2025 CVEs (page 83)
Page 83 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-62469 | High | 7.0 | 2025-12-09 | Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an authorized attacker to… |
CVE-2025-62468 | Medium | 5.5 | 2025-12-09 | Out-of-bounds read in Windows Defender Firewall Service allows an authorized attacker to disclose information locally. |
CVE-2025-62467 | High | 7.8 | 2025-12-09 | Integer overflow or wraparound in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2025-62466 | High | 7.8 | 2025-12-09 | Null pointer dereference in Windows Client-Side Caching (CSC) Service allows an authorized attacker to elevate privileges locally. |
CVE-2025-62465 | Medium | 6.5 | 2025-12-09 | Null pointer dereference in Windows DirectX allows an authorized attacker to deny service locally. |
CVE-2025-62464 | High | 7.8 | 2025-12-09 | Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2025-62463 | Medium | 6.5 | 2025-12-09 | Null pointer dereference in Windows DirectX allows an authorized attacker to deny service locally. |
CVE-2025-62462 | High | 7.8 | 2025-12-09 | Buffer over-read in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2025-62461 | High | 7.8 | 2025-12-09 | Buffer over-read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-62458 | High | 7.8 | 2025-12-09 | Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. |
CVE-2025-62457 | High | 7.8 | 2025-12-09 | Out-of-bounds read in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-62456 | High | 8.8 | 2025-12-09 | Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code over a network. |
CVE-2025-62455 | High | 7.8 | 2025-12-09 | Improper input validation in Windows Message Queuing allows an authorized attacker to elevate privileges locally. |
CVE-2025-62454 | High | 7.8 | 2025-12-09 | Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-62221 | High | 7.8 | 2025-12-09 | Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-61258 | High | 7.5 | 2025-12-09 | Outsystems Platform Server 11.18.1.37828 allows attackers to cause a denial of service via a crafted content-length value mismatching the body length. NOTE: th… |
CVE-2025-61078 | Medium | 6.1 | 2025-12-09 | Cross-site scripting (XSS) vulnerability in Request IP form in phpIPAM v1.7.3 allows remote attackers to inject arbitrary web script or HTML via the instructio… |
CVE-2025-60024 | High | 8.8 | 2025-12-09 | Multiple Improper Limitations of a Pathname to a Restricted Directory ('Path Traversal') vulnerabilities [CWE-22] vulnerability in Fortinet FortiVoice 7.2.0 th… |
CVE-2025-59923 | Low | 2.7 | 2025-12-09 | An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all ve… |
CVE-2025-59810 | Medium | 6.5 | 2025-12-09 | An improper access control vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSOAR PaaS 7.4 all versions, F… |
CVE-2025-59808 | Medium | 6.8 | 2025-12-09 | An unverified password change vulnerability [CWE-620] vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.2, FortiSOAR PaaS 7.5.0 through 7.5.1, FortiSO… |
CVE-2025-59719 | Critical | 9.8 | 2025-12-09 | An improper verification of cryptographic signature vulnerability in Fortinet FortiWeb 8.0.0, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9 may al… |
CVE-2025-59718 | Critical | 9.8 | 2025-12-09 | A improper verification of cryptographic signature vulnerability in Fortinet FortiOS 7.6.0 through 7.6.3, FortiOS 7.4.0 through 7.4.8, FortiOS 7.2.0 through 7… |
CVE-2025-59517 | High | 7.8 | 2025-12-09 | Improper access control in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-59516 | High | 7.8 | 2025-12-09 | Missing authentication for critical function in Windows Storage VSP Driver allows an authorized attacker to elevate privileges locally. |
CVE-2025-57823 | Low | 2.7 | 2025-12-09 | A direct request ('forced browsing') vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator… |
CVE-2025-55233 | High | 7.8 | 2025-12-09 | Out-of-bounds read in Windows Projected File System allows an authorized attacker to elevate privileges locally. |
CVE-2025-54838 | Medium | 6.8 | 2025-12-09 | An Incorrect Authorization vulnerability [CWE-863] in FortiPortal 7.4.0 through 7.4.5 may allow an authenticated attacker to reboot a shared FortiGate device v… |
CVE-2025-54353 | Medium | 5.4 | 2025-12-09 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability [CWE-79] vulnerability in Fortinet FortiSandbox 5.0.0 thr… |
CVE-2025-54100 | High | 7.8 | 2025-12-09 | Improper neutralization of special elements used in a command ('command injection') in Windows PowerShell allows an unauthorized attacker to execute code local… |
CVE-2025-53949 | High | 7.2 | 2025-12-09 | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0… |
CVE-2025-53679 | High | 7.2 | 2025-12-09 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSandbox 5.0… |
CVE-2025-46637 | High | 7.3 | 2025-12-09 | Dell Encryption, versions prior to 11.12.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A local malicious user cou… |
CVE-2025-46636 | Medium | 6.6 | 2025-12-09 | Dell Encryption, versions prior to 11.12.1, contain an Improper Link Resolution Before File Access ('Link Following') vulnerability. A low privileged attacker… |
CVE-2025-34414 | | 2025-12-09 | Entrust Instant Financial Issuance (IFI) On Premise software (formerly referred to as CardWizard) versions 5.x, prior to 6.10.5, and prior to 6.11.1 contain an… | |
