2025 CVEs (page 92)
Page 92 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-40264 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: be2net: pass wrb_params in case of OS2BMC be_insert_vlan_in_pkt() is called with the wrb_… | |
CVE-2025-40263 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: Input: cros_ec_keyb - fix an invalid memory access If cros_ec_keyb_register_matrix() isn'… | |
CVE-2025-40262 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: Input: imx_sc_key - fix memory corruption on unload This is supposed to be "priv" but we… |
CVE-2025-40261 | Critical | 9.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() nvme_fc_delete_a… |
CVE-2025-40260 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix scx_enable() crash on helper kthread creation failure A crash was observed… | |
CVE-2025-40259 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: scsi: sg: Do not sleep in atomic context sg_finish_rem_req() calls blk_rq_unmap_user(). T… | |
CVE-2025-40258 | Critical | 9.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix race condition in mptcp_schedule_work() syzbot reported use-after-free in mptc… |
CVE-2025-40257 | Critical | 9.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: mptcp: fix a race in mptcp_pm_del_add_timer() mptcp_pm_del_add_timer() can call sk_stop_t… |
CVE-2025-40256 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added … | |
CVE-2025-40255 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: net: core: prevent NULL deref in generic_hwtstamp_ioctl_lower() The ethtool tsconfig Netl… | |
CVE-2025-40254 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: remove never-working support for setting nsh fields The validation of t… | |
CVE-2025-40253 | High | 8.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: s390/ctcm: Fix double-kfree The function 'mpc_rcvd_sweep_req(mpcginfo)' is called conditi… |
CVE-2025-40252 | Critical | 9.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: net: qlogic/qede: fix potential out-of-bounds read in qede_tpa_cont() and qede_tpa_end() … |
CVE-2025-40251 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy The function devl_rate_nod… |
CVE-2025-40250 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Clean up only new IRQ glue on request_irq() failure The mlx5_irq_alloc() functi… |
CVE-2025-40249 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: make sure the cdev fd is still active before emitting events With the final c… |
CVE-2025-40248 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: vsock: Ignore signal/timeout on connect() if already established During connect(), acting… |
CVE-2025-40247 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix pgtable prealloc error path The following splat was reported: Unable to… | |
CVE-2025-40246 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: xfs: fix out of bounds memory read error in symlink repair xfs/286 produced this report o… | |
CVE-2025-40245 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: nios2: ensure that memblock.current_limit is set when setting pfn limits On nios2, with C… |
CVE-2025-40244 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix KMSAN uninit-value issue in __hfsplus_ext_cache_extent() The syzbot reported… |
CVE-2025-40243 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: hfs: fix KMSAN uninit-value issue in hfs_find_set_zero_bits() The syzbot reported issue i… |
CVE-2025-40242 | High | 7.0 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix unlikely race in gdlm_put_lock In gdlm_put_lock(), there is a small window of t… |
CVE-2025-40241 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: erofs: fix crafted invalid cases for encoded extents Robert recently reported two corrupt… |
CVE-2025-40240 | High | 7.5 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: sctp: avoid NULL dereference when chunk data buffer is missing chunk->skb pointer is dere… |
CVE-2025-40239 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: net: phy: micrel: always set shared->phydev for LAN8814 Currently, during the LAN8814 PTP… | |
CVE-2025-40238 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix IPsec cleanup over MPV device When we do mlx5e_detach_netdev() we eventuall… | |
