2025 CVEs (page 73)
Page 73 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13794 | Medium | 4.3 | 2025-12-16 | The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2025-12809 | Medium | 5.3 | 2025-12-16 | The Dokan Pro plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the `/dokan/v1/wholesale/register` REST AP… |
CVE-2025-66357 | Medium | 5.3 | 2025-12-16 | CHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper check for unusual or exceptional conditions. When the Video Download feature is in a specifi… |
CVE-2025-61976 | High | 7.5 | 2025-12-16 | CHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper check for unusual or exceptional conditions. If a remote attacker sends a specially crafted… |
CVE-2025-59479 | Medium | 6.1 | 2025-12-16 | CHOCO TEI WATCHER mini (IB-MCT001) contains an issue with improper restriction of rendered UI layers or frames. If a user clicks on content on a malicious web… |
CVE-2025-14777 | Medium | 6.0 | 2025-12-16 | A flaw was found in Keycloak. An IDOR (Broken Access Control) vulnerability exists in the admin API endpoints for authorization resource management, specifical… |
CVE-2025-13956 | Medium | 5.3 | 2025-12-16 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the statistic func… |
CVE-2025-62849 | Critical | 9.8 | 2025-12-16 | An SQL injection vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to e… |
CVE-2025-62848 | High | 7.5 | 2025-12-16 | A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerab… |
CVE-2025-62847 | High | 7.5 | 2025-12-16 | An improper neutralization of argument delimiters in a command vulnerability has been reported to affect several QNAP operating system versions. The remote att… |
CVE-2025-59385 | Critical | 9.8 | 2025-12-16 | An authentication bypass by spoofing vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit th… |
CVE-2025-14749 | Medium | 6.3 | 2025-12-16 | A vulnerability was identified in Ningyuanda TC155 57.0.2.0. This impacts an unknown function of the file /onvif/device_service of the component ONVIF PTZ Cont… |
CVE-2025-14748 | Medium | 5.4 | 2025-12-16 | A vulnerability was determined in Ningyuanda TC155 57.0.2.0. This affects an unknown function of the file /onvif/device_service of the component ONVIF Device M… |
CVE-2025-14747 | Medium | 4.3 | 2025-12-16 | A vulnerability was found in Ningyuanda TC155 57.0.2.0. The impacted element is an unknown function of the component RTSP Service. Performing manipulation resu… |
CVE-2025-14746 | Medium | 4.3 | 2025-12-16 | A vulnerability has been found in Ningyuanda TC155 57.0.2.0. The affected element is an unknown function of the component RTSP Live Video Stream Endpoint. Such… |
CVE-2025-68115 | Medium | 6.1 | 2025-12-16 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 8.6.1 and 9.1.0-alpha.3, a Reflect… |
CVE-2025-68113 | Medium | 6.5 | 2025-12-16 | ALTCHA is privacy-first software for captcha and bot protection. A cryptographic semantic binding flaw in ALTCHA libraries allows challenge payload splicing, w… |
CVE-2025-67874 | Medium | 6.5 | 2025-12-16 | ChurchCRM is an open-source church management system. Prior to version 6.5.0, the application echoes back plaintext passwords submitted by users in subsequent… |
CVE-2025-67751 | High | 7.2 | 2025-12-16 | ChurchCRM is an open-source church management system. Prior to version 6.5.0, a SQL injection vulnerability exists in the `EventEditor.php` file. When creating… |
CVE-2025-67748 | High | 7.8 | 2025-12-16 | Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 had a bypass caused by `pty` missing from the block list of unsafe module… |
CVE-2025-67747 | High | 7.8 | 2025-12-16 | Fickling is a Python pickling decompiler and static analyzer. Versions prior to 0.1.6 are missing `marshal` and `types` from the block list of unsafe module im… |
CVE-2025-67744 | Critical | 9.6 | 2025-12-16 | DeepChat is an open-source artificial intelligence agent platform that unifies models, tools, and agents. Prior to version 0.5.3, a security vulnerability exis… |
CVE-2025-67736 | High | 7.2 | 2025-12-16 | The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk. Versions prior to 16.0.5 an… |
CVE-2025-67735 | Medium | 6.5 | 2025-12-16 | Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.8.Final, the `io.netty.handler.codec.http.Http… |
CVE-2025-67722 | High | 7.8 | 2025-12-16 | FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to versions 16.0.45 and 17.0.24 of the FreePBX framework, an au… |
