2025 CVEs (page 82)

Page 82 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.

All CVEs published in 2025 — newest first (page 82 of 436)
CVESeverityScorePublishedSummary
CVE-2025-67485Medium5.32025-12-10mad-proxy is a Python-based HTTP/HTTPS proxy server for detection and blocking of malicious web activity using custom security policies. Versions 0.3 and below…
CVE-2025-67502Medium5.42025-12-10Taguette is an open source qualitative research tool. In versions 1.5.1 and below, attackers can craft malicious URLs that redirect users to arbitrary externa…
CVE-2025-67501High8.82025-12-10WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Versions 3.5.4 and below contain an SQL Injection vulnerability…
CVE-2025-67500Low3.72025-12-10Mastodon is a free, open-source social network server based on ActivityPub. Versions 4.2.27 and prior, 4.3.0-beta.1 through 4.3.14, 4.4.0-beta.1 through 4.4.9…
CVE-2025-67499Medium6.62025-12-10The CNI portmap plugin allows containers to emulate opening a host port, forwarding that traffic to the container. Versions 1.6.0 through 1.8.0 inadvertently…
CVE-2025-64898Medium5.32025-12-10ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Insufficiently Protected Credentials vulnerability that could result in limited una…
CVE-2025-64897Medium5.62025-12-10ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability. A low privileged attacker could leverage thi…
CVE-2025-61823Medium6.22025-12-10ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that co…
CVE-2025-61822Medium6.22025-12-10ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could lead to arbitrary file system wr…
CVE-2025-61821Medium6.82025-12-10ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that co…
CVE-2025-61813High7.42025-12-10ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that co…
CVE-2025-61812High8.42025-12-10ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could allow a high privileged attacker…
CVE-2025-61811Critical9.12025-12-10ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability that could result in arbitrary code execution…
CVE-2025-61810High8.42025-12-10ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code…
CVE-2025-61809Critical9.12025-12-10ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature byp…
CVE-2025-61808Critical9.12025-12-10ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could lead to ar…
CVE-2025-67496Medium4.32025-12-09WeGIA is an open source Web Manager for Institutions with a focus on Portuguese language users. Versions 3.5.4 and below contain a Stored Cross-Site Scripting…
CVE-2025-67495High8.02025-12-09ZITADEL is an open-source identity infrastructure tool. Versions 4.0.0-rc.1 through 4.7.0 are vulnerable to DOM-Based XSS through the Zitadel V2 logout endpoin…
CVE-2025-67494Critical9.32025-12-09ZITADEL is an open-source identity infrastructure tool. Versions 4.7.0 and below are vulnerable to an unauthenticated, full-read SSRF vulnerability. The ZITADE…
CVE-2025-66645High7.52025-12-09NiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to directory traversal through the App.add_media_files() function, which allow…
CVE-2025-66039Critical9.82025-12-09FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authenticat…
CVE-2025-65513High7.52025-12-09fetch-mcp v1.0.2 and before is vulnerable to Server-Side Request Forgery (SSRF) vulnerability, which allows attackers to bypass private IP validation and acces…
CVE-2025-36437Medium4.32025-12-09IBM Planning Analytics Local 2.1.0 - 2.1.15 could disclose sensitive information about server architecture that could aid in further attacks against the system.
