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-mark… |
CVE-2025-67929 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-67912 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premio Stars Testimonials stars-testimonials-with-slider-… |
CVE-2025-66167 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Lottier lottier-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-66166 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Lottier for Elementor lottier-elementor allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-66165 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Lottier for WPBakery lottier-wpbakery allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66164 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Laser laser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Laser… |
CVE-2025-66163 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Masker for Elementor masker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66162 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Spoter for Elementor spoter-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66161 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Grider for Elementor grider-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66147 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Coder for Elementor coder-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-66134 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in NinjaTeam FileBird Pro filebird-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-66133 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Conf… |
CVE-2025-66132 | Medium | 5.3 | 2025-12-16 | Authorization Bypass Through User-Controlled Key vulnerability in FAPI Business s.r.o. FAPI Member fapi-member allows Exploiting Incorrectly Configured Access… |
CVE-2025-66131 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in yaadsarig Yaad Sarig Payment Gateway For WC yaad-sarig-payment-gateway-for-wc allows Exploiting Incorrectly Configured A… |
CVE-2025-66130 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in etruel WP Views Counter wpecounter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-66129 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in wppochipp Pochipp pochipp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poc… |
CVE-2025-66128 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in Brevo Sendinblue for WooCommerce woocommerce-sendinblue-newsletter-subscription allows Exploiting Incorrectly Configured… |
CVE-2025-66127 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-66126 | Medium | 5.3 | 2025-12-16 | Insertion of Sensitive Information Into Sent Data vulnerability in wowpress.host Fix Media Library wow-media-library-fix allows Retrieve Embedded Sensitive Dat… |
CVE-2025-66125 | Medium | 5.3 | 2025-12-16 | Insertion of Sensitive Information Into Sent Data vulnerability in Nitesh Ultimate Auction ultimate-auction allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2025-66124 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in ZEEN101 Leaky Paywall leaky-paywall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-66122 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in Design Stylish Price List stylish-price-list allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-66121 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in SiteGround SiteGround Security sg-security allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-66120 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in CatFolders CatFolders catfolders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-64639 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in WP Compress WP Compress for MainWP wp-compress-mainwp allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-64638 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in OnPay.io OnPay.io for WooCommerce onpay-io-for-woocommerce allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-64635 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in Syed Balkhi Feeds for YouTube feeds-for-youtube allows Exploiting Incorrectly Configured Access Control Security Levels… |