2025 CVEs (page 96)
Page 96 of 434 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-58312 | Medium | 5.1 | 2025-11-28 | Permission control vulnerability in the App Lock module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58310 | High | 8.0 | 2025-11-28 | Permission control vulnerability in the distributed component. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58309 | Medium | 6.8 | 2025-11-28 | Permission control vulnerability in the startup recovery module. Impact: Successful exploitation of this vulnerability will affect availability and confidentia… |
CVE-2025-58307 | Medium | 6.4 | 2025-11-28 | UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58303 | High | 8.4 | 2025-11-28 | UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58294 | Medium | 6.2 | 2025-11-28 | Permission control vulnerability in the print module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-66361 | Medium | 6.5 | 2025-11-28 | An issue was discovered in Logpoint before 7.7.0. Sensitive information is exposed in System Processes for an extended period during high CPU load. |
CVE-2025-66360 | High | 8.8 | 2025-11-28 | An issue was discovered in Logpoint before 7.7.0. An improperly configured access control policy exposes sensitive Logpoint internal service (Redis) informatio… |
CVE-2025-66359 | High | 8.5 | 2025-11-28 | An issue was discovered in Logpoint before 7.7.0. Insufficient input validation and a lack of output escaping in multiple components leads to a cross-site scri… |
CVE-2025-12421 | Critical | 9.9 | 2025-11-27 | Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange… |
CVE-2025-12559 | Medium | 4.3 | 2025-11-27 | Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to sanitize team email addresses to be visible only to Tea… |
CVE-2025-13765 | Medium | 4.3 | 2025-11-27 | Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: before 2025.2.21, bef… |
CVE-2025-13758 | Low | 3.5 | 2025-11-27 | Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8. |
CVE-2025-13757 | High | 8.8 | 2025-11-27 | SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025.3.8. |
CVE-2025-12419 | Critical | 9.9 | 2025-11-27 | Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Conn… |
CVE-2025-8890 | | 2025-11-27 | Firmware in SDMC NE6037 routers prior to version 7.1.12.2.44 has a network diagnostics tool vulnerable to a shell command injection attacks. In order to exploi… | |
CVE-2025-13692 | High | 7.2 | 2025-11-27 | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includin… |
CVE-2025-12140 | | 2025-11-27 | The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. The application in… | |
CVE-2025-12971 | Medium | 4.3 | 2025-11-27 | The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to unauthorized modification of… |
CVE-2025-59454 | Medium | 4.3 | 2025-11-27 | In Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL - listNetworkACLs - listResourceDetails - listVirtualMachinesUsageHis… |
CVE-2025-59302 | Medium | 4.7 | 2025-11-27 | In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admin… |
CVE-2025-54057 | Medium | 6.1 | 2025-11-27 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking. This issue affects Apache SkyWalking: <= 10… |
CVE-2025-59890 | High | 7.3 | 2025-11-27 | Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with… |
CVE-2025-13742 | Medium | 6.1 | 2025-11-27 | Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replac… |
CVE-2025-10476 | Medium | 4.3 | 2025-11-27 | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpfc_db_fix_callback() fu… |
CVE-2025-59026 | Medium | 5.4 | 2025-11-27 | Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the conte… |
CVE-2025-59025 | Medium | 6.1 | 2025-11-27 | Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the users account, including exfiltration of… |
CVE-2025-30190 | Medium | 5.4 | 2025-11-27 | Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the context of the users… |
CVE-2025-30186 | Medium | 5.4 | 2025-11-27 | Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the conte… |
CVE-2025-13381 | Medium | 5.3 | 2025-11-27 | The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'ay… |
CVE-2025-13378 | Medium | 6.5 | 2025-11-27 | The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including… |
CVE-2025-12584 | Medium | 5.3 | 2025-11-27 | The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.17 via the 'wqv_popup_conte… |
CVE-2025-13536 | High | 8.8 | 2025-11-27 | The Blubrry PowerPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and includi… |
CVE-2025-13441 | Medium | 5.3 | 2025-11-27 | The Hide Category by User Role for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.1. This is… |
CVE-2025-13157 | Medium | 5.3 | 2025-11-27 | The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.7 via the 'q… |
CVE-2025-13525 | Medium | 6.1 | 2025-11-27 | The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order_by' parameter in all versions up to, and including, 1… |
CVE-2025-13143 | Medium | 4.3 | 2025-11-27 | The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 19… |
CVE-2025-12185 | Medium | 4.4 | 2025-11-27 | The StaffList plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.2.6 due to insuffici… |
