2025 CVEs (page 93)
Page 93 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-11781 | High | 7.8 | 2025-12-02 | Use of hardcoded cryptographic keys in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. The affected firmware contains a hardcoded static authentication key. An attacker… |
CVE-2025-11780 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in Circutor SGE-PLC1000/SGE-PLC50 v9.0.2. In the 'showMeterReport()' function, there is an unlimited user input that… |
CVE-2025-11779 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow vulnerability in CircutorSGE-PLC1000/SGE-PLC50 v9.0.2. The 'SetLan' function is invoked when a new configuration is applied. This n… |
CVE-2025-11778 | Critical | 9.8 | 2025-12-02 | Stack-based buffer overflow in Circutor SGE-PLC1000/SGE-PLC50 v0.9.2. This vulnerability allows an attacker to remotely exploit memory corruption through the '… |
CVE-2025-13090 | Medium | 4.9 | 2025-12-02 | The WP Directory Kit plugin for WordPress is vulnerable to SQL Injection via the 'search' parameter in all versions up to, and including, 1.4.6 due to insuffic… |
CVE-2025-41744 | Critical | 9.1 | 2025-12-02 | Sprecher Automations SPRECON-E series uses default cryptographic keys that allow an unprivileged remote attacker to access all encrypted communications, thereb… |
CVE-2025-41743 | Medium | 4.0 | 2025-12-02 | Insufficient encryption strength in Sprecher Automation SPRECON-E-C, SPRECON-E-P, and SPRECON-E-T3 allows a local unprivileged attacker to extract data from up… |
CVE-2025-41742 | Critical | 9.8 | 2025-12-02 | Sprecher Automations SPRECON-E-C, SPRECON-E-P, SPRECON-E-T3 is vulnerable to attack by an unauthorized remote attacker via default cryptographic keys. The use… |
CVE-2025-13353 | Medium | 5.5 | 2025-12-02 | In gokey versions <0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM… |
CVE-2025-13873 | Medium | 5.4 | 2025-12-02 | Stored Cross-Site Scripting (XSS) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on web application allows an attacker to inject arbitrary J… |
CVE-2025-13872 | Critical | 9.1 | 2025-12-02 | Blind Server-Side Request Forgery (SSRF) in the survey-import feature of ObjectPlanet Opinio 7.26 rev12562 on Web-based platforms allows an attacker to fo… |
CVE-2025-13871 | High | 8.8 | 2025-12-02 | Cross-Site Request Forgery (CSRF) in the resource-management feature of ObjectPlanet Opinio 7.26 rev12562 allows to upload files on behalf of the connecte… |
CVE-2025-13870 | Low | 3.1 | 2025-12-02 | Mattermost versions 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to validate the user permission when accessing the files and subscribing to the block in Boards… |
CVE-2025-13724 | High | 7.5 | 2025-12-02 | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'month' parameter in all versions up t… |
CVE-2025-13534 | Medium | 6.3 | 2025-12-02 | The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.3.2… |
CVE-2025-13516 | High | 8.1 | 2025-12-02 | The SureMail – SMTP and Email Logs Plugin for WordPress is vulnerable to Unrestricted Upload of File with Dangerous Type in versions up to and including 1.9.0… |
CVE-2025-10543 | Medium | 5.3 | 2025-12-02 | In Eclipse Paho Go MQTT v3.1 library (paho.mqtt.golang) versions <=1.5.0 UTF-8 encoded strings, passed into the library, may be incorrectly encoded if their le… |
CVE-2025-13696 | Medium | 5.3 | 2025-12-02 | The Zigaform plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.6.5. This is due to the plugin exposing a… |
CVE-2025-11726 | Medium | 4.3 | 2025-12-02 | The Beaver Builder – WordPress Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.9.4. This is du… |
CVE-2025-10971 | | 2025-12-02 | Insecure Storage of Sensitive Information vulnerability in MeetMe on iOS, Android allows Retrieve Embedded Sensitive Data. This issue affects MeetMe: through v… | |
CVE-2025-13685 | Medium | 4.3 | 2025-12-02 | The Photo Gallery by Ays plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 6.4.8. This is due to missing n… |
CVE-2025-13140 | Medium | 4.3 | 2025-12-02 | The SurveyJS: Drag & Drop WordPress Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.12.20… |
