2025 CVEs (page 97)
Page 97 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-6666 | Low | 2.0 | 2025-11-29 | A vulnerability was determined in motogadget mo.lock Ignition Lock up to 20251125. Affected by this vulnerability is an unknown functionality of the component… |
CVE-2025-66291 | Medium | 4.3 | 2025-11-29 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the interview attachment retrieval endpoint in the Recruitment mo… |
CVE-2025-66290 | Medium | 4.3 | 2025-11-29 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application’s recruitment attachment retrieval endpoint does… |
CVE-2025-66289 | High | 8.8 | 2025-11-29 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application does not invalidate existing sessions when a user… |
CVE-2025-66225 | High | 8.8 | 2025-11-29 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the password reset workflow does not enforce that the username su… |
CVE-2025-66224 | High | 8.8 | 2025-11-29 | OrangeHRM is a comprehensive human resource management (HRM) system. From version 5.0 to 5.7, the application contains an input-neutralization flaw in its mail… |
CVE-2025-65892 | Medium | 6.1 | 2025-11-29 | Reflected Cross-Site Scripting (rXSS) in krpano before version 1.23.2 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the victim's… |
CVE-2025-65540 | Medium | 6.1 | 2025-11-29 | Multiple Cross-Site Scripting (XSS) vulnerabilities exist in xmall v1.1 due to improper handling of user-supplied data. User input fields such as username and… |
CVE-2025-66223 | | 2025-11-29 | OpenObserve is a cloud-native observability platform. Prior to version 0.16.0, organization invitation tokens do not expire once issued, remain valid even afte… | |
CVE-2025-66221 | Medium | 5.3 | 2025-11-29 | Werkzeug is a comprehensive WSGI web application library. Prior to version 3.1.4, Werkzeug's safe_join function allows path segments with Windows device names… |
CVE-2025-66217 | High | 7.5 | 2025-11-29 | AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, an integer underflow vulnerability exists in the MQTT parsing logic of AIS-catcher. This v… |
CVE-2025-66216 | Critical | 9.8 | 2025-11-29 | AIS-catcher is a multi-platform AIS receiver. Prior to version 0.64, a heap buffer overflow vulnerability has been identified in the AIS::Message class of AIS-… |
CVE-2025-61915 | Medium | 6.0 | 2025-11-29 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can u… |
CVE-2025-58436 | Medium | 5.1 | 2025-11-29 | OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd b… |
CVE-2025-53939 | Medium | 6.3 | 2025-11-29 | Kiteworks is a private data network (PDN). Prior to version 9.1.0, improper input validation when managing roles of a shared folder could lead to unexpectedly… |
CVE-2025-53900 | Medium | 6.5 | 2025-11-29 | Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, an unfavourable definition of roles and permissions in Kiteworks MFT on… |
CVE-2025-53899 | High | 7.2 | 2025-11-29 | Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, the back-end of Kiteworks MFT is vulnerable to an incorrectly specified… |
CVE-2025-53897 | Medium | 6.8 | 2025-11-29 | Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, this vulnerability could allow an external attacker to gain access to lo… |
CVE-2025-53896 | High | 7.1 | 2025-11-29 | Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, a bug in Kiteworks MFT could cause under certain circumstances that a us… |
CVE-2025-66219 | Critical | 9.8 | 2025-11-29 | willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in willitme… |
CVE-2025-66201 | High | 8.1 | 2025-11-29 | LibreChat is a ChatGPT clone with additional features. Prior to version 0.8.1-rc2, LibreChat is vulnerable to Server-side Request Forgery (SSRF), by passing sp… |
CVE-2025-66036 | Medium | 6.1 | 2025-11-29 | Retro is an online platform providing items of vintage collections. Prior to version 2.4.7, Retro is vulnerable to a cross-site scripting (XSS) in the input ha… |
CVE-2025-66034 | Medium | 6.3 | 2025-11-29 | fontTools is a library for manipulating fonts, written in Python. In versions from 4.33.0 to before 4.60.2, the fonttools varLib (or python3 -m fontTools.varLi… |
CVE-2025-66027 | Medium | 6.5 | 2025-11-29 | Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, includ… |
