2025 CVEs (page 9)
Page 9 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-59601 | Medium | 6.5 | 2026-06-01 | Information Disclosure when resetting device to factory default settings through powerline interface allows unauthorized access to device configuration. |
CVE-2025-48652 | High | 7.8 | 2026-06-01 | In performPreInstallChecks of InstallRepository.kt, there is a possible way to bypass MDM policy due to a logic error in the code. This could lead to local esc… |
CVE-2025-48649 | High | 7.8 | 2026-06-01 | In multiple locations, there is a possible way to reset user-selected permissions selections due to a permissions bypass. This could lead to local escalation o… |
CVE-2025-48648 | Medium | 5.5 | 2026-06-01 | In isSameApp of NotificationManagerService.java, there is a possible persistent dos due to resource exhaustion. This could lead to local denial of service with… |
CVE-2025-48616 | Low | 3.3 | 2026-06-01 | In multiple functions of KeyguardViewMediator.java , there is a possible way to bypass lockdown mode with screen pinning due to a logic error in the code. This… |
CVE-2025-48595 | High | 8.4 | 2026-06-01 | In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no a… |
CVE-2025-48570 | High | 7.8 | 2026-06-01 | In multiple functions of PipTaskOrganizer.java, there is a possible way to launch an activity from the background due to a confused deputy. This could lead to… |
CVE-2025-32348 | High | 7.8 | 2026-06-01 | In multiple locations, there is a possible background activity launch due to a missing permission check. This could lead to local escalation of privilege with… |
CVE-2025-26418 | High | 7.8 | 2026-06-01 | In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account to a managed device d… |
CVE-2025-22426 | High | 7.8 | 2026-06-01 | In many functions of ComputerEngine.java, there is a possible way to access URIs across users due to a logic error in the code. This could lead to local escala… |
CVE-2025-22424 | High | 7.8 | 2026-06-01 | In multiple locations, there is a possible way to reveal images across users due to improper input validation. This could lead to local escalation of privilege… |
CVE-2025-70099 | High | 7.5 | 2026-06-01 | A NULL pointer dereference in the ext4_dir_en_get_name_len function in include/ext4_dir.h of lwext4 1.0.0 allows attackers to cause a denial of service by supp… |
CVE-2025-60495 | Medium | 5.5 | 2026-06-01 | A segmentation violation in the gf_media_get_color_info function (/media_tools/isom_tools.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a… |
CVE-2025-60486 | Medium | 5.5 | 2026-06-01 | A heap use-after-free in the dasher_process function (/filters/dasher.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial of Service (D… |
CVE-2025-60485 | Medium | 5.5 | 2026-06-01 | A segmentation violation in the gf_isom_apple_set_tag_ex function (/isomedia/isom_write.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a De… |
CVE-2025-60483 | Medium | 5.5 | 2026-06-01 | A NULL pointer dereference in the gf_ac4_pres_b_4_back_channels_present function (/media_tools/av_parsers.c) of GPAC Project/MP4Box before 26.02.0 allows attac… |
CVE-2025-60481 | Medium | 5.5 | 2026-06-01 | A NULL pointer dereference in the gf_odf_ac4_cfg_dsi_v1 function (/odf/descriptors.c) of GPAC Project/MP4Box before 26.02.0 allows attackers to cause a Denial… |
CVE-2025-55664 | Medium | 5.5 | 2026-06-01 | A heap buffer overflow in the m2tsdmx_send_packet function (filters/dmx_m2ts.c) of GPAC MP4Box v2.4 allows attackers to cause a Denial of Service (DoS) via sup… |
CVE-2025-41281 | High | 7.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Waterfall WF-500 RX Hos… |
CVE-2025-41280 | High | 7.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-23: Relative Path Traversal (Zip Slip) in Waterfall WF-500 RX Host in version 7.9.1.0 R2502171040 that allows attackers w… |
CVE-2025-41279 | High | 7.2 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebU… |
CVE-2025-41278 | High | 7.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-125: Out-of-bounds Read in Waterfall WF-500 RX Host in version 7.10.0.0 R2601141040 that allows attackers with access to… |
CVE-2025-41277 | Critical | 9.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Wa… |
CVE-2025-41276 | Critical | 9.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Wa… |