CVE-2025-13007 | Medium | 6.1 | 2025-12-02 | The WP Social Ninja – Embed Social Feeds, Customer Reviews, Chat Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up t… |
CVE-2025-12483 | Medium | 6.5 | 2025-12-02 | The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'query' parameter in all versions up to, an… |
CVE-2025-13001 | Medium | 4.1 | 2025-12-02 | The donation WordPress plugin through 1.0 does not sanitize and escape a parameter before using it in a SQL statement, allowing high privilege users, such as a… |
CVE-2025-13000 | High | 7.7 | 2025-12-02 | The db-access WordPress plugin through 0.8.7 does not have authorization in an AJAX action, allowing any authenticated users, such as subscriber to perform SQL… |
CVE-2025-13606 | Medium | 6.5 | 2025-12-02 | The Export All Posts, Products, Orders, Refunds & Users plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including… |
CVE-2025-13387 | High | 7.2 | 2025-12-02 | The Kadence WooCommerce Email Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer name in all versions up to, and inclu… |
CVE-2025-20792 | Medium | 5.3 | 2025-12-02 | In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base… |
CVE-2025-20791 | Medium | 6.5 | 2025-12-02 | In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service, if a UE has connected to a rogue base… |
CVE-2025-20790 | Medium | 5.3 | 2025-12-02 | In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base… |
CVE-2025-20789 | Medium | 4.4 | 2025-12-02 | In GPU pdma, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no additional execu… |
CVE-2025-20788 | Medium | 4.4 | 2025-12-02 | In GPU pdma, there is a possible memory corruption due to a missing permission check. This could lead to local denial of service with no additional execution p… |
CVE-2025-20777 | Medium | 6.7 | 2025-12-02 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2025-20776 | Medium | 6.7 | 2025-12-02 | In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alr… |
CVE-2025-20775 | Medium | 6.7 | 2025-12-02 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-20774 | Medium | 6.7 | 2025-12-02 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2025-20773 | Medium | 6.7 | 2025-12-02 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-20772 | Medium | 6.7 | 2025-12-02 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-20771 | Medium | 6.7 | 2025-12-02 | In display, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege if a malicious actor… |
CVE-2025-20770 | Medium | 6.7 | 2025-12-02 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-20769 | Medium | 6.7 | 2025-12-02 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2025-20768 | High | 7.8 | 2025-12-02 | In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alr… |
CVE-2025-20767 | High | 7.8 | 2025-12-02 | In display, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has alrea… |
CVE-2025-20766 | High | 7.8 | 2025-12-02 | In display, there is a possible memory corruption due to improper input validation. This could lead to local escalation of privilege if a malicious actor has a… |
CVE-2025-20765 | Medium | 4.7 | 2025-12-02 | In aee daemon, there is a possible system crash due to a race condition. This could lead to local denial of service if a malicious actor has already obtained t… |
CVE-2025-20764 | High | 7.8 | 2025-12-02 | In smi, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alread… |
CVE-2025-20763 | High | 7.8 | 2025-12-02 | In mmdvfs, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alr… |
CVE-2025-20759 | Medium | 6.5 | 2025-12-02 | In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue b… |
CVE-2025-20758 | Medium | 4.9 | 2025-12-02 | In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base sta… |
CVE-2025-20757 | Medium | 6.5 | 2025-12-02 | In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base… |
CVE-2025-20756 | Medium | 6.5 | 2025-12-02 | In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogue base station con… |
CVE-2025-20755 | Medium | 5.3 | 2025-12-02 | In Modem, there is a possible application crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue… |