CVE-2025-34413 | | 2025-12-09 | Legality WHISTLEBLOWING by DigitalPA contains a protection mechanism failure in which critical HTTP security headers are not emitted by default. Affected deplo… | |
CVE-2025-34409 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the Failed parameter of /Mondo/lang/sys/Forms/MAI/AddRecipie… |
CVE-2025-34408 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the Added parameter of /Mondo/lang/sys/Forms/MAI/AddRecipien… |
CVE-2025-34407 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the theme parameter of /Mondo/lang/sys/Forms/Statistics.aspx… |
CVE-2025-34406 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the Id parameter of /Mobile/ContactDetails.aspx. The Id valu… |
CVE-2025-34404 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the InstanceScope parameter of /Mondo/lang/sys/Forms/CAL/com… |
CVE-2025-34403 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the FieldTo parameter of /Mondo/lang/sys/Forms/AddressBook.a… |
CVE-2025-34402 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the FieldCc parameter of /Mondo/lang/sys/Forms/AddressBook.a… |
CVE-2025-34401 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the FieldBcc parameter of /Mondo/lang/sys/Forms/AddressBook… |
CVE-2025-34400 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the AddressesTo parameter of /Mondo/lang/sys/Forms/AddressBo… |
CVE-2025-34399 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the AddressesCc parameter of /Mondo/lang/sys/Forms/AddressBo… |
CVE-2025-34398 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the AddressesBcc parameter of /Mondo/lang/sys/Forms/AddressB… |
CVE-2025-34397 | Medium | 6.1 | 2025-12-09 | MailEnable versions prior to 10.54 contain a reflected cross-site scripting (XSS) vulnerability in the Message parameter of /Mobile/Compose.aspx. The Message v… |
CVE-2025-34396 | High | 7.3 | 2025-12-09 | MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative e… |
CVE-2025-33214 | High | 8.8 | 2025-12-09 | NVIDIA NVTabular for Linux contains a vulnerability in the Workflow component, where a user could cause a deserialization issue. A successful exploit of this v… |
CVE-2025-33213 | High | 8.8 | 2025-12-09 | NVIDIA Merlin Transformers4Rec for Linux contains a vulnerability in the Trainer component, where a user could cause a deserialization issue. A successful expl… |
CVE-2025-13924 | Medium | 4.3 | 2025-12-09 | The Advanced Product Fields (Product Addons) for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includ… |
CVE-2025-65289 | Medium | 6.1 | 2025-12-09 | A stored Cross site scripting (XSS) vulnerability in the Mercury MR816v2 (081C3114 4.8.7 Build 110427 Rel 36550n) router allows a remote attacker on the LAN to… |
CVE-2025-65288 | Medium | 6.5 | 2025-12-09 | A buffer overflow in the Mercury MR816v2 (081C3114 4.8.7 Build 110427 Rel 36550n) occurs when the device accepts and stores excessively long hostnames from LAN… |
CVE-2025-63742 | Critical | 9.8 | 2025-12-09 | SQL Injection vulnerability in function setwxqyAction in file webmain/task/api/loginAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive… |
CVE-2025-63740 | Medium | 4.3 | 2025-12-09 | SQL Injection vulnerability in function getselectdataAjax in file inputAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers gain sensitive information… |
CVE-2025-63739 | Medium | 4.3 | 2025-12-09 | An issue was discovered in function phpinisaveAction in file webmain/system/cogini/coginiAction.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to authen… |
CVE-2025-63738 | Medium | 4.3 | 2025-12-09 | An issue was discovered in file index.php in Xinhu Rainrock RockOA 2.7.0 allowing attackers to gain sensitive information via phpinfo via the a parameter to th… |
CVE-2025-63737 | Medium | 6.1 | 2025-12-09 | Cross-site scripting (XSS) vulnerability in function urltestAction in file cliAction.php in Xinhu Rainrock RockOA 2.7.0 allows remote attackers to inject arbit… |
CVE-2025-56704 | High | 8.8 | 2025-12-09 | LeptonCMS version 7.3.0 contains an arbitrary file upload vulnerability, which is caused by the lack of proper validation for uploaded files. An authenticated… |
CVE-2025-12946 | High | 7.5 | 2025-12-09 | A vulnerability in the speedtest feature of affected NETGEAR Nighthawk routers, caused by improper input validation, can allow attackers on the router's WAN si… |
CVE-2025-12945 | Low | 2.4 | 2025-12-09 | An improper input validation vulnerability in the NETGEAR Nighthawk R7000P (end of service) routers lets an authenticated administrator with local network acce… |
CVE-2025-12941 | Medium | 5.7 | 2025-12-09 | Denial of Service Vulnerability in NETGEAR C6220 and C6230 (DOCSIS® 3.0 Two-in-one Cable Modem + WiFi Router) allows authenticated local WiFi users reboot the… |
CVE-2025-9638 | Medium | 4.8 | 2025-12-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Portabilis i-Educar allows Stored Cross-Site Scripting (X… |
CVE-2025-9368 | | 2025-12-09 | A security issue exists within 432ES-IG3 Series A, which affects GuardLink® EtherNet/IP Interface, resulting in denial-of-service. A manual power cycle is requ… | |
CVE-2025-6924 | Medium | 5.4 | 2025-12-09 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software e-BAP Automation allows Reflected… |
CVE-2025-6923 | Medium | 5.4 | 2025-12-09 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Talent Software UNIS allows Reflected XSS. This i… |
