2025 CVEs (page 87)
Page 87 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-64499 | Medium | 4.6 | 2025-12-08 | Tuleap is a free and open source suite for management of software development and collaboration. Tuleap Community Editon versions prior to 17.0.99.1762456922 a… |
CVE-2025-64498 | Medium | 4.6 | 2025-12-08 | Tuleap is an Open Source Suite for management of software development and collaboration. Tuleap Community Edition versions below 17.0.99.1762444754 and Tuleap… |
CVE-2025-64497 | Medium | 6.5 | 2025-12-08 | Tuleap is an Open Source Suite for management of software development and collaboration. Versions below 17.0.99.1762431347 of Tuleap Community Edition and Tul… |
CVE-2025-36140 | Medium | 6.5 | 2025-12-08 | IBM watsonx.data 2.2 through 2.2.1 could allow an authenticated user to cause a denial of service through ingestion pods due to improper allocation of resource… |
CVE-2025-64650 | Medium | 6.5 | 2025-12-08 | IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.18 could disclose sensitive user credentials in log files. |
CVE-2025-62408 | Medium | 5.9 | 2025-12-08 | c-ares is an asynchronous resolver library. Versions 1.32.3 through 1.34.5 terminate a query after maximum attempts when using read_answer() and process_answe… |
CVE-2025-36102 | Low | 2.7 | 2025-12-08 | IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow a privileged user to bypass validation, passing user input… |
CVE-2025-36017 | Medium | 6.5 | 2025-12-08 | IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 stores unencrypted sensitive information in environmental variables fi… |
CVE-2025-36015 | Medium | 6.5 | 2025-12-08 | IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 could allow an authenticated user to cause a denial of service due to… |
CVE-2025-33111 | Medium | 4.3 | 2025-12-08 | IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 is vulnerable to creation of temporary files without atomic operations… |
CVE-2025-14276 | Medium | 5.6 | 2025-12-08 | A vulnerability was determined in Ilevia EVE X1 Server up to 4.6.5.0.eden. Impacted is an unknown function of the file /ajax/php/leaf_search.php. This manipula… |
CVE-2025-12832 | Medium | 4.6 | 2025-12-08 | IBM InfoSphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to se… |
CVE-2025-12635 | Medium | 5.4 | 2025-12-08 | IBM WebSphere Application Server 8.5, 9.0 and IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.12 are affected by cross-site scripting due to i… |
CVE-2025-65228 | Low | 3.5 | 2025-12-08 | A stored cross-site scripting vulnerability exists in the web management interface of the R.V.R. Elettronica TLK302T telemetry controller (firmware 1.5.1799). |
CVE-2025-65230 | Medium | 5.4 | 2025-12-08 | Barix Instreamer v04.06 and v04.05 contains a stored cross-site scripting (XSS) vulnerability in the Web UI Configuration Streaming Destination input. |
CVE-2025-65229 | Medium | 4.6 | 2025-12-08 | A stored cross-site scripting (XSS) vulnerability exists in the web interface of Lyrion Music Server <= 9.0.3. An authenticated user with access to Settings Pl… |
CVE-2025-65849 | Critical | 9.1 | 2025-12-08 | A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constan… |
CVE-2025-65548 | Critical | 9.1 | 2025-12-08 | NUT-14 allows cashu tokens to be created with a preimage hash. However, nutshell (cashubtc/nuts) before 0.18.0 do not validate the size of preimage when the to… |
CVE-2025-65271 | High | 8.8 | 2025-12-08 | Client-side template injection (CSTI) in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an admini… |
CVE-2025-65231 | Medium | 6.1 | 2025-12-08 | Barix Instreamer v04.06 and earlier is vulnerable to Cross Site Scripting (XSS) in the Web UI I/O & Serial configuration page, specifically the CTS close comma… |
CVE-2025-14261 | High | 7.1 | 2025-12-08 | The Litmus platform uses JWT for authentication and authorization, but the secret being used for signing the JWT is only 6 bytes long at its core, which makes… |
CVE-2025-65804 | Medium | 6.5 | 2025-12-08 | Tenda AX3 v16.03.12.11 contains a stack overflow in formSetIptv via the iptvType parameter, which can cause memory corruption and enable remote code execution… |
CVE-2025-64081 | Critical | 9.8 | 2025-12-08 | SQL injection vulnerability in /php/api_patient_schedule.php in SourceCodester Patients Waiting Area Queue Management System v1 allows attackers to execute arb… |