CVE-2025-34425Medium6.12025-12-09MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the WindowContext parameter of /Mondo/lang/sys/Forms/MAI/com…
CVE-2025-67489Critical9.82025-12-09@vitejs/plugin-rs provides React Server Components (RSC) support for Vite. Versions 0.5.5 and below are vulnerable to arbitrary remote code execution on the de…
CVE-2025-67488High7.82025-12-09SiYuan is self-hosted, open source personal knowledge management software. Versions 0.0.0-20251202123337-6ef83b42c7ce and below contain function importZipMd wh…
CVE-2025-66626High8.12025-12-09Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Versions 3.6.13 and below and versions 3.7.0 t…
CVE-2025-64899High7.82025-12-09Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an out-of-bounds read vulnerability wh…
CVE-2025-64896Medium5.52025-12-09Creative Cloud Desktop versions 6.4.0.361 and earlier are affected by a Creation of Temporary File in Directory with Incorrect Permissions vulnerability that c…
CVE-2025-64787Low3.32025-12-09Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Improper Verification of Cryptograp…
CVE-2025-64786Low3.32025-12-09Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Improper Verification of Cryptograp…
CVE-2025-64785High7.82025-12-09Acrobat Reader versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier are affected by an Untrusted Search Path vulnerability…
CVE-2025-13743High7.52025-12-09Docker Desktop diagnostics bundles were found to include expired Hub PATs in log output due to error object serialization. This poses a risk of leaking sensiti…
CVE-2025-66625Medium4.92025-12-09Umbraco is an ASP.NET CMS. Due to unsafe handling and deletion of temporary files in versions 10.0.0 through 13.12.0, during the dictionary upload process an a…
CVE-2025-66457High8.82025-12-09Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.17 and below are s…
CVE-2025-66456Critical9.82025-12-09Elysia is a Typescript framework for request validation, type inference, OpenAPI documentation and client-server communication. Versions 1.4.0 through 1.4.16 c…
CVE-2025-66214High7.02025-12-09Ladybug adds message-based debugging, unit, system, and regression testing to Java applications. Versions prior to 3.0-20251107.114628 contain the APIs /iaf/la…
CVE-2025-65741Critical9.82025-12-09Sublime Text 3 Build 3208 or prior for MacOS is vulnerable to Dylib Injection. An attacker could compile a .dylib file and force the execution of this library…
CVE-2025-64113Critical9.82025-12-09Emby Server is a user-installable home media server. Versions below 4.9.1.81 allow an attacker to gain full administrative access to an Emby Server (for Emby S…
CVE-2025-14337High7.32025-12-09A vulnerability was determined in itsourcecode Student Management System 1.0. This affects an unknown part of the file /new_grade.php. This manipulation of the…
CVE-2025-9614Medium6.52025-12-09An issue was discovered in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, where insufficient guidance on re-keying and stream flushi…
CVE-2025-9613Medium6.52025-12-09A vulnerability was discovered in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, where insufficient guidance on tag reuse after comp…
CVE-2025-9612Medium5.12025-12-09An issue was discovered in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, where insufficient guidance on Transaction Layer Packet (T…
CVE-2025-65882Critical9.82025-12-09An issue was discovered in openmptcprouter thru 0.64 in file common/package/utils/sys-upgrade-helper/src/tools/sysupgrade.c in function create_xor_ipad_opad al…
CVE-2025-65573High8.82025-12-09Cross Site Request Forgery (CSRF) vulnerability in AllskyTeam AllSky v2024.12.06_06 allows remote attackers to cause a denial of service via function handle_in…
CVE-2025-65572Medium6.12025-12-09Cross Site Scripting (XSS) vulnerability in AllskyTeam AllSky v2024.12.06_06 allows remote attackers to execute arbitrary code via the (1) config, (2) filename…
CVE-2025-65300Medium5.42025-12-09A stored Cross-Site Scripting (XSS) vulnerability exists in the Coohom SaaS Platform feVersion=1760060603897 (2025-10-28) in the Account Settings module, where…
CVE-2025-14336High7.32025-12-09A vulnerability was found in itsourcecode Student Management System 1.0. Affected by this issue is some unknown functionality of the file /promote.php. The man…
CVE-2025-14335High7.32025-12-09A vulnerability has been found in itsourcecode Student Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /new_schoo…
CVE-2025-14334High7.32025-12-09A flaw has been found in itsourcecode Student Management System 1.0. Affected is an unknown function of the file /new_adviser.php. Executing manipulation of th…
CVE-2025-11531High8.82025-12-09HP System Event Utility and Omen Gaming Hub might allow execution of certain files outside of their restricted paths. This potential vulnerabil…
CVE-2025-65594High8.12025-12-09OpenSIS 9.2 and below is vulnerable to Incorrect Access Control in Student.php, which allows an authenticated low-privilege user to perform unauthorized databa…
CVE-2025-64894Medium5.52025-12-09DNG SDK versions 1.7.0 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could lead to application denial-of-service. An attacke…
CVE-2025-64893High7.12025-12-09DNG SDK versions 1.7.0 and earlier are affected by an Out-of-bounds Read vulnerability that could lead to memory exposure or application denial of service. An…
CVE-2025-64784High7.12025-12-09DNG SDK versions 1.7.0 and earlier are affected by a Heap-based Buffer Overflow vulnerability that could lead to memory exposure or application denial of servi…
CVE-2025-64783High7.82025-12-09DNG SDK versions 1.7.0 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context…
CVE-2025-64680High7.82025-12-09Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVE-2025-64679High7.82025-12-09Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
CVE-2025-64678High8.82025-12-09Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
CVE-2025-64673High7.82025-12-09Improper access control in Storvsp.sys Driver allows an authorized attacker to elevate privileges locally.