CVE-2025-67599 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in WebToffee WebToffee eCommerce Marketing Automation decorator-woocommerce-email-customizer allows Exploiting Incorrectly… |
CVE-2025-67598 | Medium | 4.3 | 2025-12-09 | Cross-Site Request Forgery (CSRF) vulnerability in PSM Plugins SupportCandy supportcandy allows Cross Site Request Forgery.This issue affects SupportCandy: fro… |
CVE-2025-67597 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in Shahjahan Jewel Fluent Booking fluent-booking allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-67596 | Medium | 4.3 | 2025-12-09 | Cross-Site Request Forgery (CSRF) vulnerability in Strategy11 Team Business Directory business-directory-plugin allows Cross Site Request Forgery.This issue af… |
CVE-2025-67595 | Medium | 4.3 | 2025-12-09 | Cross-Site Request Forgery (CSRF) vulnerability in Ays Pro Quiz Maker quiz-maker allows Cross Site Request Forgery.This issue affects Quiz Maker: from n/a thro… |
CVE-2025-67594 | Medium | 4.3 | 2025-12-09 | Authorization Bypass Through User-Controlled Key vulnerability in ThimPress Thim Elementor Kit thim-elementor-kit allows Exploiting Incorrectly Configured Acce… |
CVE-2025-67593 | Medium | 4.3 | 2025-12-09 | Cross-Site Request Forgery (CSRF) vulnerability in Stiofan UsersWP userswp allows Cross Site Request Forgery.This issue affects UsersWP: from n/a through <= 1… |
CVE-2025-67592 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in Joe Dolson My Calendar my-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-67591 | Medium | 4.3 | 2025-12-09 | Cross-Site Request Forgery (CSRF) vulnerability in jegtheme JNews Paywall jnews-paywall allows Cross Site Request Forgery.This issue affects JNews Paywall: fro… |
CVE-2025-67590 | Medium | 4.3 | 2025-12-09 | Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Ultimate FAQ ultimate-faqs allows Cross Site Request Forgery.This issue affects Ultimate FAQ: fro… |
CVE-2025-67589 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips woocommerce-pdf-invoices-packing-slips allows Exploiting Incorrect… |
CVE-2025-67588 | Medium | 4.3 | 2025-12-09 | Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-67587 | Medium | 4.7 | 2025-12-09 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks WP Gravity Forms FreshDesk Plugin gf-freshdesk allows Phishing.This issue affect… |
CVE-2025-67586 | Medium | 4.7 | 2025-12-09 | Missing Authorization vulnerability in Ronald Huereca Highlight and Share highlight-and-share allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-67585 | Medium | 4.7 | 2025-12-09 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in flexmls Flexmls® IDX flexmls-idx allows Phishing.This issue affects Flexmls® IDX: from n/a… |
CVE-2025-67584 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in rtCamp GoDAM godam allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GoDAM: fro… |
CVE-2025-67583 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in Foysal Imran IDonate idonate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-67582 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in wbcomdesigns Wbcom Designs lock-my-bp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-67581 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-67580 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in Constant Contact Constant Contact + WooCommerce constant-contact-woocommerce allows Exploiting Incorrectly Configured Ac… |
CVE-2025-67579 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in vanquish User Extra Fields wp-user-extra-fields allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-67578 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in Rhys Wynne WP Email Capture wp-email-capture allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-67577 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in hassantafreshi Easy Form Builder easy-form-builder allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-67576 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in QuantumCloud Simple Link Directory simple-link-directory allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-67575 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in Andrew Lima Sitewide Notice WP sitewide-notice-wp allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-67574 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access C… |
CVE-2025-67573 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in ThimPress Sailing sailing allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sai… |
CVE-2025-67572 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in PenciDesign PenNews pennews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects P… |
CVE-2025-67571 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in WPFunnels WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-67570 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in WesternDeal WPForms Google Sheet Connector gsheetconnector-wpforms allows Exploiting Incorrectly Configured Access Contr… |
CVE-2025-67569 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in scriptsbundle AdForest adforest allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-67568 | Medium | 5.3 | 2025-12-09 | Missing Authorization vulnerability in xtemos Basel basel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Basel: fro… |
CVE-2025-67567 | Medium | 5.3 | 2025-12-09 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in uixthemes Sober sober allows Retrieve Embedded Sensitive Data.This… |