2025 CVEs (page 81)
Page 81 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-64658 | High | 7.5 | 2025-12-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privilege… |
CVE-2025-64471 | Medium | 4.9 | 2025-12-09 | A use of password hash instead of password for authentication vulnerability [CWE-836] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 th… |
CVE-2025-64447 | High | 8.1 | 2025-12-09 | A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb… |
CVE-2025-64156 | High | 7.2 | 2025-12-09 | An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7… |
CVE-2025-64153 | High | 7.2 | 2025-12-09 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, FortiExtender 7.4.0… |
CVE-2025-64086 | High | 7.5 | 2025-12-09 | A NULL pointer dereference vulnerability in the util.readFileIntoStream component of PDF-XChange Editor v10.7.3.401 allows attackers to cause a Denial of Servi… |
CVE-2025-64085 | High | 7.5 | 2025-12-09 | A NULL pointer dereference vulnerability in the importDataObject() function of PDF-XChange Editor v10.7.3.401 allows attackers to cause a Denial of Service (Do… |
CVE-2025-62631 | Medium | 5.6 | 2025-12-09 | An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS… |
CVE-2025-62573 | High | 7.0 | 2025-12-09 | Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally. |
CVE-2025-62572 | High | 7.8 | 2025-12-09 | Out-of-bounds read in Application Information Services allows an authorized attacker to elevate privileges locally. |
CVE-2025-62571 | High | 7.8 | 2025-12-09 | Improper input validation in Windows Installer allows an authorized attacker to elevate privileges locally. |
CVE-2025-62570 | High | 7.1 | 2025-12-09 | Improper access control in Windows Camera Frame Server Monitor allows an authorized attacker to disclose information locally. |
CVE-2025-62569 | High | 7.0 | 2025-12-09 | Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally. |
CVE-2025-62567 | Medium | 5.3 | 2025-12-09 | Integer underflow (wrap or wraparound) in Windows Hyper-V allows an authorized attacker to deny service over a network. |
CVE-2025-62565 | High | 7.3 | 2025-12-09 | Use after free in Windows Shell allows an authorized attacker to elevate privileges locally. |
CVE-2025-62564 | High | 7.8 | 2025-12-09 | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62563 | High | 7.8 | 2025-12-09 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62562 | High | 7.8 | 2025-12-09 | Use after free in Microsoft Office Outlook allows an unauthorized attacker to execute code locally. |
CVE-2025-62561 | High | 7.8 | 2025-12-09 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62560 | High | 7.8 | 2025-12-09 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62559 | High | 7.8 | 2025-12-09 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-62558 | High | 7.8 | 2025-12-09 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-62557 | High | 8.4 | 2025-12-09 | Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-62556 | High | 7.8 | 2025-12-09 | Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62555 | High | 7.0 | 2025-12-09 | Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
CVE-2025-62554 | High | 8.4 | 2025-12-09 | Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally. |
CVE-2025-62553 | High | 7.8 | 2025-12-09 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
CVE-2025-62552 | High | 7.8 | 2025-12-09 | Relative path traversal in Microsoft Office Access allows an unauthorized attacker to execute code locally. |
CVE-2025-62550 | High | 8.8 | 2025-12-09 | Out-of-bounds write in Azure Monitor Agent allows an authorized attacker to execute code over a network. |
CVE-2025-62549 | High | 8.8 | 2025-12-09 | Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
CVE-2025-62474 | High | 7.8 | 2025-12-09 | Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-62473 | Medium | 6.5 | 2025-12-09 | Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network. |
CVE-2025-62472 | High | 7.8 | 2025-12-09 | Use of uninitialized resource in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. |
CVE-2025-62470 | High | 7.8 | 2025-12-09 | Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-62469 | High | 7.0 | 2025-12-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an authorized attacker to… |
CVE-2025-62468 | Medium | 5.5 | 2025-12-09 | Out-of-bounds read in Windows Defender Firewall Service allows an authorized attacker to disclose information locally. |