CVE-2025-48625 | High | 7.0 | 2025-12-08 | In multiple locations of UsbDataAdvancedProtectionHook.java, there is a possible way to access USB data when the screen is off due to a race condition. This co… |
CVE-2025-48608 | Medium | 5.5 | 2025-12-08 | In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check. This could lead to local information… |
CVE-2025-48606 | High | 7.8 | 2025-12-08 | In preparePackage of InstallPackageHelper.java, there is a possible way for an app to appear hidden upon installation without a mechanism to uninstall it due t… |
CVE-2025-48569 | Medium | 5.5 | 2025-12-08 | In multiple locations, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of service with no additiona… |
CVE-2025-14259 | Medium | 6.3 | 2025-12-08 | A vulnerability was found in Jihai Jshop MiniProgram Mall System 2.9.0. Affected by this issue is some unknown functionality of the file /index.php/api.html. T… |
CVE-2025-14258 | High | 7.3 | 2025-12-08 | A vulnerability has been found in itsourcecode Student Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /newsubjec… |
CVE-2025-65799 | Medium | 4.3 | 2025-12-08 | A lack of file name validation or verification in the Attachment service of usememos memos v0.25.2 allows attackers to execute a path traversal. |
CVE-2025-65797 | Medium | 6.5 | 2025-12-08 | Incorrect access control in the Identity Provider service of usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete… |
CVE-2025-65795 | High | 7.5 | 2025-12-08 | Incorrect access control in the /api/v1/user endpoint of usememos memos v0.25.2 allows unauthorized attackers to create arbitrary accounts via a crafted reques… |
CVE-2025-65363 | High | 7.2 | 2025-12-08 | Authenticated append-style command-injection Ruijie APs (AP_RGOS 11.1.x) allows an authenticated web user to execute appended shell expressions as root, enabli… |
CVE-2025-63721 | High | 8.8 | 2025-12-08 | HummerRisk thru v1.5.0 is using a vulnerable Snakeyaml component, allowing attackers with normal user privileges to hit the /rule/add API and thereby achieve R… |
CVE-2025-59391 | Medium | 6.5 | 2025-12-08 | A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when… |
CVE-2025-48639 | High | 7.3 | 2025-12-08 | In DefaultTransitionHandler.java, there is a possible way to unknowingly grant permissions to an app due to a tapjacking/overlay attack. This could lead to loc… |
CVE-2025-48638 | High | 7.8 | 2025-12-08 | In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege w… |
CVE-2025-48637 | High | 7.8 | 2025-12-08 | In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege wi… |
CVE-2025-48633 | Medium | 5.5 | 2025-12-08 | In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code… |
CVE-2025-48632 | High | 7.8 | 2025-12-08 | In setDisplayName of AssociationRequest.java, there is a possible way to cause CDM associations to persist after the user has disassociated them due to imprope… |
CVE-2025-48631 | Medium | 6.5 | 2025-12-08 | In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to remote denial of… |
CVE-2025-48629 | High | 7.8 | 2025-12-08 | In findAvailRecognizer of VoiceInteractionManagerService.java, there is a possible way to become the default speech recognizer app due to an insecure default v… |
CVE-2025-48628 | High | 7.8 | 2025-12-08 | In validateIconUserBoundary of PrintManagerService.java, there is a possible cross-user image leak due to a confused deputy. This could lead to local escalatio… |
CVE-2025-48627 | High | 7.8 | 2025-12-08 | In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to launch an activity from the background due to a logic error in the… |
CVE-2025-48626 | Critical | 9.8 | 2025-12-08 | In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure. This could lead to remote esca… |
CVE-2025-48624 | High | 7.8 | 2025-12-08 | In multiple functions of arm-smmu-v3.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privil… |
CVE-2025-48623 | High | 7.8 | 2025-12-08 | In init_pkvm_hyp_vcpu of pkvm.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege wit… |
CVE-2025-48622 | Medium | 5.5 | 2025-12-08 | In ProcessArea of dng_misc_opcodes.cpp, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with n… |
CVE-2025-48621 | High | 7.3 | 2025-12-08 | In DefaultTransitionHandler.java, there is a possible way to enable a tapjacking attack due to a insecure default. This could lead to local escalation of privi… |
CVE-2025-48620 | High | 7.8 | 2025-12-08 | In onSomePackagesChanged of VoiceInteractionManagerService.java, there is a possible way for a third party application's component name to persist even after u… |
