2025 CVEs (page 79)
Page 79 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-65473 | Critical | 9.1 | 2025-12-11 | An arbitrary file rename vulnerability in the /admin/filer.php component of EasyImages 2.0 v2.8.6 and below allows attackers with Administrator privileges to e… |
CVE-2025-65472 | High | 8.8 | 2025-12-11 | A Cross-Site Request Forgery (CSRF) in the /admin/admin.inc.php component of EasyImages 2.0 v2.8.6 and below allows attackers to escalate privileges to Adminis… |
CVE-2025-65471 | High | 8.8 | 2025-12-11 | An arbitrary file upload vulnerability in the /admin/manager.php component of EasyImages 2.0 v2.8.6 and below allows attackers to execute arbitrary code via up… |
CVE-2025-14528 | Medium | 5.3 | 2025-12-11 | A vulnerability was detected in D-Link DIR-803 up to 1.04. Impacted is an unknown function of the file /getcfg.php of the component Configuration Handler. The… |
CVE-2025-14527 | High | 7.3 | 2025-12-11 | A weakness has been identified in projectworlds Advanced Library Management System 1.0. This vulnerability affects unknown code of the file /view_book.php. Exe… |
CVE-2025-14526 | High | 8.8 | 2025-12-11 | A security flaw has been discovered in Tenda CH22 1.0.0.1. This affects the function frmL7ImForm of the file /goform/L7Im. Performing a manipulation of the arg… |
CVE-2025-67742 | Low | 3.8 | 2025-12-11 | In JetBrains TeamCity before 2025.11 path traversal was possible via file upload |
CVE-2025-67741 | Medium | 4.6 | 2025-12-11 | In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute |
CVE-2025-67740 | Low | 2.7 | 2025-12-11 | In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata |
CVE-2025-67739 | Low | 3.1 | 2025-12-11 | In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure |
CVE-2025-59803 | Medium | 5.3 | 2025-12-11 | Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via triggers. An attacker can embed triggers (e.g., JavaScript) in a PDF document that exe… |
CVE-2025-59802 | High | 7.5 | 2025-12-11 | Foxit PDF Editor and Reader before 2025.2.1 allow signature spoofing via OCG. When Optional Content Groups (OCG) are supported, the state property of an OCG is… |
CVE-2025-55314 | High | 7.8 | 2025-12-11 | An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. When pages in a PDF are deleted via JavaScript, the a… |
CVE-2025-55313 | High | 7.8 | 2025-12-11 | An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. They allow potential arbitrary code execution when pr… |
CVE-2025-55312 | High | 7.8 | 2025-12-11 | An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. When pages in a PDF are deleted via JavaScript, the application… |
CVE-2025-55311 | Medium | 6.5 | 2025-12-11 | An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can use JavaScript to alter annotation… |
CVE-2025-55310 | High | 7.3 | 2025-12-11 | An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. An attacker able to alter or replace the static HTML… |
CVE-2025-55309 | Medium | 6.7 | 2025-12-11 | An issue was discovered in Foxit PDF and Editor for Windows and macOS before 13.2 and 2025 before 2025.2. A crafted PDF can contain JavaScript that attaches an… |
CVE-2025-55308 | Medium | 6.7 | 2025-12-11 | An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. A crafted PDF containing JavaScript that calls closeDoc() while… |
CVE-2025-55307 | Low | 3.3 | 2025-12-11 | An issue was discovered in Foxit PDF and Editor for Windows before 13.2 and 2025 before 2025.2. Opening a malicious PDF containing a crafted JavaScript call to… |
CVE-2025-14522 | Medium | 6.3 | 2025-12-11 | A vulnerability was detected in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. The impacted element is an unknown function of the file /Public/Kin… |
CVE-2025-14521 | Medium | 4.3 | 2025-12-11 | A security vulnerability has been detected in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. The affected element is an unknown function of the fi… |
CVE-2025-14520 | Medium | 5.4 | 2025-12-11 | A weakness has been identified in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. Impacted is an unknown function of the file /admin/index.php/data… |
CVE-2025-14519 | Low | 3.5 | 2025-12-11 | A security flaw has been discovered in baowzh hfly up to 638ff9abe9078bc977c132b37acbe1900b63491c. This issue affects some unknown processing of the file /admi… |
CVE-2025-14518 | Medium | 6.3 | 2025-12-11 | A vulnerability was identified in PowerJob up to 5.1.2. This vulnerability affects the function checkConnectivity of the file src/main/java/tech/powerjob/commo… |
