2025 CVEs (page 78)
Page 78 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-67718 | | 2025-12-11 | Form.io is a combined Form and API platform for Serverless applications. Versions 3.5.6 and below and 4.0.0-rc.1 through 4.4.2 contain a flaw in path handling… | |
CVE-2025-67717 | Medium | 4.3 | 2025-12-11 | ZITADEL is an open-source identity infrastructure tool. Versions 2.44.0 through 3.4.4 and 4.0.0-rc.1 through 4.7.1 disclose the total number of instance users… |
CVE-2025-67716 | Medium | 5.7 | 2025-12-11 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw… |
CVE-2025-67713 | Medium | 6.1 | 2025-12-11 | Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false, enabling phishing flows af… |
CVE-2025-67648 | High | 7.1 | 2025-12-11 | Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php… |
CVE-2025-67646 | Low | 3.5 | 2025-12-11 | TableProgressTracking is a MediaWiki extension to track progress against specific criterion. Versions 1.2.0 and below do not enforce CSRF token validation in t… |
CVE-2025-67644 | High | 7.3 | 2025-12-11 | LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Versions 3.0.0 and belo… |
CVE-2025-67511 | Critical | 9.6 | 2025-12-11 | Cybersecurity AI (CAI) is an open-source framework for building and deploying AI-powered offensive and defensive automation. Versions 0.5.9 and below are vulne… |
CVE-2025-67513 | | 2025-12-10 | FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and 17.0.1 through 17.0.9 have a weak defau… | |
CVE-2025-67510 | Critical | 9.4 | 2025-12-10 | Neuron is a PHP framework for creating and orchestrating AI Agents. In versions 2.8.11 and below, the MySQLWriteTool executes arbitrary SQL provided by the cal… |
CVE-2025-67509 | High | 8.2 | 2025-12-10 | Neuron is a PHP framework for creating and orchestrating AI Agents. Versions 2.8.11 and below use MySQLSelectTool, which is vulnerable to Read-Only Bypass. My… |
CVE-2025-67505 | High | 8.4 | 2025-12-10 | Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent re… |
CVE-2025-67490 | Medium | 5.4 | 2025-12-10 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultan… |
CVE-2025-66628 | High | 7.5 | 2025-12-10 | ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a cr… |
CVE-2025-66474 | High | 8.8 | 2025-12-10 | XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Versions… |
CVE-2025-66473 | High | 7.5 | 2025-12-10 | XWiki is an open-source wiki software platform. Versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3 and 17.5.0-rc-1 through 17.6.0 contain a REST API which… |
CVE-2025-66472 | Medium | 6.1 | 2025-12-10 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc… |
CVE-2025-66033 | Medium | 5.3 | 2025-12-10 | Okta Java Management SDK facilitates interactions with the Okta management API. In versions 21.0.0 through 24.0.0, specific multithreaded implementations may e… |
CVE-2025-65297 | High | 7.5 | 2025-12-10 | Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect and upload unencrypted sensitive informati… |
CVE-2025-65296 | Medium | 6.5 | 2025-12-10 | NULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 in the JSON processing enable denial-of-se… |
CVE-2025-65295 | High | 8.1 | 2025-12-10 | Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devices, allow attacker… |
CVE-2025-65294 | Critical | 9.8 | 2025-12-10 | Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestr… |
CVE-2025-65293 | Medium | 6.6 | 2025-12-10 | Command injection vulnerabilities in Aqara Camera Hub G3 4.1.9_0027 allow attackers to execute arbitrary commands with root privileges through malicious QR cod… |
CVE-2025-65292 | High | 7.3 | 2025-12-10 | Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 allows attackers to execute a… |
CVE-2025-65291 | High | 7.4 | 2025-12-10 | Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail to validate server certificates in TLS connections for discover… |
CVE-2025-65290 | High | 7.4 | 2025-12-10 | Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 fail to validate server certificates during HTTPS firmware downl… |
CVE-2025-67461 | Medium | 5.0 | 2025-12-10 | External control of file name or path in Zoom Rooms for macOS before version 6.6.0 may allow an authenticated user to conduct a disclosure of information via l… |
CVE-2025-67460 | High | 7.8 | 2025-12-10 | Protection Mechanism Failure of Software Downgrade in Zoom Rooms for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privile… |
CVE-2025-65950 | High | 8.8 | 2025-12-10 | WBCE CMS is a content management system. In versions 1.6.4 and below, the user management module allows a low-privileged authenticated user with permissions to… |
CVE-2025-65832 | Medium | 4.6 | 2025-12-10 | The mobile application insecurely handles information stored within memory. By performing a memory dump on the application after a user has logged out and term… |
CVE-2025-65831 | High | 7.5 | 2025-12-10 | The application uses an insecure hashing algorithm (MD5) to hash passwords. If an attacker obtained a copy of these hashes, either through exploiting cloud ser… |
CVE-2025-65830 | Critical | 9.1 | 2025-12-10 | Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. As a result, an adversary located "upstream" can decrypt t… |
CVE-2025-65829 | Medium | 6.8 | 2025-12-10 | The ESP32 system on a chip (SoC) that powers the Meatmeet basestation device was found to lack Secure Boot. The Secure Boot feature ensures that only authentic… |
CVE-2025-65828 | Medium | 6.5 | 2025-12-10 | An unauthenticated attacker within proximity of the Meatmeet device can issue several commands over Bluetooth Low Energy (BLE) to these devices which would res… |
CVE-2025-65827 | Critical | 9.1 | 2025-12-10 | The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP. As a result, an adversary locate… |