CVE-2025-48618 | Medium | 6.8 | 2025-12-08 | In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. This could lead to p… |
CVE-2025-48615 | High | 7.8 | 2025-12-08 | In getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence due to resource exhaustion. This could lead to local escalatio… |
CVE-2025-48614 | Medium | 4.6 | 2025-12-08 | In rebootWipeUserData of RecoverySystem.java, there is a possible way to factory reset the device while in DSU mode due to a missing permission check. This cou… |
CVE-2025-48612 | High | 7.8 | 2025-12-08 | In setDefaultKey of DefaultPaymentSettings.java, there is a possible way for an application to set the main user's default NFC payment setting due to improper… |
CVE-2025-48610 | Medium | 5.5 | 2025-12-08 | In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible configuration data leak due to a logic error in the code. This could lead to local inf… |
CVE-2025-48607 | Medium | 5.5 | 2025-12-08 | In multiple locations, there is a possible way to create a large amount of app ops due to a logic error in the code. This could lead to local denial of service… |
CVE-2025-48604 | Medium | 5.5 | 2025-12-08 | In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosu… |
CVE-2025-48603 | Medium | 5.5 | 2025-12-08 | In InputMethodInfo of InputMethodInfo.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of serv… |
CVE-2025-48601 | Medium | 5.5 | 2025-12-08 | In multiple locations, there is a possible permanent denial of service due to improper input validation. This could lead to local escalation of privilege with… |
CVE-2025-48600 | Medium | 5.5 | 2025-12-08 | In multiple files, there is a possible way to reveal information across users due to a missing permission check. This could lead to local information disclosur… |
CVE-2025-48599 | High | 7.8 | 2025-12-08 | In multiple functions of WifiScanModeActivity.java, there is a possible way to bypass a device config restriction due to a missing permission check. This could… |
CVE-2025-48598 | Medium | 6.6 | 2025-12-08 | In multiple locations, there is a possible way to alter the primary user's face unlock settings due to a confused deputy. This could lead to physical escalatio… |
CVE-2025-48597 | High | 7.8 | 2025-12-08 | In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalat… |
CVE-2025-48596 | High | 7.8 | 2025-12-08 | In appendFrom of Parcel.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no add… |
CVE-2025-48594 | High | 7.3 | 2025-12-08 | In onUidImportance of DisassociationProcessor.java, there is a possible way to retain companion application privileges after disassociation due to improper inp… |
CVE-2025-48592 | High | 7.5 | 2025-12-08 | In initDecoder of C2SoftDav1dDec.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure wi… |
CVE-2025-48591 | Medium | 5.5 | 2025-12-08 | In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosu… |
CVE-2025-48590 | Medium | 5.5 | 2025-12-08 | In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances d… |
CVE-2025-48589 | High | 7.8 | 2025-12-08 | In multiple functions of HeaderPrivacyIconsController.kt, there is a possible way to grand permissions across user due to a logic error in the code. This coul… |
CVE-2025-48588 | High | 7.8 | 2025-12-08 | In startAlwaysOnVpn of Vpn.java, there is a possible way to disable always-on VPN due to a logic error in the code. This could lead to local escalation of priv… |
CVE-2025-48586 | High | 7.8 | 2025-12-08 | In onActivityResult of EditFdnContactScreen.java, there is a possible way to leak contacts from the work profile due to a confused deputy. This could lead to l… |
CVE-2025-48584 | Medium | 5.5 | 2025-12-08 | In multiple functions of NotificationManagerService.java, there is a possible way to bypass the per-package channel limits causing resource exhaustion. This co… |
CVE-2025-48583 | High | 7.8 | 2025-12-08 | In multiple functions of BaseBundle.java, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalati… |
CVE-2025-48580 | High | 7.8 | 2025-12-08 | In connectInternal of MediaBrowser.java, there is a possible way to access while in use permission while the app is in background due to a logic error in the c… |
CVE-2025-48576 | Medium | 5.5 | 2025-12-08 | In updateNotificationChannelGroupFromPrivilegedListener of NotificationManagerService.java, there is a possible permanent denial of service due to resource exh… |