CVE-2025-64672High8.82025-12-09Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform sp…
CVE-2025-64671High8.42025-12-09Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to execute code locally.
CVE-2025-64670Medium6.52025-12-09Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose information over a network.
CVE-2025-64667Medium5.32025-12-09User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVE-2025-64666High7.52025-12-09Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2025-64661High7.82025-12-09Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privilege…
CVE-2025-64658High7.52025-12-09Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privilege…
CVE-2025-64471Medium4.92025-12-09A use of password hash instead of password for authentication vulnerability [CWE-836] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 th…
CVE-2025-64447High8.12025-12-09A reliance on cookies without validation and integrity checking vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.5, FortiWeb…
CVE-2025-64156High7.22025-12-09An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiVoice 7.2.0 through 7.2.2, FortiVoice 7…
CVE-2025-64153High7.22025-12-09A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.6.0 through 7.6.3, FortiExtender 7.4.0…
CVE-2025-64086High7.52025-12-09A NULL pointer dereference vulnerability in the util.readFileIntoStream component of PDF-XChange Editor v10.7.3.401 allows attackers to cause a Denial of Servi…
CVE-2025-64085High7.52025-12-09A NULL pointer dereference vulnerability in the importDataObject() function of PDF-XChange Editor v10.7.3.401 allows attackers to cause a Denial of Service (Do…
CVE-2025-62631Medium5.62025-12-09An insufficient session expiration vulnerability [CWE-613] vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2 all versions, FortiOS 7.0 all versions, FortiOS…
CVE-2025-62573High7.02025-12-09Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.
CVE-2025-62572High7.82025-12-09Out-of-bounds read in Application Information Services allows an authorized attacker to elevate privileges locally.
CVE-2025-62571High7.82025-12-09Improper input validation in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2025-62570High7.12025-12-09Improper access control in Windows Camera Frame Server Monitor allows an authorized attacker to disclose information locally.
CVE-2025-62569High7.02025-12-09Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
CVE-2025-62567Medium5.32025-12-09Integer underflow (wrap or wraparound) in Windows Hyper-V allows an authorized attacker to deny service over a network.
CVE-2025-62565High7.32025-12-09Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.
CVE-2025-62564High7.82025-12-09Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-62563High7.82025-12-09Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-62562High7.82025-12-09Use after free in Microsoft Office Outlook allows an unauthorized attacker to execute code locally.
CVE-2025-62561High7.82025-12-09Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-62560High7.82025-12-09Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-62559High7.82025-12-09Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2025-62558High7.82025-12-09Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2025-62557High8.42025-12-09Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2025-62556High7.82025-12-09Untrusted pointer dereference in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-62555High7.02025-12-09Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
CVE-2025-62554High8.42025-12-09Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
CVE-2025-62553High7.82025-12-09Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
CVE-2025-62552High7.82025-12-09Relative path traversal in Microsoft Office Access allows an unauthorized attacker to execute code locally.
CVE-2025-62550High8.82025-12-09Out-of-bounds write in Azure Monitor Agent allows an authorized attacker to execute code over a network.
CVE-2025-62549High8.82025-12-09Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
CVE-2025-62474High7.82025-12-09Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
CVE-2025-62473Medium6.52025-12-09Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
CVE-2025-62472High7.82025-12-09Use of uninitialized resource in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
CVE-2025-62470High7.82025-12-09Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.