2025 CVEs (page 80)
Page 80 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-34394 | Critical | 9.8 | 2025-12-10 | Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, exposes a .NET Remoting service that is insufficiently protected a… |
CVE-2025-34393 | Critical | 9.8 | 2025-12-10 | Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not correctly verify the name of an attacker-controlled WSDL… |
CVE-2025-34392 | Critical | 9.8 | 2025-12-10 | Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL tha… |
CVE-2025-13155 | High | 7.8 | 2025-12-10 | An improper permissions vulnerability was reported in Lenovo Baiying Client that could allow a local authenticated user to execute code with elevated privilege… |
CVE-2025-13152 | High | 7.8 | 2025-12-10 | A potential DLL hijacking vulnerability was reported in Lenovo One Client during an internal security assessment that could allow a local authenticated user to… |
CVE-2025-13125 | Medium | 4.3 | 2025-12-10 | Authorization Bypass Through User-Controlled Key vulnerability in Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd… |
CVE-2025-12046 | High | 7.8 | 2025-12-10 | A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated user to execute code… |
CVE-2025-8110 | High | 8.8 | 2025-12-10 | Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. |
CVE-2025-13127 | Low | 3.5 | 2025-12-10 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in TAC Information Services Internal and External Tra… |
CVE-2025-13184 | Critical | 9.8 | 2025-12-10 | Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password on factory/reset X5000R V9.1.0u.636… |
CVE-2025-41358 | | 2025-12-10 | Direct Object Reference Vulnerability (IDOR) in i2A's CronosWeb, in versions prior to 25.00.00.12, inclusive. This vulnerability could allow an authenticated a… | |
CVE-2025-13953 | | 2025-12-10 | Bypass vulnerability in the authentication method in the GTT Tax Information System application, related to the Active Directory (LDAP) login method. Authenti… | |
CVE-2025-41732 | Critical | 9.8 | 2025-12-10 | An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers which… |
CVE-2025-41730 | Critical | 9.8 | 2025-12-10 | An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size stack buffers whic… |
CVE-2025-7073 | High | 7.8 | 2025-12-10 | A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges. T… |
CVE-2025-66675 | High | 8.2 | 2025-12-10 | Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0… |
CVE-2025-14390 | High | 8.8 | 2025-12-10 | The Video Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in version <= 5.0.4. This is due to missing or incorrect nonce validation o… |
CVE-2025-9315 | | 2025-12-10 | An unauthenticated device registration vulnerability, caused by Improperly Controlled Modification of Dynamically-Determined Object Attributes, has been identi… | |
CVE-2025-66004 | Medium | 5.7 | 2025-12-10 | A Path Traversal vulnerability in usbmuxd allows local users to escalate to the service user.This issue affects usbmuxd: before 3ded00c9985a5108cfc7591a309f9a2… |
CVE-2025-1161 | High | 7.1 | 2025-12-10 | Incorrect Use of Privileged APIs vulnerability in NomySoft Information Technology Training and Consulting Inc. Nomysem allows Privilege Escalation. This issue… |
CVE-2025-14087 | Medium | 5.6 | 2025-12-10 | A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code ex… |
CVE-2025-14082 | Low | 2.7 | 2025-12-10 | A flaw was found in Keycloak Admin REST (Representational State Transfer) API. This vulnerability allows information disclosure of sensitive role metadata via… |
CVE-2025-13955 | | 2025-12-10 | Predictable default Wi-Fi Password in Access Point functionality in EZCast Pro II before version 1.17478.177 allows attackers in Wi-Fi range to gain access to… | |
CVE-2025-13954 | | 2025-12-10 | Hard-coded cryptographic keys in Admin UI of EZCast Pro II before version 1.17478.177 allows attackers to bypass authorization checks and gain full access to t… | |
CVE-2025-12952 | | 2025-12-10 | A privilege escalation vulnerability exists in Google Cloud's Dialogflow CX. Dialogflow agent developers with Webhook editor permission are able to configure… | |
CVE-2025-9571 | | 2025-12-10 | A remote code execution (RCE) vulnerability exists in Google Cloud Data Fusion. A user with permissions to upload artifacts to a Data Fusion instance can execu… | |
CVE-2025-13073 | High | 7.1 | 2025-12-10 | The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Refl… |
CVE-2025-13072 | High | 7.1 | 2025-12-10 | The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Refl… |
CVE-2025-13339 | High | 7.5 | 2025-12-10 | The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.1 via the template_redirec… |
CVE-2025-9056 | Medium | 5.3 | 2025-12-10 | Unprotected service in the AudioLink component allows a local attacker to overwrite system files via unauthorized service invocation. |
CVE-2025-13677 | Medium | 4.9 | 2025-12-10 | The Simple Download Counter plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.2.2. This is due to insufficient path… |
CVE-2025-13613 | Critical | 9.8 | 2025-12-10 | The Elated Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.2. This is due to the plugin not prop… |
CVE-2025-67507 | High | 8.1 | 2025-12-10 | Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.3.0 contain a flaw in the handling of recovery… |
CVE-2025-67506 | Critical | 9.8 | 2025-12-10 | PipesHub is a fully extensible workplace AI platform for enterprise search and workflow automation. Versions prior to 0.1.0-beta expose POST /api/v1/record/buf… |
CVE-2025-67485 | Medium | 5.3 | 2025-12-10 | mad-proxy is a Python-based HTTP/HTTPS proxy server for detection and blocking of malicious web activity using custom security policies. Versions 0.3 and below… |
CVE-2025-67502 | Medium | 5.4 | 2025-12-10 | Taguette is an open source qualitative research tool. In versions 1.5.1 and below, attackers can craft malicious URLs that redirect users to arbitrary externa… |
CVE-2025-67501 | High | 8.8 | 2025-12-10 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Versions 3.5.4 and below contain an SQL Injection vulnerability… |
CVE-2025-67500 | Low | 3.7 | 2025-12-10 | Mastodon is a free, open-source social network server based on ActivityPub. Versions 4.2.27 and prior, 4.3.0-beta.1 through 4.3.14, 4.4.0-beta.1 through 4.4.9… |
CVE-2025-67499 | Medium | 6.6 | 2025-12-10 | The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. Versions 1.6.0 through 1.8.0 inadvertently… |
CVE-2025-64898 | Medium | 5.3 | 2025-12-10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could result in limited una… |
CVE-2025-64897 | Medium | 5.6 | 2025-12-10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability. A low privileged attacker could leverage thi… |
CVE-2025-61823 | Medium | 6.2 | 2025-12-10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that co… |
CVE-2025-61822 | Medium | 6.2 | 2025-12-10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system wr… |
CVE-2025-61821 | Medium | 6.8 | 2025-12-10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that co… |
CVE-2025-61813 | High | 7.4 | 2025-12-10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that co… |
CVE-2025-61812 | High | 8.4 | 2025-12-10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could allow a high privileged attacker… |
CVE-2025-61811 | Critical | 9.1 | 2025-12-10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution… |
CVE-2025-61810 | High | 8.4 | 2025-12-10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code… |
CVE-2025-61809 | Critical | 9.1 | 2025-12-10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature byp… |
CVE-2025-61808 | Critical | 9.1 | 2025-12-10 | ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could lead to ar… |
CVE-2025-67496 | Medium | 4.3 | 2025-12-09 | WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Versions 3.5.4 and below contain a Stored Cross-Site Scripting… |
CVE-2025-67495 | High | 8.0 | 2025-12-09 | ZITADEL is an open-source identity infrastructure tool. Versions 4.0.0-rc.1 through 4.7.0 are vulnerable to DOM-Based XSS through the Zitadel V2 logout endpoin… |
CVE-2025-67494 | Critical | 9.3 | 2025-12-09 | ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADE… |
CVE-2025-66645 | High | 7.5 | 2025-12-09 | NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to directory traversal through the App.add_media_files() function, which allow… |
CVE-2025-66039 | Critical | 9.8 | 2025-12-09 | FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authenticat… |
CVE-2025-65513 | High | 7.5 | 2025-12-09 | fetch-mcp v1.0.2 and before is vulnerable to Server-Side Request Forgery (SSRF) vulnerability, which allows attackers to bypass private IP validation and acces… |
CVE-2025-36437 | Medium | 4.3 | 2025-12-09 | IBM Planning Analytics Local 2.1.0 - 2.1.15 could disclose sensitive information about server architecture that could aid in further attacks against the system. |
CVE-2025-34425 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the WindowContext parameter of /Mondo/lang/sys/Forms/MAI/com… |
CVE-2025-67489 | Critical | 9.8 | 2025-12-09 | @vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the de… |
CVE-2025-67488 | High | 7.8 | 2025-12-09 | SiYuan is self-hosted, open source personal knowledge management software. Versions 0.0.0-20251202123337-6ef83b42c7ce and below contain function importZipMd wh… |
CVE-2025-66626 | High | 8.1 | 2025-12-09 | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions 3.6.13 and below and versions 3.7.0 t… |
CVE-2025-64899 | High | 7.8 | 2025-12-09 | Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an out-of-bounds read vulnerability wh… |
CVE-2025-64896 | Medium | 5.5 | 2025-12-09 | Creative Cloud Desktop versions 6.4.0.361 and earlier are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that c… |
CVE-2025-64787 | Low | 3.3 | 2025-12-09 | Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Improper Verification of Cryptograp… |
CVE-2025-64786 | Low | 3.3 | 2025-12-09 | Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Improper Verification of Cryptograp… |
CVE-2025-64785 | High | 7.8 | 2025-12-09 | Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Untrusted Search Path vulnerability… |
CVE-2025-13743 | High | 7.5 | 2025-12-09 | Docker Desktop diagnostics bundles were found to include expired Hub PATs in log output due to error object serialization. This poses a risk of leaking sensiti… |
CVE-2025-66625 | Medium | 4.9 | 2025-12-09 | Umbraco is an ASP.NET CMS. Due to unsafe handling and deletion of temporary files in versions 10.0.0 through 13.12.0, during the dictionary upload process an a… |
CVE-2025-66457 | High | 8.8 | 2025-12-09 | Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.17 and below are s… |
CVE-2025-66456 | Critical | 9.8 | 2025-12-09 | Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 c… |
CVE-2025-66214 | High | 7.0 | 2025-12-09 | Ladybug adds message-based debugging, unit, system, and regression testing to Java applications. Versions prior to 3.0-20251107.114628 contain the APIs /iaf/la… |
CVE-2025-65741 | Critical | 9.8 | 2025-12-09 | Sublime Text 3 Build 3208 or prior for MacOS is vulnerable to Dylib Injection. An attacker could compile a .dylib file and force the execution of this library… |
CVE-2025-64113 | Critical | 9.8 | 2025-12-09 | Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server (for Emby S… |
CVE-2025-14337 | High | 7.3 | 2025-12-09 | A vulnerability was determined in itsourcecode Student Management System 1.0. This affects an unknown part of the file /new_grade.php. This manipulation of the… |
CVE-2025-9614 | Medium | 6.5 | 2025-12-09 | An issue was discovered in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, where insufficient guidance on re-keying and stream flushi… |
CVE-2025-9613 | Medium | 6.5 | 2025-12-09 | A vulnerability was discovered in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, where insufficient guidance on tag reuse after comp… |
CVE-2025-9612 | Medium | 5.1 | 2025-12-09 | An issue was discovered in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, where insufficient guidance on Transaction Layer Packet (T… |
CVE-2025-65882 | Critical | 9.8 | 2025-12-09 | An issue was discovered in openmptcprouter thru 0.64 in file common/package/utils/sys-upgrade-helper/src/tools/sysupgrade.c in function create_xor_ipad_opad al… |
CVE-2025-65573 | High | 8.8 | 2025-12-09 | Cross Site Request Forgery (CSRF) vulnerability in AllskyTeam AllSky v2024.12.06_06 allows remote attackers to cause a denial of service via function handle_in… |
CVE-2025-65572 | Medium | 6.1 | 2025-12-09 | Cross Site Scripting (XSS) vulnerability in AllskyTeam AllSky v2024.12.06_06 allows remote attackers to execute arbitrary code via the (1) config, (2) filename… |
CVE-2025-65300 | Medium | 5.4 | 2025-12-09 | A stored Cross-Site Scripting (XSS) vulnerability exists in the Coohom SaaS Platform feVersion=1760060603897 (2025-10-28) in the Account Settings module, where… |
CVE-2025-14336 | High | 7.3 | 2025-12-09 | A vulnerability was found in itsourcecode Student Management System 1.0. Affected by this issue is some unknown functionality of the file /promote.php. The man… |
CVE-2025-14335 | High | 7.3 | 2025-12-09 | A vulnerability has been found in itsourcecode Student Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /new_schoo… |
CVE-2025-14334 | High | 7.3 | 2025-12-09 | A flaw has been found in itsourcecode Student Management System 1.0. Affected is an unknown function of the file /new_adviser.php. Executing manipulation of th… |
CVE-2025-11531 | High | 8.8 | 2025-12-09 | HP System Event Utility and Omen Gaming Hub might allow execution of certain files outside of their restricted paths. This potential vulnerabil… |
CVE-2025-65594 | High | 8.1 | 2025-12-09 | OpenSIS 9.2 and below is vulnerable to Incorrect Access Control in Student.php, which allows an authenticated low-privilege user to perform unauthorized databa… |
CVE-2025-64894 | Medium | 5.5 | 2025-12-09 | DNG SDK versions 1.7.0 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could lead to application denial-of-service. An attacke… |
CVE-2025-64893 | High | 7.1 | 2025-12-09 | DNG SDK versions 1.7.0 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure or application denial of service. An… |
CVE-2025-64784 | High | 7.1 | 2025-12-09 | DNG SDK versions 1.7.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure or application denial of servi… |
CVE-2025-64783 | High | 7.8 | 2025-12-09 | DNG SDK versions 1.7.0 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context… |
CVE-2025-64680 | High | 7.8 | 2025-12-09 | Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2025-64679 | High | 7.8 | 2025-12-09 | Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. |
CVE-2025-64678 | High | 8.8 | 2025-12-09 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
CVE-2025-64673 | High | 7.8 | 2025-12-09 | Improper access control in Storvsp.sys Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-64672 | High | 8.8 | 2025-12-09 | Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp… |
CVE-2025-64671 | High | 8.4 | 2025-12-09 | Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute code locally. |
CVE-2025-64670 | Medium | 6.5 | 2025-12-09 | Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose information over a network. |
CVE-2025-64667 | Medium | 5.3 | 2025-12-09 | User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. |
CVE-2025-64666 | High | 7.5 | 2025-12-09 | Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
CVE-2025-64661 | High | 7.8 | 2025-12-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privilege… |