CVE-2025-40237 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: fs/notify: call exportfs_encode_fid with s_umount Calling intotify_show_fdinfo() on fd wa… | |
CVE-2025-40236 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: virtio-net: zero unused hash fields When GSO tunnel is negotiated virtio_net_hdr_tnl_from… | |
CVE-2025-40235 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: btrfs: directly free partially initialized fs_info in btrfs_check_leaked_roots() If fs_in… | |
CVE-2025-40234 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: platform/x86: alienware-wmi-wmax: Fix NULL pointer dereference in sleep handlers Devices… | |
CVE-2025-40233 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: ocfs2: clear extent cache after moving/defragmenting extents The extent map cache can bec… |
CVE-2025-40232 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: rv: Fully convert enabled_monitors to use list_head as iterator The callbacks in enabled_… | |
CVE-2025-40231 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: vsock: fix lock inversion in vsock_assign_transport() Syzbot reported a potential lock in… | |
CVE-2025-40230 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: mm: prevent poison consumption when splitting THP When performing memory error injection… | |
CVE-2025-40229 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: fix potential memory leak by cleaning ops_filter in damon_destroy_scheme C… | |
CVE-2025-40228 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: catch commit test ctx alloc failure Patch series "mm/damon/sysfs: fix com… | |
CVE-2025-40227 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: dealloc commit test ctx always The damon_ctx for testing online DAMON par… | |
CVE-2025-40226 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Account for failed debug initialization When the SCMI debug subsystem… | |
CVE-2025-40225 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: drm/panthor: Fix kernel panic on partial unmap of a GPU VA region This commit address a k… | |
CVE-2025-40224 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: hwmon: (cgbc-hwmon) Add missing NULL check after devm_kzalloc() The driver allocates memo… | |
CVE-2025-40223 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: most: usb: Fix use-after-free in hdm_disconnect hdm_disconnect() calls most_deregister_in… | |
CVE-2025-40222 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: tty: serial: sh-sci: fix RSCI FIFO overrun handling The receive error handling code is sh… | |
CVE-2025-65346 | Critical | 9.1 | 2025-12-04 | alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The unzip/extraction functionality improperly allows archive contents to b… |
CVE-2025-54307 | High | 8.8 | 2025-12-04 | An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. The /configure/plugins/plugin/upload/zip/ and /configure/newupdates/offli… |
CVE-2025-54306 | High | 7.2 | 2025-12-04 | An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. A remote code execution vulnerability exists in the network configuration… |
CVE-2025-54305 | High | 7.8 | 2025-12-04 | An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. One of the middlewares included in this application, LocalhostAuthMiddlew… |
CVE-2025-54304 | Critical | 9.8 | 2025-12-04 | An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. When they are powered on, an X11 display server is started. The display ser… |
CVE-2025-54303 | Critical | 9.8 | 2025-12-04 | The Thermo Fisher Torrent Suite Django application 5.18.1 has weak default credentials, which are stored as fixtures for the Django ORM API. The ionadmin user… |
CVE-2025-53963 | Critical | 9.8 | 2025-12-04 | An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. They run an SSH server accessible over the default port 22. The root accoun… |
CVE-2025-40221 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: media: pci: mg4b: fix uninitialized iio scan data Fix potential leak of uninitialized sta… | |
CVE-2025-40220 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: fuse: fix livelock in synchronous file put from fuseblk workers I observed a hang when ru… | |