CVE-2025-67715 | Medium | 4.3 | 2025-12-16 | Weblate is a web based localization tool. In versions prior to 5.15, it was possible to retrieve user notification settings or list all users via API. Version… |
CVE-2025-67492 | Medium | 5.3 | 2025-12-16 | Weblate is a web based localization tool. In versions prior to 5.15, it was possible to trigger repository updates for many repositories via a crafted webhook… |
CVE-2025-66449 | High | 8.8 | 2025-12-16 | ConvertXis a self-hosted online file converter. In versions prior to 0.16.0, the endpoint `/upload` allows an authenticated user to write arbitrary files on th… |
CVE-2025-14758 | Medium | 6.5 | 2025-12-16 | Incorrect configuration of replication security in the MariaDB component of the infra-operator in YAOOK Operator allows an on-path attacker to read database co… |
CVE-2025-9460 | High | 7.8 | 2025-12-16 | A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage… |
CVE-2025-9459 | High | 7.8 | 2025-12-16 | A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage… |
CVE-2025-9457 | High | 7.8 | 2025-12-16 | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage this… |
CVE-2025-9456 | High | 7.8 | 2025-12-16 | A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage t… |
CVE-2025-9455 | High | 7.8 | 2025-12-16 | A maliciously crafted CATPRODUCT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leve… |
CVE-2025-9454 | High | 7.8 | 2025-12-16 | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage th… |
CVE-2025-9453 | High | 7.8 | 2025-12-16 | A maliciously crafted PRT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverage th… |
CVE-2025-9452 | High | 7.8 | 2025-12-16 | A maliciously crafted SLDPRT file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage t… |
CVE-2025-66482 | Medium | 6.5 | 2025-12-16 | Misskey is an open source, federated social media platform. Attackers who use an untrusted reverse proxy or not using a reverse proxy at all can bypass IP rate… |
CVE-2025-66407 | Medium | 5.0 | 2025-12-16 | Weblate is a web based localization tool. The Create Component functionality in Weblate allows authorized users to add new translation components by specifying… |
CVE-2025-66402 | Medium | 6.5 | 2025-12-16 | Misskey is an open source, federated social media platform. Starting in version 13.0.0-beta.16 and prior to version 2025.12.0, an actor who does not have permi… |
CVE-2025-58173 | High | 8.8 | 2025-12-16 | FreshRSS is a self-hosted RSS feed aggregator. In versions 1.23.0 through 1.27.0, using a path traversal inside the `language` user configuration parameter, it… |
CVE-2025-14731 | Medium | 6.3 | 2025-12-16 | A weakness has been identified in CTCMS Content Management System up to 2.1.2. This affects an unknown function in the library /ctcms/apps/libraries/CT_Parser… |
CVE-2025-14593 | High | 7.8 | 2025-12-16 | A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can leverag… |
CVE-2025-10900 | High | 7.8 | 2025-12-16 | AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverag… |
CVE-2025-10899 | High | 7.8 | 2025-12-16 | AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverag… |
CVE-2025-10898 | High | 7.8 | 2025-12-16 | AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverag… |
CVE-2025-10889 | High | 7.8 | 2025-12-16 | A maliciously crafted CATPART file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage… |
CVE-2025-10888 | High | 7.8 | 2025-12-16 | AA maliciously crafted MODEL file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverag… |
CVE-2025-10887 | High | 7.8 | 2025-12-16 | A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage th… |
CVE-2025-10886 | High | 7.8 | 2025-12-16 | A maliciously crafted MODEL file, when parsed through certain Autodesk products, can force a Memory corruption vulnerability. A malicious actor can leverage th… |
CVE-2025-10884 | High | 7.8 | 2025-12-16 | AA maliciously crafted CATPART file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may lever… |
CVE-2025-10883 | High | 7.8 | 2025-12-16 | A maliciously crafted CATPRODUCT file, when parsed through certain Autodesk products, can force an Out-of-Bounds Read vulnerability. A malicious actor can lev… |
CVE-2025-10882 | High | 7.8 | 2025-12-16 | AA maliciously crafted X_T file, when parsed through certain Autodesk products, can force an Out-of-Bounds Write vulnerability. A malicious actor may leverage… |
CVE-2025-10881 | High | 7.8 | 2025-12-16 | A maliciously crafted CATPRODUCT file, when parsed through certain Autodesk products, can force a Heap-Based Overflow vulnerability. A malicious actor can leve… |