CVE-2025-12123 | Medium | 6.1 | 2025-11-27 | The Customer Reviews Collector for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'email-text' parameter in all versi… |
CVE-2025-7820 | High | 7.5 | 2025-11-27 | The SKT PayPal for WooCommerce plugin for WordPress is vulnerable to Payment Bypass in all versions up to, and including, 1.4. This is due to the plugin only e… |
CVE-2025-3784 | Medium | 5.5 | 2025-11-27 | Cleartext Storage of Sensitive Information Vulnerability in GX Works2 all versions allows an attacker to disclose credential information stored in plaintext fr… |
CVE-2025-13680 | High | 8.8 | 2025-11-27 | The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the plugin allowing a user to… |
CVE-2025-13675 | Critical | 9.8 | 2025-11-27 | The Tiger theme for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 101.2.1. This is due to the 'paypal-submit.php' file… |
CVE-2025-13540 | Critical | 9.8 | 2025-11-27 | The Tiare Membership plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2. This is due to the 'tiare_membership… |
CVE-2025-13539 | Critical | 9.8 | 2025-11-27 | The FindAll Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.4. This is due to the plugin not p… |
CVE-2025-13538 | Critical | 9.8 | 2025-11-27 | The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findall_listing… |
CVE-2025-12758 | High | 7.5 | 2025-11-27 | Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() functio… |
CVE-2025-12151 | Medium | 6.4 | 2025-11-27 | The Simple Folio plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'portfolio_name' parameter in all versions up to, and including, 1.1… |
CVE-2025-66314 | High | 7.5 | 2025-11-27 | Improper Privilege Management vulnerability in ZTE ElasticNet UME R32 on Linux allows Accessing Functionality Not Properly Constrained by ACLs.This issue affec… |
CVE-2025-13762 | | 2025-11-27 | Improper Input Validation vulnerability in CyberArk CyberArk Secure Web Sessions Extension on Chrome, Edge allows Denial of Service when trying to starting new… | |
CVE-2025-12713 | Medium | 6.4 | 2025-11-27 | The Soundslides plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the soundslides shortcode in all versions up to, and including, 1.4.2 due… |
CVE-2025-12712 | Medium | 6.4 | 2025-11-27 | The Shouty plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shouty shortcode in all versions up to, and including, 0.2.1 due to insuff… |
CVE-2025-12670 | Medium | 6.4 | 2025-11-27 | The wp-twitpic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters of the 'twitpic' shortcode in all versions up to, and… |
CVE-2025-12666 | Medium | 6.4 | 2025-11-27 | The Google Drive upload and download link plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' parameter of the 'atachfilegoogle' s… |
CVE-2025-12649 | Medium | 6.4 | 2025-11-27 | The SortTable Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in the sorttablepost shortcode in all versions up t… |
CVE-2025-12579 | Medium | 5.3 | 2025-11-27 | The Reuters Direct plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'logoff' action in all vers… |
CVE-2025-12578 | Medium | 4.3 | 2025-11-27 | The Reuters Direct plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing or inco… |
CVE-2025-0658 | | 2025-11-27 | A vulnerability in Automated Logic and Carrier's Zone Controller via BACnet protocol causes the device to crash. The device enters a fault state; after a reset… | |
CVE-2025-0657 | | 2025-11-27 | A weakness in Automated Logic and Carrier i-Vu Gen5 router on driver version drv_gen5_106-01-2380, allows malformed packets to be sent through BACnet MS/T… | |
CVE-2025-66040 | Low | 3.6 | 2025-11-27 | Spotipy is a Python library for the Spotify Web API. Prior to version 2.25.2, there is a cross-site scripting (XSS) vulnerability in the OAuth callback server… |
CVE-2025-66035 | | 2025-11-26 | Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16… | |
CVE-2025-66031 | High | 7.5 | 2025-11-26 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Uncontrolled Recursion vulnerability in node-forge ve… |
CVE-2025-66030 | Medium | 5.3 | 2025-11-26 | Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. An Integer Overflow vulnerability in node-forge versions… |
CVE-2025-64344 | High | 7.5 | 2025-11-26 | Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13… |
CVE-2025-64335 | High | 7.5 | 2025-11-26 | Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 t… |
CVE-2025-64334 | High | 7.5 | 2025-11-26 | Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. In versions from 8.0.0 t… |
CVE-2025-64333 | High | 7.5 | 2025-11-26 | Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13… |
CVE-2025-64332 | High | 7.5 | 2025-11-26 | Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13… |
CVE-2025-64331 | High | 7.5 | 2025-11-26 | Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13… |
CVE-2025-64330 | High | 7.5 | 2025-11-26 | Suricata is a network IDS, IPS and NSM engine developed by the OISF (Open Information Security Foundation) and the Suricata community. Prior to versions 7.0.13… |
CVE-2025-62593 | High | 8.8 | 2025-11-26 | Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited via a critical RCE vulnerability explo… |
CVE-2025-40934 | Critical | 9.3 | 2025-11-26 | XML-Sig versions 0.27 through 0.67 for Perl incorrectly validates XML files if signatures are omitted. An attacker can remove the signature from the XML docum… |