CVE-2025-20754 | Medium | 5.3 | 2025-12-02 | In Modem, there is a possible system crash due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base… |
CVE-2025-20753 | Medium | 5.3 | 2025-12-02 | In Modem, there is a possible system crash due to an uncaught exception. This could lead to remote denial of service, if a UE has connected to a rogue base sta… |
CVE-2025-20752 | Medium | 6.5 | 2025-12-02 | In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base st… |
CVE-2025-20751 | Medium | 6.5 | 2025-12-02 | In Modem, there is a possible system crash due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base st… |
CVE-2025-20750 | Medium | 6.5 | 2025-12-02 | In Modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service, if a UE has connected to a rogue base… |
CVE-2025-13697 | Medium | 6.4 | 2025-12-02 | The BlockArt Blocks – Gutenberg Blocks, Page Builder Blocks ,WordPress Block Plugin, Sections & Template Library plugin for WordPress is vulnerable to Stored C… |
CVE-2025-12529 | High | 8.8 | 2025-12-02 | The Cost Calculator Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteOrdersFiles() f… |
CVE-2025-58488 | Medium | 4.5 | 2025-12-02 | Improper verification of source of a communication channel in SmartTouchCall prior to version 1.0.1.1 allows remote attackers to access sensitive information… |
CVE-2025-58487 | Medium | 4.0 | 2025-12-02 | Improper authorization in Samsung Account prior to version 15.5.01.1 allows local attacker to launch arbitrary activity with Samsung Account privilege. |
CVE-2025-58486 | Medium | 4.0 | 2025-12-02 | Improper input validation in Samsung Account prior to version 15.5.01.1 allows local attacker to execute arbitrary script. |
CVE-2025-58485 | Medium | 5.5 | 2025-12-02 | Improper input validation in Samsung Internet prior to version 29.0.0.48 allows local attackers to inject arbitrary script. |
CVE-2025-58484 | Medium | 4.0 | 2025-12-02 | Incorrect default permissions in Samsung Cloud Assistant prior to version 8.0.03.8 allows local attacker to access partial data in sandbox. |
CVE-2025-58483 | Medium | 5.9 | 2025-12-02 | Improper export of android application components in Galaxy Store for Galaxy Watch prior to version 1.0.06.29 allows local attacker to install arbitrary applic… |
CVE-2025-58482 | High | 7.3 | 2025-12-02 | Improper access control in MPLocalService of MotionPhoto prior to version 4.1.51 allows local attackers to start privileged service. |
CVE-2025-58481 | High | 7.3 | 2025-12-02 | Improper access control in MPRemoteService of MotionPhoto prior to version 4.1.51 allows local attackers to start privileged service. |
CVE-2025-58480 | Medium | 4.3 | 2025-12-02 | Heap-based buffer overflow in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory. |
CVE-2025-58479 | Medium | 4.3 | 2025-12-02 | Out-of-bounds read in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory. |
CVE-2025-58478 | Medium | 4.3 | 2025-12-02 | Out-of-bounds write in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory. |
CVE-2025-58477 | Medium | 4.3 | 2025-12-02 | Out-of-bounds write in parsing IFD tag in libimagecodec.quram.so prior to SMR Dec-2025 Release 1 allows remote attackers to access out-of-bounds memory. |
CVE-2025-58476 | Medium | 4.2 | 2025-12-02 | Out-of-bounds read vulnerability in bootloader prior to SMR Dec-2025 Release 1 allows physical attackers to access out-of-bounds memory. |
CVE-2025-58475 | Medium | 5.6 | 2025-12-02 | Improper input validation in libsec-ril.so prior to SMR Dec-2025 Release 1 allows local privileged attackers to write out-of-bounds memory. |
CVE-2025-55129 | Medium | 5.4 | 2025-12-02 | HackerOne community member Kassem S.(kassem_s94) has reported that username handling in Revive Adserver was still vulnerable to impersonation attacks after the… |
CVE-2025-21080 | Medium | 6.2 | 2025-12-02 | Improper export of android application components in Dynamic Lockscreen prior to SMR Dec-2025 Release 1 allows local attackers to access files with Dynamic Loc… |