CVE-2025-62467 | High | 7.8 | 2025-12-09 | Integer overflow or wraparound in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2025-62466 | High | 7.8 | 2025-12-09 | Null pointer dereference in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-62465 | Medium | 6.5 | 2025-12-09 | Null pointer dereference in Windows DirectX allows an authorized attacker to deny service locally. |
CVE-2025-62464 | High | 7.8 | 2025-12-09 | Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2025-62463 | Medium | 6.5 | 2025-12-09 | Null pointer dereference in Windows DirectX allows an authorized attacker to deny service locally. |
CVE-2025-62462 | High | 7.8 | 2025-12-09 | Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2025-62461 | High | 7.8 | 2025-12-09 | Buffer over-read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-62458 | High | 7.8 | 2025-12-09 | Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. |
CVE-2025-62457 | High | 7.8 | 2025-12-09 | Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-62456 | High | 8.8 | 2025-12-09 | Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code over a network. |
CVE-2025-62455 | High | 7.8 | 2025-12-09 | Improper input validation in Windows Message Queuing allows an authorized attacker to elevate privileges locally. |
CVE-2025-62454 | High | 7.8 | 2025-12-09 | Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-62221 | High | 7.8 | 2025-12-09 | Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-61258 | High | 7.5 | 2025-12-09 | Outsystems Platform Server 11.18.1.37828 allows attackers to cause a denial of service via a crafted content-length value mismatching the body length. NOTE: th… |
CVE-2025-61078 | Medium | 6.1 | 2025-12-09 | Cross-site scripting (XSS) vulnerability in Request IP form in phpIPAM v1.7.3 allows remote attackers to inject arbitrary web script or HTML via the instructio… |
CVE-2025-60024 | High | 8.8 | 2025-12-09 | Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] vulnerability in Fortinet FortiVoice 7.2.0 th… |
CVE-2025-59923 | Low | 2.7 | 2025-12-09 | An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all ve… |
CVE-2025-59810 | Medium | 6.5 | 2025-12-09 | An improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS 7.4 all versions, F… |
CVE-2025-59808 | Medium | 6.8 | 2025-12-09 | An unverified password change vulnerability [CWE-620] vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSO… |
CVE-2025-59719 | Critical | 9.8 | 2025-12-09 | An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may al… |
CVE-2025-59718 | Critical | 9.8 | 2025-12-09 | A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7… |
CVE-2025-59517 | High | 7.8 | 2025-12-09 | Improper access control in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-59516 | High | 7.8 | 2025-12-09 | Missing authentication for critical function in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-57823 | Low | 2.7 | 2025-12-09 | A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator… |
CVE-2025-55233 | High | 7.8 | 2025-12-09 | Out-of-bounds read in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2025-54838 | Medium | 6.8 | 2025-12-09 | An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a shared FortiGate device v… |
CVE-2025-54353 | Medium | 5.4 | 2025-12-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 thr… |
CVE-2025-54100 | High | 7.8 | 2025-12-09 | Improper neutralization of special elements used in a command ('command injection') in Windows PowerShell allows an unauthorized attacker to execute code local… |
CVE-2025-53949 | High | 7.2 | 2025-12-09 | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0… |
CVE-2025-53679 | High | 7.2 | 2025-12-09 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0… |
CVE-2025-46637 | High | 7.3 | 2025-12-09 | Dell Encryption, versions prior to 11.12.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A local malicious user cou… |
CVE-2025-46636 | Medium | 6.6 | 2025-12-09 | Dell Encryption, versions prior to 11.12.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker… |
CVE-2025-34414 | | 2025-12-09 | Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an… | |
CVE-2025-34413 | | 2025-12-09 | Legality WHISTLEBLOWING by DigitalPA contains a protection mechanism failure in which critical HTTP security headers are not emitted by default. Affected deplo… | |
CVE-2025-34409 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the Failed parameter of /Mondo/lang/sys/Forms/MAI/AddRecipie… |
CVE-2025-34408 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the Added parameter of /Mondo/lang/sys/Forms/MAI/AddRecipien… |
