2025 CVEs (page 90)
Page 90 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-12996 | Medium | 4.1 | 2025-12-04 | Medtronic CareLink Network allows a local attacker with access to log files on an internal API server to view plaintext passwords from errors logged under cert… |
CVE-2025-12995 | High | 8.1 | 2025-12-04 | Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used to determine a valid… |
CVE-2025-12994 | Medium | 5.3 | 2025-12-04 | Medtronic CareLink Network allows an unauthenticated remote attacker to initiate a request for security questions to an API endpoint that could be used to dete… |
CVE-2025-12097 | High | 7.5 | 2025-12-04 | There is a relative path traversal vulnerability in the NI System Web Server that may result in information disclosure. Successful exploitation requires an at… |
CVE-2025-65945 | High | 7.5 | 2025-12-04 | auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature ve… |
CVE-2025-65637 | High | 7.5 | 2025-12-04 | A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline… |
CVE-2025-63362 | Critical | 9.8 | 2025-12-04 | Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 allows attackers to set the A… |
CVE-2025-63361 | Medium | 5.7 | 2025-12-04 | Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovered to render the… |
CVE-2025-59788 | Medium | 6.4 | 2025-12-04 | Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28… |
CVE-2025-14016 | Medium | 5.4 | 2025-12-04 | A security vulnerability has been detected in macrozheng mall-swarm up to 1.0.3. Affected is the function delete of the file /member/readHistory/delete. Such m… |
CVE-2025-14015 | High | 8.8 | 2025-12-04 | A weakness has been identified in H3C Magic B0 up to 100R002. This impacts the function EditWlanMacList of the file /goform/aspForm. This manipulation of the a… |
CVE-2025-14013 | Low | 2.4 | 2025-12-04 | A vulnerability was identified in JIZHICMS up to 2.5.5. The impacted element is an unknown function of the file /index.php/admins/Comment/addcomment.html of th… |
CVE-2025-13488 | | 2025-12-04 | Due to a regression introduced in version 3.83.0, a security header is no longer applied to certain user-uploaded content served from repositories. This may al… | |
CVE-2025-9127 | Medium | 5.5 | 2025-12-04 | A vulnerability exists in PX Enterprise whereby sensitive information may be logged under specific conditions. |
CVE-2025-63363 | High | 7.5 | 2025-12-04 | A lack of Management Frame Protection in Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07… |
CVE-2025-14012 | Medium | 4.7 | 2025-12-04 | A vulnerability was determined in JIZHICMS up to 2.5.5. The affected element is the function deleteAll/findAll/delete of the file /index.php/admins/Comment/del… |
CVE-2025-14011 | Medium | 4.7 | 2025-12-04 | A vulnerability was found in JIZHICMS up to 2.5.5. Impacted is the function commentlist of the file /index.php/admins/Comment/addcomment.html of the component… |
CVE-2025-66516 | High | 8.4 | 2025-12-04 | Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to… |
CVE-2025-66373 | Medium | 4.8 | 2025-12-04 | Akamai Ghost on Akamai CDN edge servers before 2025-11-17 has a chunked request body processing error that can result in HTTP request smuggling. When Akamai Gh… |
CVE-2025-66287 | High | 8.8 | 2025-12-04 | A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling. |
CVE-2025-63364 | High | 7.5 | 2025-12-04 | Waveshare RS232/485 TO WIFI ETH (B) Serial to Ethernet/Wi-Fi Gateway Firmware V3.1.1.0: HW 4.3.2.1: Webpage V7.04T.07.002880.0301 was discovered to transmit Ad… |
CVE-2025-8074 | Medium | 5.6 | 2025-12-04 | Origin validation error vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.3-13973 allows local users to write arbitrary files with non-sens… |
CVE-2025-65516 | Medium | 6.1 | 2025-12-04 | A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12. When Seafile is configured with the Gol… |
CVE-2025-63681 | Medium | 4.3 | 2025-12-04 | open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, en… |
CVE-2025-61148 | Medium | 6.5 | 2025-12-04 | An Insecure Direct Object Reference (IDOR) vulnerability in the EduplusCampus 3.0.1 Student Payment API allows authenticated users to access other students per… |
CVE-2025-57213 | High | 7.5 | 2025-12-04 | Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensitive information via a crafted request. |
CVE-2025-57212 | High | 7.5 | 2025-12-04 | Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive information via a crafted request. |
CVE-2025-57210 | High | 7.5 | 2025-12-04 | Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive information via unspecified vectors. |
CVE-2025-56427 | High | 7.5 | 2025-12-04 | Directory Traversal vulnerability in ComposioHQ v.0.7.20 allows a remote attacker to obtain sensitive information via the _download_file_or_dir function. |
CVE-2025-54160 | High | 7.8 | 2025-12-04 | Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 al… |
CVE-2025-54159 | High | 7.5 | 2025-12-04 | Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attackers to delete arbitrary files via unspe… |
CVE-2025-54158 | High | 7.8 | 2025-12-04 | Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitr… |
CVE-2025-40266 | High | 8.2 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Check the untrusted offset in FF-A memory share Verify the offset to prevent… |
CVE-2025-40265 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: vfat: fix missing sb_min_blocksize() return value checks When emulating an nvme device on… | |
CVE-2025-40264 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: be2net: pass wrb_params in case of OS2BMC be_insert_vlan_in_pkt() is called with the wrb_… | |
CVE-2025-40263 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: Input: cros_ec_keyb - fix an invalid memory access If cros_ec_keyb_register_matrix() isn'… | |
CVE-2025-40262 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: Input: imx_sc_key - fix memory corruption on unload This is supposed to be "priv" but we… |
CVE-2025-40261 | Critical | 9.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() nvme_fc_delete_a… |
CVE-2025-40260 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix scx_enable() crash on helper kthread creation failure A crash was observed… | |
CVE-2025-40259 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Do not sleep in atomic context sg_finish_rem_req() calls blk_rq_unmap_user(). T… | |
CVE-2025-40258 | Critical | 9.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptc… |
CVE-2025-40257 | Critical | 9.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix a race in mptcp_pm_del_add_timer() mptcp_pm_del_add_timer() can call sk_stop_t… |
CVE-2025-40256 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added … | |
CVE-2025-40255 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() The ethtool tsconfig Netl… | |
CVE-2025-40254 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: remove never-working support for setting nsh fields The validation of t… | |
CVE-2025-40253 | High | 8.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Fix double-kfree The function 'mpc_rcvd_sweep_req(mpcginfo)' is called conditi… |
CVE-2025-40252 | Critical | 9.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() … |
CVE-2025-40251 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy The function devl_rate_nod… |
CVE-2025-40250 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Clean up only new IRQ glue on request_irq() failure The mlx5_irq_alloc() functi… |
CVE-2025-40249 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: make sure the cdev fd is still active before emitting events With the final c… |
CVE-2025-40248 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During connect(), acting… |
CVE-2025-40247 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix pgtable prealloc error path The following splat was reported: Unable to… | |
CVE-2025-40246 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix out of bounds memory read error in symlink repair xfs/286 produced this report o… | |
CVE-2025-40245 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: nios2: ensure that memblock.current_limit is set when setting pfn limits On nios2, with C… |
CVE-2025-40244 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() The syzbot reported… |
CVE-2025-40243 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() The syzbot reported issue i… |
CVE-2025-40242 | High | 7.0 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix unlikely race in gdlm_put_lock In gdlm_put_lock(), there is a small window of t… |
CVE-2025-40241 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: erofs: fix crafted invalid cases for encoded extents Robert recently reported two corrupt… |
CVE-2025-40240 | High | 7.5 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: sctp: avoid NULL dereference when chunk data buffer is missing chunk->skb pointer is dere… |
CVE-2025-40239 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: net: phy: micrel: always set shared->phydev for LAN8814 Currently, during the LAN8814 PTP… | |
CVE-2025-40238 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix IPsec cleanup over MPV device When we do mlx5e_detach_netdev() we eventuall… | |
CVE-2025-40237 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: fs/notify: call exportfs_encode_fid with s_umount Calling intotify_show_fdinfo() on fd wa… | |
CVE-2025-40236 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: virtio-net: zero unused hash fields When GSO tunnel is negotiated virtio_net_hdr_tnl_from… | |
CVE-2025-40235 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() If fs_in… | |
CVE-2025-40234 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: alienware-wmi-wmax: Fix NULL pointer dereference in sleep handlers Devices… | |
CVE-2025-40233 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: clear extent cache after moving/defragmenting extents The extent map cache can bec… |
CVE-2025-40232 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: rv: Fully convert enabled_monitors to use list_head as iterator The callbacks in enabled_… | |
CVE-2025-40231 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: vsock: fix lock inversion in vsock_assign_transport() Syzbot reported a potential lock in… | |
CVE-2025-40230 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: mm: prevent poison consumption when splitting THP When performing memory error injection… | |
CVE-2025-40229 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: fix potential memory leak by cleaning ops_filter in damon_destroy_scheme C… | |
CVE-2025-40228 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: catch commit test ctx alloc failure Patch series "mm/damon/sysfs: fix com… | |
CVE-2025-40227 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: dealloc commit test ctx always The damon_ctx for testing online DAMON par… | |
CVE-2025-40226 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Account for failed debug initialization When the SCMI debug subsystem… | |
CVE-2025-40225 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix kernel panic on partial unmap of a GPU VA region This commit address a k… | |
CVE-2025-40224 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (cgbc-hwmon) Add missing NULL check after devm_kzalloc() The driver allocates memo… | |
CVE-2025-40223 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: most: usb: Fix use-after-free in hdm_disconnect hdm_disconnect() calls most_deregister_in… | |
CVE-2025-40222 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: tty: serial: sh-sci: fix RSCI FIFO overrun handling The receive error handling code is sh… | |
CVE-2025-65346 | Critical | 9.1 | 2025-12-04 | alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to b… |
CVE-2025-54307 | High | 8.8 | 2025-12-04 | An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. The /configure/plugins/plugin/upload/zip/ and /configure/newupdates/offli… |
CVE-2025-54306 | High | 7.2 | 2025-12-04 | An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. A remote code execution vulnerability exists in the network configuration… |
CVE-2025-54305 | High | 7.8 | 2025-12-04 | An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. One of the middlewares included in this application, LocalhostAuthMiddlew… |
CVE-2025-54304 | Critical | 9.8 | 2025-12-04 | An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. When they are powered on, an X11 display server is started. The display ser… |
CVE-2025-54303 | Critical | 9.8 | 2025-12-04 | The Thermo Fisher Torrent Suite Django application 5.18.1 has weak default credentials, which are stored as fixtures for the Django ORM API. The ionadmin user… |
CVE-2025-53963 | Critical | 9.8 | 2025-12-04 | An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. They run an SSH server accessible over the default port 22. The root accoun… |
CVE-2025-40221 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: media: pci: mg4b: fix uninitialized iio scan data Fix potential leak of uninitialized sta… | |
CVE-2025-40220 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: fuse: fix livelock in synchronous file put from fuseblk workers I observed a hang when ru… | |
CVE-2025-40219 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Fix race between SR-IOV enable/disable and hotplug Commit 05703271c3cd ("PCI/IOV… | |
CVE-2025-40218 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success DAMON's virtual address… | |
CVE-2025-40217 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: pidfs: validate extensible ioctls Validate extensible ioctls stricter than we do now. | |
CVE-2025-40216 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: don't rely on user vaddr alignment There is no guaranteed alignment for us… |
CVE-2025-2848 | Medium | 6.3 | 2025-12-04 | A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings, and disable some non-critical functions. |
CVE-2025-29846 | High | 7.2 | 2025-12-04 | A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages. |
CVE-2025-29845 | Medium | 4.3 | 2025-12-04 | A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files. |
CVE-2025-29844 | Medium | 4.3 | 2025-12-04 | A vulnerability in FileStation file cgi allows remote authenticated users to read file metadata and path information. |
CVE-2025-29843 | Medium | 5.4 | 2025-12-04 | A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files. |
CVE-2025-14008 | Medium | 4.7 | 2025-12-04 | A flaw has been found in dayrui XunRuiCMS up to 4.7.1. This vulnerability affects unknown code of the file admin79f2ec220c7e.php?c=api&m=test_site_domain of th… |
CVE-2025-14007 | Low | 2.0 | 2025-12-04 | A vulnerability was detected in dayrui XunRuiCMS up to 4.7.1. This affects an unknown part of the file /admin79f2ec220c7e.php?c=api&m=demo&name=mobile of the c… |
CVE-2025-14006 | Low | 3.5 | 2025-12-04 | A security vulnerability has been detected in dayrui XunRuiCMS up to 4.7.1. Affected by this issue is some unknown functionality of the file /admind45f74adbd95… |
CVE-2025-14005 | Low | 2.4 | 2025-12-04 | A weakness has been identified in dayrui XunRuiCMS up to 4.7.1. Affected by this vulnerability is an unknown functionality of the file /admind45f74adbd95.php?c… |
CVE-2025-14004 | Medium | 4.7 | 2025-12-04 | A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.1. Affected is an unknown function of the file /admind45f74adbd95.php?c=email&m=add of the co… |