CVE-2025-14265 | Critical | 9.1 | 2025-12-11 | In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execut… |
CVE-2025-13124 | High | 7.6 | 2025-12-11 | Authorization Bypass Through User-Controlled Key vulnerability in Netiket Information Technologies Ltd. Co. ApplyLogic allows Exploitation of Trusted Identifie… |
CVE-2025-14517 | Medium | 5.3 | 2025-12-11 | A vulnerability was determined in Yalantis uCrop 2.2.11. This affects the function UCropActivity of the file AndroidManifest.xml. Executing manipulation can l… |
CVE-2025-14516 | Medium | 6.3 | 2025-12-11 | A vulnerability was found in Yalantis uCrop 2.2.11. Affected by this issue is the function downloadFile of the file com.yalantis.ucrop.task.BitmapLoadTask.java… |
CVE-2025-14523 | High | 8.2 | 2025-12-11 | A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front pr… |
CVE-2025-14515 | High | 7.3 | 2025-12-11 | A vulnerability has been found in Campcodes Supplier Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/add_u… |
CVE-2025-13003 | High | 7.6 | 2025-12-11 | Authorization Bypass Through User-Controlled Key vulnerability in Aksis Computer Services and Consulting Inc. AxOnboard allows Exploitation of Trusted Identifi… |
CVE-2025-64995 | Medium | 6.5 | 2025-12-11 | A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Exchange-NomadClientHealth-ConfigureGeneralSe… |
CVE-2025-64994 | Medium | 6.5 | 2025-12-11 | A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-SetWorkRate instruction prior V17.1. Th… |
CVE-2025-64993 | Medium | 6.8 | 2025-12-11 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-ConfigMgrConsoleExtensions instructions. Imprope… |
CVE-2025-64992 | Medium | 6.8 | 2025-12-11 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-PauseNomadJobQueue instruction prior V25… |
CVE-2025-64991 | Medium | 6.8 | 2025-12-11 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-PatchInsights-Deploy instruction prior V15. Impr… |
CVE-2025-64990 | Medium | 6.8 | 2025-12-11 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-LogoffUser instruction prio… |
CVE-2025-64989 | High | 7.2 | 2025-12-11 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-FindFileBySizeAndHash instr… |
CVE-2025-64988 | High | 7.2 | 2025-12-11 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-GetCmContentLocations instruction prior V1… |
CVE-2025-64987 | High | 7.2 | 2025-12-11 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-CheckSimpleIoC instruction… |
CVE-2025-64986 | High | 7.2 | 2025-12-11 | A command injection vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Explorer-TachyonCore-DevicesListeningOnAPort ins… |
CVE-2025-46266 | Medium | 4.3 | 2025-12-11 | A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious a… |
CVE-2025-44016 | High | 8.8 | 2025-12-11 | A vulnerability in TeamViewer DEX Client (former 1E client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious a… |
CVE-2025-14514 | High | 7.3 | 2025-12-11 | A flaw has been found in Campcodes Supplier Management System 1.0. Affected is an unknown function of the file /admin/add_distributor.php. This manipulation of… |
CVE-2025-12687 | Medium | 6.5 | 2025-12-11 | A vulnerability in TeamViewer DEX Client (former 1E Client) - Content Distribution Service (NomadBranch.exe) prior version 25.11 for Windows allows malicious a… |
CVE-2025-64701 | High | 7.8 | 2025-12-11 | QND Premium/Advance/Standard Ver.11.0.9i and prior contains a privilege escalation vulnerability, which may allow a user who can log in to a Windows system wit… |
CVE-2025-12734 | Low | 3.5 | 2025-12-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allow… |
CVE-2025-12029 | High | 8.0 | 2025-12-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.11 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have, und… |
CVE-2025-67738 | High | 8.5 | 2025-12-11 | squid/cachemgr.cgi in Webmin before 2.600 does not properly quote arguments. This is relevant if Webmin's Squid module and its Cache Manager feature are availa… |
CVE-2025-14512 | Medium | 6.5 | 2025-12-11 | A flaw was found in glib. This vulnerability allows a heap buffer overflow and denial-of-service (DoS) via an integer overflow in GLib's GIO (GLib Input/Output… |
CVE-2025-8405 | High | 7.7 | 2025-12-11 | GitLab has remediated a security issue in GitLab CE/EE affecting all versions from 17.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could ha… |
