2025 CVEs (page 76)
Page 76 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-43511 | Medium | 6.5 | 2025-12-12 | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.2, iOS 18.7.2 and iPadOS 18.7.2, iOS 26.2 and iPadOS 26… |
CVE-2025-43510 | High | 7.8 | 2025-12-12 | A memory corruption issue was addressed with improved lock state checking. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS… |
CVE-2025-43509 | Medium | 5.5 | 2025-12-12 | This issue was addressed with improved data protection. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able… |
CVE-2025-43506 | High | 7.5 | 2025-12-12 | A logic error was addressed with improved error handling. This issue is fixed in macOS Tahoe 26.1. iCloud Private Relay may not activate when more than one use… |
CVE-2025-43497 | Medium | 5.2 | 2025-12-12 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to break out of its sandbox. |
CVE-2025-43494 | High | 7.5 | 2025-12-12 | A mail header parsing issue was addressed with improved checks. This issue is fixed in iOS 18.7.2 and iPadOS 18.7.2, iOS 26.1 and iPadOS 26.1, macOS Sequoia 15… |
CVE-2025-43482 | Medium | 5.5 | 2025-12-12 | The issue was addressed with improved input validation. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able… |
CVE-2025-43473 | Medium | 5.5 | 2025-12-12 | This issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.1. An app may be able… |
CVE-2025-43471 | Medium | 5.5 | 2025-12-12 | The issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data. |
CVE-2025-43470 | Medium | 5.5 | 2025-12-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.1. A standard user may be able to view files made from a… |
CVE-2025-43467 | High | 7.8 | 2025-12-12 | This issue was addressed with improved checks. This issue is fixed in macOS Tahoe 26.1. An app may be able to gain root privileges. |
CVE-2025-43466 | Medium | 5.5 | 2025-12-12 | An injection issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data. |
CVE-2025-43465 | Medium | 5.5 | 2025-12-12 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Tahoe 26.1. An app may be able to… |
CVE-2025-43464 | Medium | 6.5 | 2025-12-12 | A denial-of-service issue was addressed with improved input validation. This issue is fixed in macOS Tahoe 26.1. Visiting a website may lead to an app denial-o… |
CVE-2025-43463 | Medium | 5.5 | 2025-12-12 | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8… |
CVE-2025-43461 | Medium | 5.5 | 2025-12-12 | This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Tahoe 26.1. An app may be able to access protected user data. |
CVE-2025-43437 | Low | 3.3 | 2025-12-12 | An information disclosure issue was addressed with improved privacy controls. This issue is fixed in iOS 26.1 and iPadOS 26.1. An app may be able to fingerprin… |
CVE-2025-43416 | Medium | 5.5 | 2025-12-12 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, macOS Tahoe 26.2. An app may be able… |
CVE-2025-43410 | Low | 2.4 | 2025-12-12 | The issue was addressed with improved handling of caches. This issue is fixed in macOS Sequoia 15.7.2, macOS Sonoma 14.8.2, macOS Tahoe 26.2. An attacker with… |
CVE-2025-43406 | Medium | 5.5 | 2025-12-12 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data. |
CVE-2025-43404 | Low | 3.3 | 2025-12-12 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user da… |
CVE-2025-43402 | High | 7.8 | 2025-12-12 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.1. An app may be able t… |
CVE-2025-43393 | Medium | 5.2 | 2025-12-12 | A permissions issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to break out of its sandbox. |
CVE-2025-43388 | Medium | 5.5 | 2025-12-12 | An injection issue was addressed with improved validation. This issue is fixed in macOS Tahoe 26.1. An app may be able to access sensitive user data. |
CVE-2025-43381 | Medium | 5.5 | 2025-12-12 | This issue was addressed with improved handling of symlinks. This issue is fixed in macOS Tahoe 26.1. A malicious app may be able to delete protected user data. |
CVE-2025-43351 | Medium | 5.5 | 2025-12-12 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Tahoe 26.1. An app may be able to access protected user data. |
CVE-2025-43320 | High | 7.8 | 2025-12-12 | The issue was addressed by adding additional logic. This issue is fixed in macOS Sequoia 15.7.3, macOS Tahoe 26. An app may be able to bypass launch constraint… |