CVE-2025-65202 | High | 8.0 | 2025-11-26 | TRENDnet TEW-657BRM 1.00.1 has an authenticated remote OS command injection vulnerability in the setup.cgi binary, exploitable via the HTTP parameters "command… |
CVE-2025-7449 | Medium | 6.5 | 2025-11-26 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 8.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowe… |
CVE-2025-6195 | Medium | 4.3 | 2025-11-26 | GitLab has remediated an issue in GitLab EE affecting all versions from 13.7 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allowed… |
CVE-2025-65670 | Medium | 4.3 | 2025-11-26 | An Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows students to access sensitive admin/teacher endpoints by manipulating course IDs in URLs… |
CVE-2025-65278 | High | 7.5 | 2025-11-26 | An issue was discovered in file users.json in GroceryMart commit 21934e6 (2020-10-23) allowing unauthenticated attackers to gain sensitive information includin… |
CVE-2025-65276 | Critical | 9.8 | 2025-11-26 | An unauthenticated administrative access vulnerability exists in the open-source HashTech project (https://github.com/henzljw/hashtech) 1.0 thru commit 5919dec… |
CVE-2025-50433 | Critical | 9.8 | 2025-11-26 | An issue was discovered in imonnit.com (2025-04-24) allowing malicious actors to gain escalated privileges via crafted password reset to take over arbitrary us… |
CVE-2025-13611 | Low | 2.0 | 2025-11-26 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.2 before 18.5.5 and 18.6 before 18.6.3 that could have allowed an authenticated u… |
CVE-2025-12653 | Medium | 6.5 | 2025-11-26 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.3 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that under specific c… |
CVE-2025-12571 | High | 7.5 | 2025-11-26 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.10 before 18.4.5, 18.5 before 18.5.3, and 18.6 before 18.6.1 that could have allo… |
CVE-2025-66028 | High | 8.2 | 2025-11-26 | OneUptime is a solution for monitoring and managing online services. Prior to version 8.0.5567, OneUptime is vulnerable to privilege escalation via Login Respo… |
CVE-2025-65966 | High | 8.1 | 2025-11-26 | OneUptime is a solution for monitoring and managing online services. In version 9.0.5598, a low-permission user can create new accounts through a direct API re… |
CVE-2025-65681 | Low | 3.3 | 2025-11-26 | An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information… |
CVE-2025-65676 | Medium | 5.4 | 2025-11-26 | Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG cover images. |
CVE-2025-65675 | Medium | 5.4 | 2025-11-26 | Stored Cross site scripting (XSS) vulnerability in Classroomio LMS 0.1.13 allows authenticated attackers to execute arbitrary code via crafted SVG profile pict… |
CVE-2025-65672 | High | 7.5 | 2025-11-26 | Insecure Direct Object Reference (IDOR) in classroomio 0.1.13 allows unauthorized share and invite access to course settings. |
CVE-2025-65669 | Critical | 9.1 | 2025-11-26 | An issue was discovered in classroomio 0.1.13. Student accounts are able to delete courses from the Explore page without any authorization or authentication ch… |
CVE-2025-26155 | Critical | 9.8 | 2025-11-26 | NCP Secure Enterprise Client 13.18 and NCP Secure Entry Windows Client 13.19 have an Untrusted Search Path vulnerability. |
CVE-2025-64130 | Critical | 9.8 | 2025-11-26 | Zenitel TCIV-3+ is vulnerable to a reflected cross-site scripting vulnerability, which could allow a remote attacker to execute arbitrary JavaScript on the v… |
CVE-2025-64129 | High | 7.6 | 2025-11-26 | Zenitel TCIV-3+ is vulnerable to an out-of-bounds write vulnerability, which could allow a remote attacker to crash the device. |
CVE-2025-64128 | Critical | 10.0 | 2025-11-26 | An OS command injection vulnerability exists due to incomplete validation of user-supplied input. Validation fails to enforce sufficient formatting rules, wh… |
CVE-2025-64127 | Critical | 10.0 | 2025-11-26 | An OS command injection vulnerability exists due to insufficient sanitization of user-supplied input. The application accepts parameters that are later incor… |
CVE-2025-64126 | Critical | 10.0 | 2025-11-26 | An OS command injection vulnerability exists due to improper input validation. The application accepts a parameter directly from user input without verifying… |
CVE-2025-55471 | High | 7.5 | 2025-11-26 | Incorrect access control in the getUserFormData function of youlai-boot v2.21.1 allows attackers to access sensitive information for other users. |
CVE-2025-55469 | Critical | 9.8 | 2025-11-26 | Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend. |
CVE-2025-2486 | High | 8.8 | 2025-11-26 | The Ubuntu edk2 UEFI firmware packages accidentally allowed the UEFI Shell to be accessed in Secure Boot environments, possibly allowing bypass of Secure Boot… |
CVE-2025-20373 | Low | 2.7 | 2025-11-26 | In Splunk Add-on for Palo Alto Networks versions below 2.0.2, the add-on exposes client secrets in plain text in the _internal index during the addition of new… |
CVE-2025-13084 | High | 7.6 | 2025-11-26 | The users endpoint in the groov View API returns a list of all users and associated metadata including their API keys. This endpoint requires an Editor role… |