CVE-2025-4097 | Medium | 6.5 | 2025-12-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allo… |
CVE-2025-11984 | Medium | 6.8 | 2025-12-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.1 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allow… |
CVE-2025-11247 | Medium | 4.3 | 2025-12-11 | GitLab has remediated an issue in GitLab EE affecting all versions from 13.2 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowed… |
CVE-2025-9436 | Medium | 6.4 | 2025-12-11 | The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `trustindex` shortcode in all versions up to… |
CVE-2025-14157 | Medium | 6.5 | 2025-12-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 6.3 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allowe… |
CVE-2025-13978 | Medium | 4.3 | 2025-12-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.5 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allow… |
CVE-2025-12716 | High | 8.7 | 2025-12-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that, under certain c… |
CVE-2025-12562 | High | 7.5 | 2025-12-11 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.10 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that could have allo… |
CVE-2025-10163 | Medium | 6.5 | 2025-12-11 | The List category posts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘starting_with’ parameter of the catlist shortcode in all versio… |
CVE-2025-14485 | Medium | 5.0 | 2025-12-11 | A weakness has been identified in EFM ipTIME A3004T 14.19.0. This vulnerability affects the function show_debug_screen of the file /sess-bin/timepro.cgi of the… |
CVE-2025-13764 | Critical | 9.8 | 2025-12-11 | The WP CarDealer plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.16. This is due to the 'WP_CarDealer_User… |
CVE-2025-11467 | Medium | 5.8 | 2025-12-11 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind Server-Side Reques… |
CVE-2025-67720 | Medium | 6.5 | 2025-12-11 | Pyrofork is a modern, asynchronous MTProto API framework. Versions 2.3.68 and earlier do not properly sanitize filenames received from Telegram messages in the… |
CVE-2025-67719 | | 2025-12-11 | Ibexa is a composable end-to-end DXP (Digital Experience Platform). Versions 5.0.0-beta1 through 5.0.3 do not have password validation. During the transition f… | |
CVE-2025-67718 | | 2025-12-11 | Form.io is a combined Form and API platform for Serverless applications. Versions 3.5.6 and below and 4.0.0-rc.1 through 4.4.2 contain a flaw in path handling… | |
CVE-2025-67717 | Medium | 4.3 | 2025-12-11 | ZITADEL is an open-source identity infrastructure tool. Versions 2.44.0 through 3.4.4 and 4.0.0-rc.1 through 4.7.1 disclose the total number of instance users… |
CVE-2025-67716 | Medium | 5.7 | 2025-12-11 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. Versions 4.9.0 through 4.12.1 contain an input-validation flaw… |
CVE-2025-67713 | Medium | 6.1 | 2025-12-11 | Miniflux 2 is an open source feed reader. Versions 2.2.14 and below treat redirect_url as safe when url.Parse(...).IsAbs() is false, enabling phishing flows af… |
CVE-2025-67648 | High | 7.1 | 2025-12-11 | Shopware is an open commerce platform. Versions 6.4.6.0 through 6.6.10.9 and 6.7.0.0 through 6.7.5.0 have a Reflected XSS vulnerability in AuthController.php… |
CVE-2025-67646 | Low | 3.5 | 2025-12-11 | TableProgressTracking is a MediaWiki extension to track progress against specific criterion. Versions 1.2.0 and below do not enforce CSRF token validation in t… |
CVE-2025-67644 | High | 7.3 | 2025-12-11 | LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Versions 3.0.0 and belo… |
CVE-2025-67511 | Critical | 9.6 | 2025-12-11 | Cybersecurity AI (CAI) is an open-source framework for building and deploying AI-powered offensive and defensive automation. Versions 0.5.9 and below are vulne… |
CVE-2025-67513 | | 2025-12-10 | FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions prior to 16.0.96 and 17.0.1 through 17.0.9 have a weak defau… | |
CVE-2025-67510 | Critical | 9.4 | 2025-12-10 | Neuron is a PHP framework for creating and orchestrating AI Agents. In versions 2.8.11 and below, the MySQLWriteTool executes arbitrary SQL provided by the cal… |
CVE-2025-67509 | High | 8.2 | 2025-12-10 | Neuron is a PHP framework for creating and orchestrating AI Agents. Versions 2.8.11 and below use MySQLSelectTool, which is vulnerable to Read-Only Bypass. My… |