CVE-2025-41275 | Critical | 9.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Wa… |
CVE-2025-41274 | Critical | 9.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Wa… |
CVE-2025-41273 | Critical | 9.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-288: Authentication Bypass Using an Alternate Path or Channel in the Console WebUI in Waterfall WF-500 TX and RX Hosts in… |
CVE-2025-41272 | Critical | 9.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Wa… |
CVE-2025-41271 | High | 7.5 | 2026-05-29 | Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Console WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R2502171040 that… |
CVE-2025-41270 | Critical | 9.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Wa… |
CVE-2025-41269 | Critical | 9.8 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Console WebUI in Wa… |
CVE-2025-41268 | Critical | 9.1 | 2026-05-29 | Nozomi Networks Labs identified a CWE-23: Relative Path Traversal in the Administration WebUI in Waterfall WF-500 TX and RX Hosts in version 7.9.1.0 R250217104… |
CVE-2025-41267 | High | 7.2 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebU… |
CVE-2025-41266 | High | 7.2 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebU… |
CVE-2025-41265 | High | 7.2 | 2026-05-29 | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in the Administration WebU… |
CVE-2025-12714 | Medium | 5.3 | 2026-05-29 | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the up… |
CVE-2025-11262 | High | 7.2 | 2026-05-29 | The Link Whisper Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user_id parameter in all versions up to, and including, 0.9.0 d… |
CVE-2025-14042 | Medium | 6.4 | 2026-05-29 | The Automotive Car Dealership Business WordPress Theme for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Project Details' custom field in Por… |
CVE-2025-11993 | High | 8.8 | 2026-05-29 | The WooCommerce Infinite Scroll and Ajax Pagination plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.8 via th… |
CVE-2025-48977 | Medium | 6.5 | 2026-05-28 | Relative Path Traversal vulnerability in Apache Ignite REST API. Authenticated REST API users can read any file on the server with "cmd=log" command and a log… |
CVE-2025-69600 | High | 7.8 | 2026-05-27 | Command injection in Raynet rvia RayVentory Scan Engine 12.6 Update 8 and previous versions allows adversaries to execute commands via getconfig, upload, inven… |
CVE-2025-67903 | Medium | 5.3 | 2026-05-27 | Northern.tech Mender Client 5 before 5.0.4 allows a Cryptographic signature verification bypass. |
CVE-2025-70116 | Medium | 4.3 | 2026-05-27 | A NULL pointer dereference in GPAC MP4Box: when parsing certain truncated MP4 files, an unknown/invalid stsd entry can result in missing descriptor fields (e.g… |
CVE-2025-68712 | Medium | 5.5 | 2026-05-27 | SpSoft AppLock (com.sp.protector.free) 7.9.40 for Android allows a local attacker with physical access to bypass fingerprint or PIN authentication. Although th… |
CVE-2025-70103 | High | 7.3 | 2026-05-27 | Heap buffer overflow vulnerability in libjxl 0.12.0 via crafted PBM images to the jxl::extras::DecodeImagePNM function in file lib/extras/dec/pnm.cc. |
CVE-2025-71312 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix ntfs_mount_options leak in ntfs_fill_super() In ntfs_fill_super(), the fc->… |
CVE-2025-71311 | High | 8.2 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Initialize new folios before use KMSAN reports an uninitialized value in longes… |
CVE-2025-71309 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix deadlock in ni_read_folio_cmpr Syzbot reported a task hung in ni_readpage_c… |
CVE-2025-71308 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix potential NULL pointer dereference in context cleanup aie_destroy_cont… |
CVE-2025-71307 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix NULL pointer dereference on panthor_fw_unplug This patch removes the MCU… |
CVE-2025-71306 | High | 7.1 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: ima: Fix stack-out-of-bounds in is_bprm_creds_for_exec() KASAN reported a stack-out-of-bo… |
CVE-2025-71305 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: drm/display/dp_mst: Add protection against 0 vcpi When releasing a timeslot there is a sl… |
CVE-2025-71304 | Medium | 5.5 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: smack: /smack/doi: accept previously used values Writing to /smack/doi a value that has e… |