CVE-2025-48575 | High | 7.8 | 2025-12-08 | In multiple functions of CertInstaller.java, there is a possible way to install certificates due to a permissions bypass. This could lead to local escalation o… |
CVE-2025-48573 | High | 7.8 | 2025-12-08 | In sendCommand of MediaSessionRecord.java, there is a possible way to launch the foreground service while the app is in the background due to FGS while-in-use… |
CVE-2025-48572 | High | 7.8 | 2025-12-08 | In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of pri… |
CVE-2025-48566 | High | 7.8 | 2025-12-08 | In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional exec… |
CVE-2025-48565 | High | 7.8 | 2025-12-08 | In multiple locations, there is a possible way to bypass the cross profile intent filter due to a logic error in the code. This could lead to local escalation… |
CVE-2025-48564 | High | 7.0 | 2025-12-08 | In multiple locations, there is a possible intent filter bypass due to a race condition. This could lead to local escalation of privilege with no additional ex… |
CVE-2025-48555 | High | 7.8 | 2025-12-08 | In multiple functions of NotificationStation.java, there is a possible cross-profile information disclosure due to a confused deputy. This could lead to local… |
CVE-2025-48536 | High | 7.8 | 2025-12-08 | In grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for a third party app to modify secure settings due to a confused… |
CVE-2025-48525 | High | 7.8 | 2025-12-08 | In disassociate of DisassociationProcessor.java, there is a possible way for an app to continue reading notifications when not associated to a companion device… |
CVE-2025-32329 | High | 7.8 | 2025-12-08 | In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic error in the code. Thi… |
CVE-2025-32328 | High | 7.8 | 2025-12-08 | In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic error in the code. Thi… |
CVE-2025-32319 | Medium | 6.7 | 2025-12-08 | In ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions due to a permissions bypass. This could… |
CVE-2025-22432 | Medium | 6.7 | 2025-12-08 | In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input validation. This could lead to local escalat… |
CVE-2025-22420 | High | 7.8 | 2025-12-08 | In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy. This could lead to local escalation of privil… |
CVE-2025-14257 | High | 7.3 | 2025-12-08 | A flaw has been found in itsourcecode Student Management System 1.0. Affected is an unknown function of the file /newrecord.php. Executing manipulation of the… |
CVE-2025-14256 | High | 7.3 | 2025-12-08 | A vulnerability was detected in itsourcecode Student Management System 1.0. This impacts an unknown function of the file /newcurriculm.php. Performing manipula… |
CVE-2025-65798 | Medium | 5.4 | 2025-12-08 | Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily modify or delete attachments made by other users. |
CVE-2025-65796 | Medium | 4.3 | 2025-12-08 | Incorrect access control in usememos memos v0.25.2 allows attackers with low-level privileges to arbitrarily delete reactions made to other users' Memos. |
CVE-2025-61318 | Critical | 9.1 | 2025-12-08 | Emlog Pro 2.5.20 has an arbitrary file deletion vulnerability. This vulnerability stems from the admin/template.php component and the admin/plugin.php componen… |
CVE-2025-14251 | High | 7.3 | 2025-12-08 | A security vulnerability has been detected in code-projects Online Ordering System 1.0. This affects an unknown function of the file /admin/ of the component A… |
CVE-2025-14250 | High | 7.3 | 2025-12-08 | A weakness has been identified in code-projects Online Ordering System 1.0. The impacted element is an unknown function of the file /user_contact.php. This man… |
CVE-2025-60912 | Low | 3.3 | 2025-12-08 | phpIPAM v1.7.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the database export functionality. The generate-mysql.php function, located in the… |
CVE-2025-14249 | High | 7.3 | 2025-12-08 | A security flaw has been discovered in code-projects Online Ordering System 1.0. The affected element is an unknown function of the file /user_school.php. The… |
CVE-2025-14248 | High | 7.3 | 2025-12-08 | A vulnerability was identified in code-projects Simple Shopping Cart 1.0. Impacted is an unknown function of the file /adminlogin.php. The manipulation of the… |
CVE-2025-14247 | Medium | 6.3 | 2025-12-08 | A vulnerability was determined in code-projects Simple Shopping Cart 1.0. This issue affects some unknown processing of the file /Admin/additems.php. Executing… |