CVE-2025-9122 | Medium | 5.3 | 2025-12-15 | Hitachi Vantara Pentaho Data Integration and Analytics Community Dashboard Framework prior to versions 10.2.0.4, including 9.3.0.x and 8.3.x display the full s… |
CVE-2025-9121 | High | 8.8 | 2025-12-15 | Pentaho Data Integration and Analytics Community Dashboard Editor plugin versions before 10.2.0.4, including 9.3.0.x and 8.3.x, deserialize untrusted JSON data… |
CVE-2025-14730 | Medium | 4.7 | 2025-12-15 | A security flaw has been discovered in CTCMS Content Management System up to 2.1.2. The impacted element is an unknown function in the library /ctcms/libs/Ct_C… |
CVE-2025-14729 | Medium | 4.7 | 2025-12-15 | A vulnerability was identified in CTCMS Content Management System up to 2.1.2. The affected element is the function Save of the file /ctcms/libs/Ct_App.php of… |
CVE-2025-64725 | Critical | 9.8 | 2025-12-15 | Weblate is a web based localization tool. In versions prior to 5.15, it was possible to accept an invitation opened by a different user. Version 5.15. contains… |
CVE-2025-59947 | Critical | 9.0 | 2025-12-15 | NanoMQ is a messaging broker/bus for IoT Edge & SDV. Versions prior to 0.24.4 have a buffer overflow case while the PUBLISH packets trigger both shared subscri… |
CVE-2025-55895 | Critical | 9.1 | 2025-12-15 | TOTOLINK A3300R V17.0.0cu.557_B20221024 and N200RE V9.3.5u.6448_B20240521 and V9.3.5u.6437_B20230519 are vulnerable to Incorrect Access Control. Attackers can… |
CVE-2025-14722 | Low | 2.4 | 2025-12-15 | A vulnerability was determined in vion707 DMadmin up to 3403cafdb42537a648c30bf8cbc8148ec60437d1. This impacts the function Add of the file Admin/Controller/Ad… |
CVE-2025-67809 | Medium | 4.7 | 2025-12-15 | An issue was discovered in Zimbra Collaboration (ZCS) 10.0 and 10.1. A hardcoded Flickr API key and secret are present in the publicly accessible Flickr Zimlet… |
CVE-2025-55703 | Low | 2.5 | 2025-12-15 | An error-based SQL injection vulnerability exists in the Sunbird Power IQ 9.2.0 API. The vulnerability is due to an outdated API endpoint that applied arrays w… |
CVE-2025-36360 | Medium | 5.0 | 2025-12-15 | IBM UCD - IBM UrbanCode Deploy 7.1 through 7.1.2.27, 7.2 through 7.2.3.20, and 7.3 through 7.3.2.15 and IBM UCD - IBM DevOps Deploy 8.0 through 8.0.1.10, and 8… |
CVE-2025-14503 | High | 7.2 | 2025-12-15 | An overly-permissive IAM trust policy in the Harmonix on AWS framework may allow IAM principals in the same AWS account to escalate privileges via role assumpt… |
CVE-2025-14148 | Medium | 6.5 | 2025-12-15 | IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 could allow an authenticated user with LLM integration configuration privileges to recover a previously saved L… |
CVE-2025-13489 | Medium | 5.9 | 2025-12-15 | IBM UCD - IBM DevOps Deploy 8.1 through 8.1.2.3 IBM DevOps Deploy transmits data in clear text that could allow an attacker to obtain sensitive information usi… |
CVE-2025-12035 | Medium | 6.5 | 2025-12-15 | An integer overflow condition exists in Bluetooth Host stack, within the bt_br_acl_recv routine a critical path for processing inbound BR/EDR L2CAP traffic. |
CVE-2025-65835 | Medium | 6.2 | 2025-12-15 | The Cordova plugin cordova-plugin-x-socialsharing (SocialSharing-PhoneGap-Plugin) for Android 6.0.4, registers an exported broadcast receiver nl.xservices.plug… |
CVE-2025-65213 | Critical | 9.8 | 2025-12-15 | MooreThreads torch_musa through all versions contains an unsafe deserialization vulnerability in torch_musa.utils.compare_tool. The compare_for_single_op() and… |
CVE-2025-65176 | High | 7.5 | 2025-12-15 | An issue was discovered in Dynatrace OneAgent before 1.325.47. When attempting to access a remote network share from a machine where OneAgent is installed and… |
CVE-2025-51962 | Medium | 6.1 | 2025-12-15 | A HTML Injection vulnerability in the comment section of the project page in MicroStudio 24.01.29 allows remote attackers to inject arbitrary web script or HTM… |
CVE-2025-66440 | High | 8.8 | 2025-12-15 | An issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_documents() at erpnext/accounts/doctype/payment_entry/payment_ent… |
CVE-2025-66439 | High | 8.8 | 2025-12-15 | An issue was discovered in Frappe ERPNext through 15.89.0. Function get_outstanding_reference_documents() at erpnext.accounts.doctype.payment_entry.payment_ent… |
CVE-2025-66438 | High | 8.8 | 2025-12-15 | A Server-Side Template Injection (SSTI) vulnerability exists in the Frappe ERPNext through 15.89.0 Print Format rendering mechanism. Specifically, the API frap… |