CVE-2025-34407 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the theme parameter of /Mondo/lang/sys/Forms/Statistics.aspx… |
CVE-2025-34406 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the Id parameter of /Mobile/ContactDetails.aspx. The Id valu… |
CVE-2025-34404 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the InstanceScope parameter of /Mondo/lang/sys/Forms/CAL/com… |
CVE-2025-34403 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the FieldTo parameter of /Mondo/lang/sys/Forms/AddressBook.a… |
CVE-2025-34402 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the FieldCc parameter of /Mondo/lang/sys/Forms/AddressBook.a… |
CVE-2025-34401 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the FieldBcc parameter of /Mondo/lang/sys/Forms/AddressBook… |
CVE-2025-34400 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the AddressesTo parameter of /Mondo/lang/sys/Forms/AddressBo… |
CVE-2025-34399 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the AddressesCc parameter of /Mondo/lang/sys/Forms/AddressBo… |
CVE-2025-34398 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the AddressesBcc parameter of /Mondo/lang/sys/Forms/AddressB… |
CVE-2025-34397 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the Message parameter of /Mobile/Compose.aspx. The Message v… |
CVE-2025-34396 | High | 7.3 | 2025-12-09 | MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative e… |
CVE-2025-33214 | High | 8.8 | 2025-12-09 | NVIDIA NVTabular for Linux contains a vulnerability in the Workflow component, where a user could cause a deserialization issue. A successful exploit of this v… |
CVE-2025-33213 | High | 8.8 | 2025-12-09 | NVIDIA Merlin Transformers4Rec for Linux contains a vulnerability in the Trainer component, where a user could cause a deserialization issue. A successful expl… |
CVE-2025-13924 | Medium | 4.3 | 2025-12-09 | The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includ… |
CVE-2025-65289 | Medium | 6.1 | 2025-12-09 | A stored Cross site scripting (XSS) vulnerability in the Mercury MR816v2 (081C3114 4.8.7 Build 110427 Rel 36550n) router allows a remote attacker on the LAN to… |
CVE-2025-65288 | Medium | 6.5 | 2025-12-09 | A buffer overflow in the Mercury MR816v2 (081C3114 4.8.7 Build 110427 Rel 36550n) occurs when the device accepts and stores excessively long hostnames from LAN… |
CVE-2025-63742 | Critical | 9.8 | 2025-12-09 | SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive… |
CVE-2025-63740 | Medium | 4.3 | 2025-12-09 | SQL Injection vulnerability in function getselectdataAjax in file inputAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information… |
CVE-2025-63739 | Medium | 4.3 | 2025-12-09 | An issue was discovered in function phpinisaveAction in file webmain/system/cogini/coginiAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to authen… |
CVE-2025-63738 | Medium | 4.3 | 2025-12-09 | An issue was discovered in file index.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to gain sensitive information via phpinfo via the a parameter to th… |
CVE-2025-63737 | Medium | 6.1 | 2025-12-09 | Cross-site scripting (XSS) vulnerability in function urltestAction in file cliAction.php in Xinhu Rainrock RockOA 2.7.0 allows remote attackers to inject arbit… |
CVE-2025-56704 | High | 8.8 | 2025-12-09 | LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which is caused by the lack of proper validation for uploaded files. An authenticated… |
CVE-2025-12946 | High | 7.5 | 2025-12-09 | A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN si… |
CVE-2025-12945 | High | 7.2 | 2025-12-09 | A vulnerability in NETGEAR Nighthawk R7000P routers lets an authenticated admin execute OS command injections due to improper input validation. This issue… |
CVE-2025-12941 | Medium | 5.7 | 2025-12-09 | Denial of Service Vulnerability in NETGEAR C6220 and C6230 (DOCSIS® 3.0 Two-in-one Cable Modem + WiFi Router) allows authenticated local WiFi users reboot the… |
CVE-2025-9638 | Medium | 4.8 | 2025-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Portabilis i-Educar allows Stored Cross-Site Scripting (X… |
CVE-2025-9368 | | 2025-12-09 | A security issue exists within 432ES-IG3 Series A, which affects GuardLink® EtherNet/IP Interface, resulting in denial-of-service. A manual power cycle is requ… | |
CVE-2025-6924 | Medium | 5.4 | 2025-12-09 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software e-BAP Automation allows Reflected… |