CVE-2025-71303 | Medium | 4.7 | 2026-05-27 | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix race condition when checking rpm_on When autosuspend is triggered, dri… |
CVE-2025-3633 | Medium | 5.4 | 2026-05-27 | IBM Cognos Analytics 11.2.0, 11.2.4, 12.0, and 12.1.0 and IBM Cognos Transformer 11.2.4, 12.0, and 12.1.0 are vulnerable to cross-site scripting (XSS). This vu… |
CVE-2025-0898 | Medium | 6.5 | 2026-05-27 | The Xpro Elementor Addons - Pro plugin for WordPress is vulnerable to Arbitrary File Reading in all versions up to, and including, 1.4.7 via the Draw SVG widge… |
CVE-2025-66593 | Medium | 6.1 | 2026-05-27 | An origin validation error vulnerability in Synology Assistant before 7.0.6-50085 allows local users to write arbitrary files with restricted content and condu… |
CVE-2025-66592 | Medium | 6.1 | 2026-05-27 | An origin validation error vulnerability in Synology Active Backup for Business Agent before 3.1.0-4967 allows local users to write arbitrary files with restri… |
CVE-2025-52747 | High | 7.1 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jthemes Themebox - Digital Products Ecommerce allows Refl… |
CVE-2025-30028 | High | 8.6 | 2026-05-27 | A vulnerability in Active Backup for Business allows unauthorized remote attackers to read arbitrary files. |
CVE-2025-22741 | High | 7.1 | 2026-05-27 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RiceTheme Felan Framework allows Reflected XSS. This iss… |
CVE-2025-14713 | High | 7.5 | 2026-05-27 | An Exposed Dangerous Method or Function vulnerability in Synology C2 Identity Edge Server package in DSM before 1.76.0-0307 allows remote attackers to obtain u… |
CVE-2025-13593 | Medium | 6.1 | 2026-05-27 | Origin validation error vulnerability in Synology ActiveProtect Agent before 1.1.0-0439 allows local users to write arbitrary files with restricted content and… |
CVE-2025-13392 | High | 8.1 | 2026-05-27 | Improper check for unusual or exceptional conditions vulnerability in SSO in Synology DiskStation Manager (DSM) before 7.2.2-72806-5 and 7.3.1-86003-1 (7.2.1-6… |
CVE-2025-13167 | Medium | 5.4 | 2026-05-27 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in contact functionality in Synology Contacts before 1.0.10-… |
CVE-2025-12686 | Critical | 9.8 | 2026-05-27 | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allows remote… |
CVE-2025-10466 | Medium | 5.9 | 2026-05-27 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Safe Access in Synology Safe Access before 1.3.1-0329 all… |
CVE-2025-41670 | High | 7.8 | 2026-05-27 | A local user with low privileges may be able to influence the behavior of a privileged system service by manipulating configuration or application-related file… |
CVE-2025-41669 | High | 8.8 | 2026-05-27 | The Web-based Management allows a remote low privileged Engineer user to install additional APPs on the device downloaded from the PLCnext Store without implem… |
CVE-2025-14481 | Medium | 4.3 | 2026-05-27 | The Yoast SEO plugin for WordPress is vulnerable to Insecure Direct Object References in all versions up to, and including, 26.5. This is due to insufficient a… |
CVE-2025-15649 | Medium | 5.5 | 2026-05-27 | IO::Uncompress::Unzip versions before 2.215 for Perl propagate uncaught exception when parsing zip header with malformed DOS date. _dosToUnixTime() decodes th… |
CVE-2025-46307 | Medium | 5.5 | 2026-05-26 | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data. |
CVE-2025-46284 | High | 7.0 | 2026-05-26 | A race condition was addressed with additional validation. This issue is fixed in macOS Sequoia 15.7, macOS Tahoe 26. An app may be able to gain root privilege… |
CVE-2025-46280 | Medium | 5.5 | 2026-05-26 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Tahoe 26. An app may be able to cause unexpected system termina… |
CVE-2025-43451 | Medium | 5.5 | 2026-05-26 | A permissions issue was addressed by removing the vulnerable code. This issue is fixed in macOS Tahoe 26. An app may be able to access sensitive user data. |
CVE-2025-43306 | High | 7.8 | 2026-05-26 | A logic issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. A malicious app may be able to… |
CVE-2025-43290 | Medium | 5.5 | 2026-05-26 | A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. An app may be abl… |
CVE-2025-43289 | Medium | 5.5 | 2026-05-26 | A logic issue was addressed with improved validation. This issue is fixed in macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26. A malicious app may be able… |
CVE-2025-68711 | Low | 2.4 | 2026-05-26 | AppLockZ App Lock and Fingerprint Lock (applock.passwordfingerprint.applockz) 4.2.11 for Android allows a local attacker with physical access to bypass the PIN… |
CVE-2025-68708 | Low | 2.4 | 2026-05-26 | SailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker with physical access to bypass the PIN lock. The lock is implemented as an… |
CVE-2025-14361 | High | 7.1 | 2026-05-26 | Missing Authorization vulnerability in AA-Team Woocommerce Envato Affiliates allows Accessing Functionality Not Properly Constrained by ACLs. This issue affec… |
CVE-2025-68710 | Low | 2.4 | 2026-05-26 | Easyelife App lock (aka Fingerprint,Applock or locker.app.safe.applocker) 1.9.2 for Android allows a local attacker with physical access to bypass the PIN lock… |
CVE-2025-68709 | Medium | 5.2 | 2026-05-26 | SailingLab AppLock (aka com.alpha.applock) 4.3.8 for Android allows a local attacker to trigger arbitrary JavaScript execution via BrowserMainActivity, which a… |
CVE-2025-33221 | Medium | 4.4 | 2026-05-26 | NVIDIA Display Driver for Windows and Linux contains a vulnerability in the kernel driver, where a user could cause an incorrect permission assignment for a cr… |
CVE-2025-36221 | Medium | 5.3 | 2026-05-26 | IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through Interim Fix 002 IBM Cloud Pak for Data System uses default passwords default passwords from the manuf… |
CVE-2025-36220 | Medium | 4.3 | 2026-05-26 | IBM Cloud Pak for Data System - Cyclops 11.3.0.2 through Interim Fix 002 IBM Cloud Pak for Data System is vulnerable to SQL injection. A remote attacker could… |
CVE-2025-36148 | Medium | 5.4 | 2026-05-26 | IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.15 IBM Financial Transaction Manager SWIFT is vulnerable to cross… |
CVE-2025-36145 | Medium | 5.4 | 2026-05-26 | IBM watsonx.data 2.2 through 2.3.1 IBM Lakehouse does not properly restrict inbound and outbound connections which could allow an attacker to transfer or modif… |
CVE-2025-36126 | Medium | 6.4 | 2026-05-26 | IBM Cognos Analytics 11.2.0, 12.0, and 12.1.0 and IBM Cognos Transformer 12.0, 11.2.4, and 12.1.0 is vulnerable to stored cross-site scripting (XSS) in Cognos… |
CVE-2025-14290 | Medium | 5.4 | 2026-05-26 | IBM webMethods Integration (on prem) -Integration Server 10.15 through IS_10.15_Core_Fix2611.1 to IS_11.1_Core_Fix10 IBM webMethods Integration is vulnerable t… |
CVE-2025-13755 | Medium | 5.5 | 2026-05-26 | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 for Linux, UNIX and Windows (includes DB2 Connect Server) stores potentially sensitive information in… |
CVE-2025-11482 | High | 7.5 | 2026-05-26 | An Allocation of Resources Without Limits or Throttling vulnerability in the OPC-UA Server used in PPT30 Operating System versions before 1.8.0 may be used by… |
CVE-2025-71310 | | 2026-05-26 | The GDPR cookies module for Backdrop CMS (before 1.x-1.3.5) doesn't sufficiently protect visitors from Cross Site Scripting (XSS) if a malicious value has be… | |
CVE-2025-62745 | Medium | 6.5 | 2026-05-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PickPlugins Team Showcase allows Stored XSS. This issue… |
CVE-2025-46371 | Low | 3.6 | 2026-05-22 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the ssh. A low privileged attacker w… |
CVE-2025-45145 | High | 7.5 | 2026-05-22 | Directory traversal in Follett Software's Destiny Library Manager 22_0_2_rc1 and fixed in v.22.5 AU1 allows remote attackers to read arbitrary system and appli… |
CVE-2025-32751 | Medium | 5.5 | 2026-05-22 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. A low privileged attacker with local access… |
CVE-2025-32749 | Medium | 5.3 | 2026-05-22 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Exposure of Information Through Directory Listing vulnerability. An unauthenticated attacker with rem… |
CVE-2025-32747 | Medium | 5.3 | 2026-05-22 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access could poten… |
CVE-2025-32746 | Medium | 4.0 | 2026-05-22 | Dell PowerFlex Manager, version(s) <=4.6.2, contain(s) an Insecure Storage of Sensitive Information vulnerability. An unauthenticated attacker with local acces… |