CVE-2025-14611 | Critical | 9.8 | 2025-12-12 | Gladinet CentreStack and Triofox prior to version 16.12.10420.56791 used hardcoded values for their implementation of the AES cryptoscheme. This degrades secur… |
CVE-2025-14580 | Low | 3.5 | 2025-12-12 | A security vulnerability has been detected in Qualitor up to 8.24.73. The impacted element is an unknown function of the file /Qualitor/html/bc/bcdocumento9/bi… |
CVE-2025-11266 | Medium | 6.6 | 2025-12-12 | An out-of-bounds write vulnerability exists in the Grassroots DICOM library (GDCM). The issue is triggered during parsing of a malformed DICOM file containing… |
CVE-2025-8083 | High | 8.6 | 2025-12-12 | The Preset configuration https://v2.vuetifyjs.com/en/features/presets feature of Vuetify is vulnerable to Prototype Pollution https://cheatsheetseries.owasp… |
CVE-2025-67734 | Medium | 5.4 | 2025-12-12 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allowed authenticated attackers… |
CVE-2025-14578 | High | 7.3 | 2025-12-12 | A weakness has been identified in itsourcecode Student Management System 1.0. The affected element is an unknown function of the file /update_account.php. This… |
CVE-2025-14572 | High | 8.8 | 2025-12-12 | A vulnerability was found in UTT 进取 512W up to 1.7.7-171114. This affects an unknown part of the file /goform/formWebAuthGlobalConfig. Performing manipulation… |
CVE-2025-14373 | Medium | 4.3 | 2025-12-12 | Inappropriate implementation in Toolbar in Google Chrome on Android prior to 143.0.7499.110 allowed a remote attacker to perform domain spoofing via a crafted… |
CVE-2025-14372 | Medium | 6.1 | 2025-12-12 | Use after free in Password Manager in Google Chrome prior to 143.0.7499.110 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTM… |
CVE-2025-14174 | High | 8.8 | 2025-12-12 | Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a cra… |
CVE-2025-8082 | Medium | 6.3 | 2025-12-12 | Improper neutralization of the title date in the 'VDatePicker' component in Vuetify, allows unsanitized HTML to be inserted into the page. This can lead to a… |
CVE-2025-14571 | High | 7.3 | 2025-12-12 | A vulnerability has been found in projectworlds Advanced Library Management System 1.0. Affected by this issue is some unknown functionality of the file /borro… |
CVE-2025-14570 | High | 7.3 | 2025-12-12 | A flaw has been found in projectworlds Advanced Library Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /view_adm… |
CVE-2025-14569 | Medium | 5.3 | 2025-12-12 | A vulnerability was detected in ggml-org whisper.cpp up to 1.8.2. Affected is the function read_audio_data of the file /whisper.cpp/examples/common-whisper.cpp… |
CVE-2025-14568 | Medium | 6.3 | 2025-12-12 | A security vulnerability has been detected in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0. This impacts an unknown functio… |
CVE-2025-40345 | | 2025-12-12 | In the Linux kernel, the following vulnerability has been resolved: usb: storage: sddr55: Reject out-of-bound new_pba Discovered by Atuin - Automated Vulnera… | |
CVE-2025-67819 | Medium | 4.9 | 2025-12-12 | An issue was discovered in Weaviate OSS before 1.33.4. Due to a lack of validation of the fileName field in the transfer logic, an attacker who can call the Ge… |
CVE-2025-67818 | High | 7.2 | 2025-12-12 | An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path (… |
CVE-2025-67342 | Medium | 4.6 | 2025-12-12 | RuoYi versions 4.8.1 and earlier is affected by a stored XSS vulnerability in the /system/menu/edit endpoint. While the endpoint is protected by an XSS filter… |
CVE-2025-64011 | Medium | 4.3 | 2025-12-12 | Nextcloud Server 30.0.0 is vulnerable to an Insecure Direct Object Reference (IDOR) in the /core/preview endpoint. Any authenticated user can access previews o… |
CVE-2025-67344 | Medium | 4.6 | 2025-12-12 | jshERP v3.5 and earlier is affected by a stored Cross Site Scripting (XSS) vulnerability via the /msg/add endpoint. |
CVE-2025-67341 | Medium | 4.6 | 2025-12-12 | jshERP versions 3.5 and earlier are affected by a stored XSS vulnerability. This vulnerability allows attackers to upload PDF files containing XSS payloads. Ad… |
CVE-2025-66430 | Critical | 9.1 | 2025-12-12 | Plesk 18.0 has Incorrect Access Control. |
CVE-2025-65854 | Critical | 9.8 | 2025-12-12 | Insecure permissions in the scheduled tasks feature of MineAdmin v3.x allows attackers to execute arbitrary commands and execute a full account takeover. |