CVE-2025-40219 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: PCI/IOV: Fix race between SR-IOV enable/disable and hotplug Commit 05703271c3cd ("PCI/IOV… | |
CVE-2025-40218 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: do not repeat pte_offset_map_lock() until success DAMON's virtual address… | |
CVE-2025-40217 | | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: pidfs: validate extensible ioctls Validate extensible ioctls stricter than we do now. | |
CVE-2025-40216 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: io_uring/rsrc: don't rely on user vaddr alignment There is no guaranteed alignment for us… |
CVE-2025-2848 | Medium | 6.3 | 2025-12-04 | A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings, and disable some non-critical functions. |
CVE-2025-29846 | High | 7.2 | 2025-12-04 | A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages. |
CVE-2025-29845 | Medium | 4.3 | 2025-12-04 | A vulnerability in VideoPlayer2 subtitle cgi allows remote authenticated users to read .srt files. |
CVE-2025-29844 | Medium | 4.3 | 2025-12-04 | A vulnerability in FileStation file cgi allows remote authenticated users to read file metadata and path information. |
CVE-2025-29843 | Medium | 5.4 | 2025-12-04 | A vulnerability in FileStation thumb cgi allows remote authenticated users to read/write image files. |
CVE-2025-14008 | Medium | 4.7 | 2025-12-04 | A flaw has been found in dayrui XunRuiCMS up to 4.7.1. This vulnerability affects unknown code of the file admin79f2ec220c7e.php?c=api&m=test_site_domain of th… |
CVE-2025-14007 | Low | 2.0 | 2025-12-04 | A vulnerability was detected in dayrui XunRuiCMS up to 4.7.1. This affects an unknown part of the file /admin79f2ec220c7e.php?c=api&m=demo&name=mobile of the c… |
CVE-2025-14006 | Low | 3.5 | 2025-12-04 | A security vulnerability has been detected in dayrui XunRuiCMS up to 4.7.1. Affected by this issue is some unknown functionality of the file /admind45f74adbd95… |
CVE-2025-14005 | Low | 2.4 | 2025-12-04 | A weakness has been identified in dayrui XunRuiCMS up to 4.7.1. Affected by this vulnerability is an unknown functionality of the file /admind45f74adbd95.php?c… |
CVE-2025-14004 | Medium | 4.7 | 2025-12-04 | A security flaw has been discovered in dayrui XunRuiCMS up to 4.7.1. Affected is an unknown function of the file /admind45f74adbd95.php?c=email&m=add of the co… |
CVE-2025-40215 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: xfrm: delete x->tunnel as we delete x The ipcomp fallback tunnels currently get deleted (… |
CVE-2025-40214 | High | 7.8 | 2025-12-04 | In the Linux kernel, the following vulnerability has been resolved: af_unix: Initialise scc_index in unix_add_edge(). Quang Le reported that the AF_UNIX GC c… |
CVE-2025-11222 | Medium | 6.1 | 2025-12-04 | Central Dogma versions before 0.78.0 contain an Open Redirect vulnerability that allows attackers to redirect users to untrusted sites via specially crafted UR… |
CVE-2025-41080 | Medium | 6.1 | 2025-12-04 | A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the vi… |
CVE-2025-41079 | Medium | 6.1 | 2025-12-04 | A stored Cross-Site Scripting (XSS) vulnerability has been found in Seafile v12.0.10. This vulnerability allows an attacker to execute arbitrary code in the vi… |
CVE-2025-14010 | Medium | 5.5 | 2025-12-04 | A flaw was found in ansible-collection-community-general. This vulnerability allows for information exposure (IE) of sensitive credentials, specifically plaint… |
CVE-2025-12826 | Medium | 4.8 | 2025-12-04 | The Custom Post Type UI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.18.0. This is due to the plugin not… |
CVE-2025-12782 | Medium | 4.3 | 2025-12-04 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.9.4. This is due… |
CVE-2025-13513 | Medium | 6.1 | 2025-12-04 | The Clik stats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the `$_SERVER['PHP_SELF']` parameter in all versions up to, and includi… |
CVE-2025-11727 | High | 7.2 | 2025-12-04 | The Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration – Powered by Codisto plugin for WordPress is vulnerable to Stored Cross-Site Script… |