CVE-2025-65826 | Critical | 9.8 | 2025-12-10 | The mobile application was found to contain stored credentials for the network it was developed on. If an attacker retrieved this, and found the physical locat… |
CVE-2025-65825 | Medium | 4.6 | 2025-12-10 | The firmware on the basestation of the Meatmeet is not encrypted. An adversary with physical access to the Meatmeet device can disassemble the device, connect… |
CVE-2025-65824 | High | 8.8 | 2025-12-10 | An unauthenticated attacker within proximity of the Meatmeet device can perform an unauthorized Over The Air (OTA) firmware upgrade using Bluetooth Low Energy… |
CVE-2025-65823 | Critical | 9.8 | 2025-12-10 | The Meatmeet Pro was found to be shipped with hardcoded Wi-Fi credentials in the firmware, for the test network it was developed on. If an attacker retrieved t… |
CVE-2025-65822 | Medium | 6.8 | 2025-12-10 | The ESP32 system on a chip (SoC) that powers the Meatmeet Pro was found to have JTAG enabled. By leaving JTAG enabled on an ESP32 in a commercial product an at… |
CVE-2025-65821 | High | 7.5 | 2025-12-10 | As UART download mode is still enabled on the ESP32 chip on which the firmware runs, an adversary can dump the flash from the device and retrieve sensitive inf… |
CVE-2025-65820 | Critical | 9.8 | 2025-12-10 | An issue was discovered in Meatmeet Android Mobile Application 1.1.2.0. An exported activity can be spawned with the mobile application which opens a hidden pa… |
CVE-2025-65512 | High | 7.5 | 2025-12-10 | A Server-Side Request Forgery (SSRF) vulnerability was discovered in the webpage-to-markdown conversion feature of markdownify-mcp v0.0.2 and before. This vuln… |
CVE-2025-62181 | Medium | 5.3 | 2025-12-10 | Pega Platform versions 7.1.0 through Infinity 25.1.0 are affected by a User Enumeration. This issue occurs during user authentication process, where a differe… |
CVE-2025-24857 | High | 7.6 | 2025-12-10 | Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qualcomm chips IPQ4019, IPQ5018, IPQ5322… |
CVE-2025-65602 | Critical | 9.8 | 2025-12-10 | A template injection vulnerability in the /vip/v1/file/save component of ChanCMS v3.3.4 allows attackers to execute arbitrary code via a crafted POST request. |
CVE-2025-63895 | High | 7.5 | 2025-12-10 | An issue in the Bluetooth firmware of JXL 9 Inch Car Android Double Din Player Android v12.0 allows attackers to cause a Denial of Service (DoS) via sending a… |
CVE-2025-65199 | High | 7.8 | 2025-12-10 | A command injection vulnerability exists in Windscribe for Linux Desktop App that allows a local user who is a member of the windscribe group to execute arbitr… |
CVE-2025-64888 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low priv… |
CVE-2025-64887 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low priv… |
CVE-2025-64881 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64875 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64873 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64872 | Medium | 4.8 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high privilege… |
CVE-2025-64869 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64863 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64861 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64858 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64857 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64853 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64852 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64850 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64847 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64845 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64841 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64840 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64839 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64833 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64829 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64827 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64826 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64825 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64823 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64822 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64821 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64820 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64817 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64814 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64808 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64804 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64803 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64802 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64801 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64800 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64799 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64797 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64796 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64794 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64793 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64792 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64791 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64790 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64789 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64627 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64626 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64623 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64622 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64620 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64619 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64616 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |