2025 CVEs (page 81)
Page 81 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-64574 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64572 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64569 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low priv… |
CVE-2025-64566 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low priv… |
CVE-2025-64565 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low priv… |
CVE-2025-64564 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low priv… |
CVE-2025-64563 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low priv… |
CVE-2025-64562 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low priv… |
CVE-2025-64560 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low priv… |
CVE-2025-64559 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64558 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64557 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64556 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64555 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64554 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64553 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64551 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low priv… |
CVE-2025-64550 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low priv… |
CVE-2025-64549 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64548 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64547 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64546 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64545 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low priv… |
CVE-2025-64544 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low priv… |
CVE-2025-64543 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could be exploited by a low priv… |
CVE-2025-64541 | Medium | 5.4 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low privileged… |
CVE-2025-64539 | Critical | 9.3 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to arbitrary code exe… |
CVE-2025-64538 | Critical | 9.3 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to arbitrary code exe… |
CVE-2025-64537 | Critical | 9.3 | 2025-12-10 | Adobe Experience Manager versions 6.5.23 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability that could lead to arbitrary code exe… |
CVE-2025-56431 | High | 7.5 | 2025-12-10 | Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via the plugin-handler.ph… |
CVE-2025-56430 | High | 7.5 | 2025-12-10 | Directory Traversal vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to cause a denial of service via the plugin-handler.ph… |
CVE-2025-56429 | Medium | 6.1 | 2025-12-10 | Cross Site Scripting vulnerability in Fearless Geek Media FearlessCMS v.0.0.2-15 allows a remote attacker to obtain sensitive information via the login.php com… |
CVE-2025-34430 | Medium | 4.3 | 2025-12-10 | 1Panel versions 1.10.33 through 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the panel name management functionality. The affected endpo… |
CVE-2025-34429 | High | 7.1 | 2025-12-10 | 1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality. The port-change endpoin… |
CVE-2025-34428 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain a cleartext storage of credentials vulnerability that can lead to local credential compromise and account takeover… |
CVE-2025-34427 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain a cleartext storage of credentials vulnerability that can lead to local credential compromise and account takeover… |
CVE-2025-65754 | Medium | 6.1 | 2025-12-10 | Cross Site Scripting vulnerability in Algernon v1.17.4 allows attackers to execute arbitrary code via injecting a crafted payload into a filename. |
CVE-2025-63094 | High | 7.5 | 2025-12-10 | XiangShan Nanhu V2 and XiangShan Kunmighu V3 were discovered to use speculative execution and indirect branch prediction, allowing attackers to access sensitiv… |
CVE-2025-5467 | Low | 3.3 | 2025-12-10 | It was discovered that process_crash() in data/apport in Canonical's Apport crash reporting tool may create crash files with incorrect group ownership, possibl… |
CVE-2025-13607 | Critical | 9.4 | 2025-12-10 | A malicious actor can access camera configuration information, including account credentials, without authenticating when accessing a vulnerable URL. |
CVE-2025-67643 | Medium | 4.3 | 2025-12-10 | Jenkins Redpen - Pipeline Reporter for Jira Plugin 1.054.v7b_9517b_6b_202 and earlier does not correctly perform path validation of the workspace directory whi… |
CVE-2025-67642 | Medium | 4.3 | 2025-12-10 | Jenkins HashiCorp Vault Plugin 371.v884a_4dd60fb_6 and earlier does not set the appropriate context for Vault credentials lookup, allowing attackers with Item/… |
CVE-2025-67641 | Medium | 5.4 | 2025-12-10 | Jenkins Coverage Plugin 2.3054.ve1ff7b_a_a_123b_ and earlier does not validate the configured coverage results ID when creating coverage results, only when sub… |
CVE-2025-67640 | Medium | 5.0 | 2025-12-10 | Jenkins Git client Plugin 6.4.0 and earlier does not not correctly escape the path to the workspace directory as part of an argument in a temporary shell scrip… |
CVE-2025-67639 | Low | 3.5 | 2025-12-10 | A cross-site request forgery (CSRF) vulnerability in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers to trick users into logging in to the… |
CVE-2025-67638 | Medium | 4.3 | 2025-12-10 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not mask build authorization tokens displayed on the job configuration form, increasing the potential f… |
CVE-2025-67637 | Medium | 4.3 | 2025-12-10 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier stores build authorization tokens unencrypted in job config.xml files on the Jenkins controller where they c… |
CVE-2025-67636 | Medium | 4.3 | 2025-12-10 | A missing permission check in Jenkins 2.540 and earlier, LTS 2.528.2 and earlier allows attackers with View/Read permission to view encrypted password values i… |
CVE-2025-67635 | High | 7.5 | 2025-12-10 | Jenkins 2.540 and earlier, LTS 2.528.2 and earlier does not properly close HTTP-based CLI connections when the connection stream becomes corrupted, allowing un… |
CVE-2025-65815 | Medium | 6.5 | 2025-12-10 | A lack of security checks in the file import process of AB TECHNOLOGY Document Reader: PDF, DOC, PPT v65.0 allows attackers to execute a directory traversal. |
CVE-2025-65814 | Medium | 6.5 | 2025-12-10 | A lack of security checks in the file import process of RHOPHI Analytics LLP Office App-Edit Word v6.4.1 allows attackers to execute a directory traversal. |
CVE-2025-65792 | Critical | 9.1 | 2025-12-10 | DataGear v5.5.0 is vulnerable to Arbitrary File Deletion. |
CVE-2025-52493 | Medium | 6.5 | 2025-12-10 | PagerDuty Runbook through 2025-06-12 exposes stored secrets directly in the webpage DOM at the configuration page. Although these secrets appear masked as pass… |
CVE-2025-65807 | High | 8.4 | 2025-12-10 | An issue in sd command v1.0.0 and before allows attackers to escalate privileges to root via a crafted command. |
CVE-2025-65803 | Medium | 6.5 | 2025-12-10 | An integer overflow in the psdParser::ReadImageData function of FreeImage v3.18.0 and before allows attackers to cause a Denial of Service (DoS) via supplying… |
CVE-2025-34424 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative e… |
CVE-2025-34423 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative e… |
CVE-2025-34422 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative e… |
CVE-2025-34421 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative e… |
CVE-2025-34420 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative e… |
CVE-2025-34419 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative e… |
CVE-2025-34418 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative e… |
CVE-2025-34417 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative e… |
CVE-2025-34416 | High | 7.8 | 2025-12-10 | MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative e… |
CVE-2025-34410 | High | 7.1 | 2025-12-10 | 1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the Change Username functionality available from the settings pan… |
CVE-2025-34395 | High | 7.5 | 2025-12-10 | Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, exposes a .NET Remoting service in which an unauthenticated attack… |
CVE-2025-34394 | Critical | 9.8 | 2025-12-10 | Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, exposes a .NET Remoting service that is insufficiently protected a… |
CVE-2025-34393 | Critical | 9.8 | 2025-12-10 | Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not correctly verify the name of an attacker-controlled WSDL… |
CVE-2025-34392 | Critical | 9.8 | 2025-12-10 | Barracuda Service Center, as implemented in the RMM solution, in versions prior to 2025.1.1, does not verify the URL defined in an attacker-controlled WSDL tha… |
CVE-2025-13155 | High | 7.8 | 2025-12-10 | An improper permissions vulnerability was reported in Lenovo Baiying Client that could allow a local authenticated user to execute code with elevated privilege… |
CVE-2025-13152 | High | 7.8 | 2025-12-10 | A potential DLL hijacking vulnerability was reported in Lenovo One Client during an internal security assessment that could allow a local authenticated user to… |
CVE-2025-13125 | Medium | 4.3 | 2025-12-10 | Authorization Bypass Through User-Controlled Key vulnerability in Im Park Information Technology, Electronics, Press, Publishing and Advertising, Education Ltd… |
CVE-2025-12046 | High | 7.8 | 2025-12-10 | A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated user to execute code… |
CVE-2025-8110 | High | 8.8 | 2025-12-10 | Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. |
CVE-2025-13127 | Low | 3.5 | 2025-12-10 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in TAC Information Services Internal and External Tra… |
CVE-2025-13184 | Critical | 9.8 | 2025-12-10 | Unauthenticated Telnet enablement via cstecgi.cgi (auth bypass) leading to unauthenticated root login with a blank password on factory/reset X5000R V9.1.0u.636… |
CVE-2025-41358 | | 2025-12-10 | Direct Object Reference Vulnerability (IDOR) in i2A's CronosWeb, in versions prior to 25.00.00.12, inclusive. This vulnerability could allow an authenticated a… | |
CVE-2025-13953 | | 2025-12-10 | Bypass vulnerability in the authentication method in the GTT Tax Information System application, related to the Active Directory (LDAP) login method. Authenti… | |
CVE-2025-41732 | Critical | 9.8 | 2025-12-10 | An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_cookie() function to write arbitrary data into fixed-size stack buffers which… |
CVE-2025-41730 | Critical | 9.8 | 2025-12-10 | An unauthenticated remote attacker can abuse unsafe sscanf calls within the check_account() function to write arbitrary data into fixed-size stack buffers whic… |
CVE-2025-7073 | High | 7.8 | 2025-12-10 | A local privilege escalation vulnerability in Bitdefender Total Security versions prior to 27.0.47.241 allows low-privileged attackers to elevate privileges. T… |
CVE-2025-66675 | High | 8.2 | 2025-12-10 | Denial of Service vulnerability in Apache Struts, file leak in multipart request processing causes disk exhaustion. This issue affects Apache Struts: from 2.0… |
CVE-2025-14390 | High | 8.8 | 2025-12-10 | The Video Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in version <= 5.0.4. This is due to missing or incorrect nonce validation o… |
CVE-2025-9315 | | 2025-12-10 | An unauthenticated device registration vulnerability, caused by Improperly Controlled Modification of Dynamically-Determined Object Attributes, has been identi… | |
CVE-2025-66004 | Medium | 5.7 | 2025-12-10 | A Path Traversal vulnerability in usbmuxd allows local users to escalate to the service user.This issue affects usbmuxd: before 3ded00c9985a5108cfc7591a309f9a2… |
CVE-2025-1161 | High | 7.1 | 2025-12-10 | Incorrect Use of Privileged APIs vulnerability in NomySoft Information Technology Training and Consulting Inc. Nomysem allows Privilege Escalation. This issue… |
CVE-2025-14087 | Medium | 5.6 | 2025-12-10 | A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code ex… |
CVE-2025-14082 | Low | 2.7 | 2025-12-10 | A flaw was found in Keycloak Admin REST (Representational State Transfer) API. This vulnerability allows information disclosure of sensitive role metadata via… |
CVE-2025-13955 | | 2025-12-10 | Predictable default Wi-Fi Password in Access Point functionality in EZCast Pro II before version 1.17478.177 allows attackers in Wi-Fi range to gain access to… | |
CVE-2025-13954 | | 2025-12-10 | Hard-coded cryptographic keys in Admin UI of EZCast Pro II before version 1.17478.177 allows attackers to bypass authorization checks and gain full access to t… | |
CVE-2025-12952 | | 2025-12-10 | A privilege escalation vulnerability exists in Google Cloud's Dialogflow CX. Dialogflow agent developers with Webhook editor permission are able to configure… | |
CVE-2025-9571 | | 2025-12-10 | A remote code execution (RCE) vulnerability exists in Google Cloud Data Fusion. A user with permissions to upload artifacts to a Data Fusion instance can execu… | |
CVE-2025-13073 | High | 7.1 | 2025-12-10 | The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Refl… |
CVE-2025-13072 | High | 7.1 | 2025-12-10 | The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Refl… |
CVE-2025-13339 | High | 7.5 | 2025-12-10 | The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.7.1 via the template_redirec… |
CVE-2025-9056 | Medium | 5.3 | 2025-12-10 | Unprotected service in the AudioLink component allows a local attacker to overwrite system files via unauthorized service invocation. |
CVE-2025-13677 | Medium | 4.9 | 2025-12-10 | The Simple Download Counter plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 2.2.2. This is due to insufficient path… |
CVE-2025-13613 | Critical | 9.8 | 2025-12-10 | The Elated Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.2. This is due to the plugin not prop… |
CVE-2025-67507 | High | 8.1 | 2025-12-10 | Filament is a collection of full-stack components for accelerated Laravel development. Versions 4.0.0 through 4.3.0 contain a flaw in the handling of recovery… |
CVE-2025-67506 | Critical | 9.8 | 2025-12-10 | PipesHub is a fully extensible workplace AI platform for enterprise search and workflow automation. Versions prior to 0.1.0-beta expose POST /api/v1/record/buf… |