CVE-2025-11379 | Medium | 5.3 | 2025-12-04 | The WebP Express plugin for WordPress is vulnerable to information exposure via config files in all versions up to, and including, 0.25.9. This is due to the p… |
CVE-2025-62173 | | 2025-12-04 | ## Summary Authenticated SQL Injection Vulnerability in Endpoint Module Rest API | |
CVE-2025-66404 | Medium | 6.4 | 2025-12-03 | MCP Server Kubernetes is an MCP Server that can connect to a Kubernetes cluster and manage it. Prior to 2.9.8, there is a security issue exists in the exec_in_… |
CVE-2025-66293 | High | 7.1 | 2025-12-03 | LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to 1.6.52, an… |
CVE-2025-65868 | High | 7.5 | 2025-12-03 | XML external entity (XXE) injection in eyoucms v1.7.1 allows remote attackers to cause a denial of service via crafted body of a POST request. |
CVE-2025-64055 | Critical | 9.8 | 2025-12-03 | An issue was discovered in Fanvil x210 V2 2.12.20 allowing unauthenticated attackers on the local network to access administrative functions of the device (e.g… |
CVE-2025-66489 | Critical | 9.8 | 2025-12-03 | Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker to bypass password verification when a… |
CVE-2025-66453 | High | 7.5 | 2025-12-03 | Rhino is an open-source implementation of JavaScript written entirely in Java. Prior to 1.8.1, 1.7.15.1, and 1.7.14.1, when an application passed an attacker c… |
CVE-2025-66411 | High | 7.8 | 2025-12-03 | Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containin… |
CVE-2025-66406 | Medium | 5.0 | 2025-12-03 | Step CA is an online certificate authority for secure, automated certificate management for DevOps. Prior to 0.29.0, there is an improper authorization check f… |
CVE-2025-65345 | Medium | 6.5 | 2025-12-03 | alexusmai laravel-file-manager 3.3.1 and below is vulnerable to Directory Traversal. The zip/archiving functionality allows an attacker to create archives cont… |
CVE-2025-65097 | Medium | 6.5 | 2025-12-03 | RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2… |
CVE-2025-65096 | Medium | 4.3 | 2025-12-03 | RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. Prior to 4.4.1 and 4.4.1-beta.2… |
CVE-2025-65027 | High | 7.6 | 2025-12-03 | RomM (ROM Manager) allows users to scan, enrich, browse and play their game collections with a clean and responsive interface. RomM contains multiple unrestric… |
CVE-2025-61727 | Medium | 6.5 | 2025-12-03 | An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that exc… |
CVE-2025-50361 | Medium | 5.1 | 2025-12-03 | Buffer Overflow was found in SmallBASIC community SmallBASIC with SDL Before v12_28, and commit sha:298a1d495355959db36451e90a0ac74bcc5593fe in the function ma… |
CVE-2025-13086 | High | 7.5 | 2025-12-03 | Improper validation of source IP addresses in OpenVPN version 2.6.0 through 2.6.15 and 2.7_alpha1 through 2.7_rc1 allows an attacker to open a session from a d… |
CVE-2025-12385 | | 2025-12-03 | Allocation of Resources Without Limits or Throttling, Improper Validation of Specified Quantity in Input vulnerability in The Qt Company Qt on Windows, MacOS… | |
CVE-2025-66222 | Critical | 9.6 | 2025-12-03 | DeepChat is a smart assistant uses artificial intelligence. In 0.5.0 and earlier, there is a Stored Cross-Site Scripting (XSS) vulnerability in the Mermaid dia… |
CVE-2025-66220 | Medium | 5.0 | 2025-12-03 | Envoy is a high-performance edge/middle/service proxy. In 1.33.12, 1.34.10, 1.35.6, 1.36.2, and earlier, Envoy’s mTLS certificate matcher for match_typed_subje… |
CVE-2025-66208 | Critical | 9.8 | 2025-12-03 | Collabora Online - Built-in CODE Server (richdocumentscode) provides a built-in server with all of the document editing features of Collabora Online. In versio… |
CVE-2025-66032 | Critical | 9.8 | 2025-12-03 | Claude Code is an agentic coding tool. Prior to 1.0.93, Due to errors in parsing shell commands related to $IFS and short CLI flags, it was possible to bypass… |
CVE-2025-63402 | Medium | 5.5 | 2025-12-03 | An issue in HCL Technologies Limited HCLTech GRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via APIs do not enforcing limits on the n… |
CVE-2025-63401 | Medium | 5.5 | 2025-12-03 | Cross Site Scripting vulnerability in HCL Technologies Limited HCLTech DRAGON before v.7.6.0 allows a remote attacker to execute arbitrary code via missing dir… |