CVE-2025-65530 | High | 8.8 | 2025-12-12 | An eval injection in the malware de-obfuscation routines of CloudLinux ai-bolit before v32.7.4 allows attackers to overwrite arbitrary files as root via scanni… |
CVE-2025-53960 | Medium | 5.9 | 2025-12-12 | When issuing JSON Web Tokens (JWT), Apache StreamPark directly uses the user's password as the HMAC signing key (e.g., with the HS256 algorithm). An attacker c… |
CVE-2025-14567 | Medium | 5.3 | 2025-12-12 | A weakness has been identified in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0. This affects an unknown function of the fil… |
CVE-2025-14566 | High | 7.3 | 2025-12-12 | A security flaw has been discovered in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. The impacted element is an unknown function… |
CVE-2025-14565 | High | 7.3 | 2025-12-12 | A vulnerability was identified in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. The affected element is an unknown function of t… |
CVE-2025-13733 | High | 7.8 | 2025-12-12 | BuhoNTFS contains an insecure XPC service that allows local, unprivileged users to escalate their privileges to root via insecure functions.This issue affects… |
CVE-2025-12843 | Medium | 5.5 | 2025-12-12 | Code Injection using Electron Fuses in waveterm on MacOS allows TCC Bypass. This issue affects waveterm: 0.12.2. |
CVE-2025-58770 | High | 8.8 | 2025-12-12 | APTIOV contains a vulnerability in BIOS where a user may cause “Improper Handling of Insufficient Permissions or Privileges” by local access. Successful exploi… |
CVE-2025-54981 | High | 7.5 | 2025-12-12 | Weak Encryption Algorithm in StreamPark, The use of an AES cipher in ECB mode and a weak random number generator for encrypting sensitive data, including JWT t… |
CVE-2025-54947 | Critical | 9.8 | 2025-12-12 | In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability occurs because the… |
CVE-2025-36755 | | 2025-12-12 | The CleverDisplay BlueOne hardware player is designed with its USB interfaces physically enclosed and inaccessible under normal operating conditions. Researche… | |
CVE-2025-36746 | Medium | 5.4 | 2025-12-12 | SolarEdge monitoring platform contains a Cross‑Site Scripting (XSS) flaw that allows an authenticated user to inject payloads into report names, which may exec… |
CVE-2025-36745 | High | 7.8 | 2025-12-12 | SolarEdge SE3680H ships with an outdated Linux kernel containing unpatched vulnerabilities in core subsystems. An attacker with network or local access can ex… |
CVE-2025-36744 | Low | 2.4 | 2025-12-12 | SolarEdge SE3680H has unauthenticated disclosure of sensitive information during the bootloader loop. While the device repeatedly initializes and waits for boo… |
CVE-2025-36743 | Medium | 6.8 | 2025-12-12 | SolarEdge SE3680H has an exposed debug/test interface accessible to unauthenticated actors, allowing disclosure of system internals and execution of debug comm… |
CVE-2025-13506 | High | 8.8 | 2025-12-12 | Execution with Unnecessary Privileges vulnerability in Nebim Neyir Computer Industry and Services Inc. Nebim V3 ERP allows Expanding Control over the Operating… |
CVE-2025-14442 | Medium | 5.3 | 2025-12-12 | The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to sensitive information exposure due to storage of exported CSV file… |
CVE-2025-14159 | Medium | 4.3 | 2025-12-12 | The Secure Copy Content Protection and Content Locking plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4… |
CVE-2025-14065 | Medium | 4.3 | 2025-12-12 | The Simple Bike Rental plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'simpbire_carica_prenotazioni… |
CVE-2025-14030 | Medium | 6.4 | 2025-12-12 | The AI Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'aife_post_meta' shortcode in all versions up to, and including, 1.0.22… |
CVE-2025-12965 | Medium | 6.4 | 2025-12-12 | The Magical Posts Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mpac_title_tag' parameter in the Magical Posts Accordion w… |
CVE-2025-12408 | Medium | 5.3 | 2025-12-12 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 7… |
CVE-2025-12407 | Medium | 4.3 | 2025-12-12 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi… |
CVE-2025-12841 | Medium | 5.3 | 2025-12-12 | The Bookit WordPress plugin before 2.5.1 has a publicly accessible REST endpoint that allows unauthenticated update of the plugins Stripe payment options. |