CVE-2025-66437 | High | 8.8 | 2025-12-15 | An SSTI (Server-Side Template Injection) vulnerability exists in the get_address_display method of Frappe ERPNext through 15.89.0. This function renders addres… |
CVE-2025-66436 | Medium | 4.3 | 2025-12-15 | An SSTI (Server-Side Template Injection) vulnerability exists in the get_terms_and_conditions method of Frappe ERPNext through 15.89.0. The function renders at… |
CVE-2025-14038 | High | 7.0 | 2025-12-15 | EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. This could allow an attacker to read pote… |
CVE-2025-66435 | Medium | 4.3 | 2025-12-15 | An SSTI (Server-Side Template Injection) vulnerability exists in the get_contract_template method of Frappe ERPNext through 15.89.0. The function renders attac… |
CVE-2025-66434 | High | 8.8 | 2025-12-15 | An SSTI (Server-Side Template Injection) vulnerability exists in the get_dunning_letter_text method of Frappe ERPNext through 15.89.0. The function renders att… |
CVE-2025-65742 | High | 8.2 | 2025-12-15 | An unauthenticated Broken Function Level Authorization (BFLA) vulnerability in Newgen OmniDocs v11.0 allows attackers to obtain sensitive information and execu… |
CVE-2025-55901 | Medium | 6.5 | 2025-12-15 | TOTOLINK A3300R V17.0.0cu.596_B20250515 is vulnerable to command injection in the function NTPSyncWithHost via the host_time parameter. |
CVE-2025-55893 | Medium | 6.5 | 2025-12-15 | TOTOLINK N200RE V9.3.5u.6437_B20230519 is vulnerable to command Injection in setOpModeCfg via hostName. |
CVE-2025-11393 | High | 8.7 | 2025-12-15 | A flaw was found in runtimes-inventory-rhel8-operator. An internal proxy component is incorrectly configured. Because of this flaw, the proxy attaches the clus… |
CVE-2025-66963 | Medium | 5.5 | 2025-12-15 | An issue in Hitron HI3120 v.7.2.4.5.2b1 allows a local attacker to obtain sensitive information via the Logout option in the index.html |
CVE-2025-66844 | Critical | 9.1 | 2025-12-15 | In grav <1.7.49.5, a SSRF (Server-Side Request Forgery) vector may be triggered via Twig templates when page content is processed by Twig and the configuration… |
CVE-2025-66843 | Medium | 5.4 | 2025-12-15 | grav before v1.7.49.5 has a Stored Cross-Site Scripting (Stored XSS) vulnerability in the page editing functionality. An authenticated low-privileged user with… |
CVE-2025-60786 | High | 8.8 | 2025-12-15 | A Zip Slip vulnerability in the import a Project component of iceScrum v7.54 Pro On-prem allows attackers to execute arbitrary code via uploading a crafted Zip… |
CVE-2025-14387 | Medium | 6.4 | 2025-12-15 | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.3.1 due to insu… |
CVE-2025-13888 | Critical | 9.1 | 2025-12-15 | A flaw was found in OpenShift GitOps. Namespace admins can create ArgoCD Custom Resources (CRs) that trick the system into granting them elevated permissions i… |
CVE-2025-13824 | | 2025-12-15 | A security issue exists due to improper handling of malformed CIP packets during fuzzing. The controller enters a hard fault with solid red Fault LED and becom… | |
CVE-2025-13823 | | 2025-12-15 | A security issue was found in the IPv6 stack in the Micro850 and Micro870 controllers when the controllers received multiple malformed packets during fuzzing… | |
CVE-2025-34181 | | 2025-12-15 | NetSupport Manager < 14.12.0001 contains an arbitrary file write vulnerability in its Connectivity Server/Gateway PUTFILE request handler. An attacker with a v… | |
CVE-2025-34180 | | 2025-12-15 | NetSupport Manager < 14.12.0001 relies on a shared Gateway Key for authentication between Manager/Control, Client, and Connectivity Server components. The key… | |
CVE-2025-34179 | | 2025-12-15 | NetSupport Manager < 14.12.0001 contains an unauthenticated SQL injection vulnerability in its Connectivity Server/Gateway HTTPS request handling. The server e… | |
CVE-2025-14383 | High | 7.5 | 2025-12-15 | The Booking Calendar plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'dates_to_check' parameter in all versions up to, and includi… |
CVE-2025-14156 | Critical | 9.8 | 2025-12-15 | The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the… |
CVE-2025-14003 | Medium | 4.3 | 2025-12-15 | The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the… |
CVE-2025-13950 | Medium | 5.3 | 2025-12-15 | The OneSignal – Web Push Notifications plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the setting… |