CVE-2025-67505 | High | 8.4 | 2025-12-10 | Okta Java Management SDK facilitates interactions with the Okta management API. In versions 11.0.0 through 20.0.0, race conditions may arise from concurrent re… |
CVE-2025-67490 | Medium | 5.4 | 2025-12-10 | The Auth0 Next.js SDK is a library for implementing user authentication in Next.js applications. When using versions 4.11.0 through 4.11.2 and 4.12.0, simultan… |
CVE-2025-66628 | High | 7.5 | 2025-12-10 | ImageMagick is a software suite to create, edit, compose, or convert bitmap images. In versions 7.1.2-9 and prior, the TIM (PSX TIM) image parser contains a cr… |
CVE-2025-66474 | High | 8.8 | 2025-12-10 | XWiki Rendering is a generic rendering system that converts textual input in a given syntax (wiki syntax, HTML, etc) into another syntax (XHTML, etc). Versions… |
CVE-2025-66473 | High | 7.5 | 2025-12-10 | XWiki is an open-source wiki software platform. Versions 16.10.10 and below, 17.0.0-rc-1 through 17.4.3 and 17.5.0-rc-1 through 17.6.0 contain a REST API which… |
CVE-2025-66472 | Medium | 6.1 | 2025-12-10 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 6.2-milestone-1 through 16.10.9 and 17.0.0-rc… |
CVE-2025-66033 | Medium | 5.3 | 2025-12-10 | Okta Java Management SDK facilitates interactions with the Okta management API. In versions 21.0.0 through 24.0.0, specific multithreaded implementations may e… |
CVE-2025-65297 | High | 7.5 | 2025-12-10 | Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 automatically collect and upload unencrypted sensitive informati… |
CVE-2025-65296 | Medium | 6.5 | 2025-12-10 | NULL-pointer dereference vulnerabilities in Aqara Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 in the JSON processing enable denial-of-se… |
CVE-2025-65295 | High | 8.1 | 2025-12-10 | Multiple vulnerabilities in Aqara Hub firmware update process in the Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 devices, allow attacker… |
CVE-2025-65294 | Critical | 9.8 | 2025-12-10 | Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 contain an undocumented remote access mechanism enabling unrestr… |
CVE-2025-65293 | Medium | 6.6 | 2025-12-10 | Command injection vulnerabilities in Aqara Camera Hub G3 4.1.9_0027 allow attackers to execute arbitrary commands with root privileges through malicious QR cod… |
CVE-2025-65292 | High | 7.3 | 2025-12-10 | Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 allows attackers to execute a… |
CVE-2025-65291 | High | 7.4 | 2025-12-10 | Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, Camera Hub G3 4.1.9_0027 fail to validate server certificates in TLS connections for discover… |
CVE-2025-65290 | High | 7.4 | 2025-12-10 | Aqara Hub devices including Camera Hub G3 4.1.9_0027, Hub M2 4.3.6_0027, and Hub M3 4.3.6_0025 fail to validate server certificates during HTTPS firmware downl… |
CVE-2025-67461 | Medium | 5.0 | 2025-12-10 | External control of file name or path in Zoom Rooms for macOS before version 6.6.0 may allow an authenticated user to conduct a disclosure of information via l… |
CVE-2025-67460 | High | 7.8 | 2025-12-10 | Protection Mechanism Failure of Software Downgrade in Zoom Rooms for Windows before 6.6.0 may allow an unauthenticated user to conduct an escalation of privile… |
CVE-2025-65950 | High | 8.8 | 2025-12-10 | WBCE CMS is a content management system. In versions 1.6.4 and below, the user management module allows a low-privileged authenticated user with permissions to… |
CVE-2025-65832 | Medium | 4.6 | 2025-12-10 | The mobile application insecurely handles information stored within memory. By performing a memory dump on the application after a user has logged out and term… |
CVE-2025-65831 | High | 7.5 | 2025-12-10 | The application uses an insecure hashing algorithm (MD5) to hash passwords. If an attacker obtained a copy of these hashes, either through exploiting cloud ser… |
CVE-2025-65830 | Critical | 9.1 | 2025-12-10 | Due to a lack of certificate validation, all traffic from the mobile application can be intercepted. As a result, an adversary located "upstream" can decrypt t… |
CVE-2025-65829 | Medium | 6.8 | 2025-12-10 | The ESP32 system on a chip (SoC) that powers the Meatmeet basestation device was found to lack Secure Boot. The Secure Boot feature ensures that only authentic… |
CVE-2025-65828 | Medium | 6.5 | 2025-12-10 | An unauthenticated attacker within proximity of the Meatmeet device can issue several commands over Bluetooth Low Energy (BLE) to these devices which would res… |