CVE-2025-12835 | High | 7.3 | 2025-12-12 | The WooMulti WordPress plugin through 17 does not validate a file parameter when deleting files, which could allow any authenticated users, such as subscriber… |
CVE-2025-58137 | High | 8.1 | 2025-12-12 | Authorization Bypass Through User-Controlled Key vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.11.0. The issue is fixed in v… |
CVE-2025-58130 | Critical | 9.1 | 2025-12-12 | Insufficiently Protected Credentials vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.11.0. The issue is fixed in version 1.12… |
CVE-2025-26866 | High | 8.8 | 2025-12-12 | A remote code execution vulnerability exists where a malicious Raft node can exploit insecure Hessian deserialization within the PD store. The fix enforces IP-… |
CVE-2025-23408 | Medium | 6.5 | 2025-12-12 | Weak Password Requirements vulnerability in Apache Fineract. This issue affects Apache Fineract: through 1.10.1. The issue is fixed in version 1.11.0. Users… |
CVE-2025-14074 | Medium | 4.3 | 2025-12-12 | The PDF for Contact Form 7 + Drag and Drop Template Builder plugin for WordPress is vulnerable to unauthorized post duplication due to a missing capability che… |
CVE-2025-13993 | Medium | 5.5 | 2025-12-12 | The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_description' and 'success_message' par… |
CVE-2025-12348 | Medium | 5.3 | 2025-12-12 | The Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin for WordPress is vulnerable to Missing Authorization in versions up to, an… |
CVE-2025-40829 | High | 7.8 | 2025-12-12 | A vulnerability has been identified in Simcenter Femap (All versions < V2512). The affected applications contains an uninitialized memory vulnerability while p… |
CVE-2025-12960 | Medium | 6.5 | 2025-12-12 | The Simple CSV Table plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.0.1 via the `href` parameter in the `[cs… |
CVE-2025-67731 | High | 7.5 | 2025-12-12 | Servify Express is a Node.js package to start an Express server and log the port it's running on. Prior to 1.2, the Express server used express.json() without… |
CVE-2025-67730 | Medium | 5.4 | 2025-12-12 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Versions prior to 2.42.0 allow authenticated users to ad… |
CVE-2025-4970 | Medium | 5.5 | 2025-12-12 | The BSK PDF Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 3.7.1 due to i… |
CVE-2025-14169 | High | 7.5 | 2025-12-12 | The FunnelKit - Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'opid' parameter in all ve… |
CVE-2025-14049 | Medium | 6.1 | 2025-12-12 | The VikRentItems Flexible Rental Management System plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'delto' parameter in all versio… |
CVE-2025-13891 | Medium | 6.5 | 2025-12-12 | The Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.13.3. This is due t… |
CVE-2025-11876 | Medium | 6.4 | 2025-12-12 | The Mailgun Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mailgun_subscription_form' shortcode in all versi… |
CVE-2025-10583 | Low | 3.5 | 2025-12-12 | The WP Fastest Cache Premium plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.7.4 via the 'get_server_… |
CVE-2025-67737 | Low | 3.1 | 2025-12-12 | AzuraCast is a self-hosted, all-in-one web radio management suite. Versions 0.23.1 mistakenly include an API endpoint that is intended for internal use by the… |
CVE-2025-67728 | Critical | 9.8 | 2025-12-12 | Fireshare facilitates self-hosted media and link sharing. Versions 1.2.30 and below allow an authenticated user, or unauthenticated user if the Public Uploads… |
CVE-2025-67727 | Critical | 9.8 | 2025-12-12 | Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a GitHub CI workflow i… |
CVE-2025-67726 | High | 7.5 | 2025-12-12 | Tornado is a Python web framework and asynchronous networking library. Versions 6.5.2 and below use an inefficient algorithm when parsing parameters for HTTP h… |
CVE-2025-14356 | Medium | 4.3 | 2025-12-12 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'uacf7_get_gener… |
CVE-2025-14068 | High | 7.5 | 2025-12-12 | The WPNakama plugin for WordPress is vulnerable to time-based SQL Injection via the 'order_by' parameter in all versions up to, and including, 0.6.3 due to ins… |
CVE-2025-13660 | Medium | 5.3 | 2025-12-12 | The Guest Support plugin for WordPress is vulnerable to User Email Disclosure in versions up to, and including, 1.2.3. This is due to the plugin exposing a pub… |