CVE-2025-21072 | Medium | 5.7 | 2025-12-02 | Out-of-bounds write in decoding metadata in fingerprint trustlet prior to SMR Dec-2025 Release 1 allows local privileged attackers to write out-of-bounds memor… |
CVE-2025-66448 | High | 7.1 | 2025-12-01 | vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.11.1, vllm has a critical remote code execution vector in a config class n… |
CVE-2025-66415 | Medium | 5.4 | 2025-12-01 | fastify-reply-from is a Fastify plugin to forward the current HTTP request to another server. Prior to 12.5.0, by crafting a malicious URL, an attacker could a… |
CVE-2025-66412 | Medium | 5.4 | 2025-12-01 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 21.0.2, 20.3.15, a… |
CVE-2025-66410 | Critical | 9.1 | 2025-12-01 | Gin-vue-admin is a backstage management system based on vue and gin. In 2.8.6 and earlier, attackers can delete any file on the server at will, causing damage… |
CVE-2025-66405 | Critical | 9.8 | 2025-12-01 | Portkey.ai Gateway is a blazing fast AI Gateway with integrated guardrails. Prior to 1.14.0, the gateway determined the destination baseURL by prioritizing the… |
CVE-2025-66403 | Medium | 4.6 | 2025-12-01 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 2.2.3, a stored cross-site scripting (XSS) vul… |
CVE-2025-66401 | Critical | 9.8 | 2025-12-01 | MCP Watch is a comprehensive security scanner for Model Context Protocol (MCP) servers. In 0.1.2 and earlier, the MCPScanner class contains a critical Command… |
CVE-2025-66400 | Medium | 5.3 | 2025-12-01 | mdast-util-to-hast is an mdast utility to transform to hast. From 13.0.0 to before 13.2.1, multiple (unprefixed) classnames could be added in markdown source b… |
CVE-2025-66313 | High | 7.2 | 2025-12-01 | ChurchCRM is an open-source church management system. In ChurchCRM 6.2.0 and earlier, there is a time-based blind SQL injection in the handling of the 1FieldSe… |
CVE-2025-66312 | Medium | 5.4 | 2025-12-01 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta… |
CVE-2025-66311 | Medium | 5.4 | 2025-12-01 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta… |
CVE-2025-66310 | Medium | 5.4 | 2025-12-01 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta… |
CVE-2025-66309 | Medium | 6.1 | 2025-12-01 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta… |
CVE-2025-66308 | Medium | 5.4 | 2025-12-01 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta… |
CVE-2025-66307 | Medium | 6.5 | 2025-12-01 | This admin plugin for Grav is an HTML user interface that provides a convenient way to configure Grav and easily create and modify pages. Prior to 1.11.0-beta… |
CVE-2025-66306 | Medium | 4.3 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, there is an IDOR (Insecure Direct Object Reference) vulnerability in the Grav CMS Admin Panel which… |
CVE-2025-66305 | Medium | 4.9 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a Denial of Service (DoS) vulnerability was identified in the "Languages" submenu of the Grav admin… |
CVE-2025-66304 | Medium | 6.2 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, users with read access on the user account management section of the admin panel can view the passwo… |
CVE-2025-66303 | Medium | 4.9 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A Denial of Service (DoS) vulnerability has been identified in Grav related to the handling of sched… |
CVE-2025-66302 | Medium | 6.8 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A path traversal vulnerability has been identified in Grav CMS, allowing authenticated attackers wit… |
CVE-2025-66301 | Critical | 9.6 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, due to improper authorization checks when modifying critical fields on a POST request to /admin/page… |
CVE-2025-66300 | High | 8.5 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, A low privilege user account with page editing privilege can read any server files using "Frontmatte… |
CVE-2025-66299 | High | 8.8 | 2025-12-01 | Grav is a file-based Web platform. Prior to 1.8.0-beta.27, Grav CMS is vulnerable to a Server-Side Template Injection (SSTI) that allows any authenticated user… |