CVE-2025-65113 | Medium | 6.5 | 2025-11-29 | ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.2 - #164, an authorization bypass vulnerability in the AJAX flagging system allows… |
CVE-2025-65112 | Critical | 9.4 | 2025-11-29 | PubNet is a self-hosted Dart & Flutter package service. Prior to version 1.1.3, the /api/storage/upload endpoint in PubNet allows unauthenticated users to uplo… |
CVE-2025-64715 | Medium | 4.0 | 2025-11-29 | Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Prior to versions 1.16.17, 1.17.10, and 1.18.4, CiliumNetworkPolicys… |
CVE-2025-13683 | Medium | 6.5 | 2025-11-28 | Exposure of credentials in unintended requests in Devolutions Server, Remote Desktop Manager on Windows.This issue affects Devolutions Server: through 2025.3.8… |
CVE-2025-12183 | | 2025-11-28 | Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted… | |
CVE-2025-59792 | Medium | 5.3 | 2025-11-28 | Reveals plaintext credentials in the MONITOR command vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from 1.0.0 through 2.13.0. Users are… |
CVE-2025-59790 | Medium | 5.4 | 2025-11-28 | Improper Privilege Management vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from v2.9.0 through v2.13.0. Users are recommended to upgra… |
CVE-2025-51736 | Medium | 6.3 | 2025-11-28 | File upload vulnerability in HCL Technologies Ltd. Unica 12.0.0. |
CVE-2025-51735 | High | 7.5 | 2025-11-28 | CSV formula injection vulnerability in HCL Technologies Ltd. Unica 12.0.0. |
CVE-2025-51734 | Medium | 5.4 | 2025-11-28 | Cross-site scripting (XSS) vulnerability in HCL Technologies Ltd. Unica 12.0.0. |
CVE-2025-51733 | Medium | 5.5 | 2025-11-28 | Cross-Site Request Forgery (CSRF) vulnerability in HCL Technologies Ltd. Unica 12.0.0. |
CVE-2025-12638 | High | 8.0 | 2025-11-28 | Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.get_file() function when extracting tar archives. The vulnerability arise… |
CVE-2025-11156 | | 2025-11-28 | Netskope was notified about a potential gap in its agent (NS Client) on Windows systems. If this gap is successfully exploited, a local, authenticated user wi… | |
CVE-2025-12143 | Medium | 6.1 | 2025-11-28 | Stack-based Buffer Overflow vulnerability in ABB Terra AC wallbox.This issue affects Terra AC wallbox: through 1.8.33. |
CVE-2025-13771 | Medium | 6.5 | 2025-11-28 | WebITR developed by Uniong has an Arbitrary File Read vulnerability, allowing authenticated remote attackers to exploit Relative Path Traversal to download arb… |
CVE-2025-13770 | Medium | 6.5 | 2025-11-28 | WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database content… |
CVE-2025-13769 | Medium | 6.5 | 2025-11-28 | WebITR developed by Uniong has a SQL Injection vulnerability, allowing authenticated remote attackers to inject arbitrary SQL commands to read database content… |
CVE-2025-13768 | High | 7.5 | 2025-11-28 | WebITR developed by Uniong has an Authentication Bypass vulnerability, allowing authenticated remote attackers to log into the system as any user by modifying… |
CVE-2025-66386 | Medium | 4.1 | 2025-11-28 | app/Model/EventReport.php in MISP before 2.5.27 allows path traversal in view picture for a site-admin. |
CVE-2025-66385 | | 2025-11-28 | UsersController::edit in Cerebrate before 1.30 allows an authenticated non-privileged user to escalate their privileges (e.g., obtain a higher role such as adm… | |
CVE-2025-66384 | High | 8.2 | 2025-11-28 | app/Controller/EventsController.php in MISP before 2.5.24 has invalid logic in checking for uploaded file validity, related to tmp_name. |
CVE-2025-66382 | Low | 2.9 | 2025-11-28 | In libexpat through 2.7.3, a crafted file with an approximate size of 2 MiB can lead to dozens of seconds of processing time. |
CVE-2025-66372 | Low | 2.8 | 2025-11-28 | Mustang before 2.16.3 allows exfiltrating files via XXE attacks. |
CVE-2025-66371 | Medium | 5.0 | 2025-11-28 | Peppol-py before 1.1.1 allows XXE attacks because of the Saxon configuration. When validating XML-based invoices, the XML parser could read files from the file… |
CVE-2025-66370 | Medium | 5.0 | 2025-11-28 | Kivitendo before 3.9.2 allows XXE injection. By uploading an electronic invoice in the ZUGFeRD format, it is possible to read and exfiltrate files from the ser… |
CVE-2025-64312 | Medium | 4.9 | 2025-11-28 | Permission control vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58311 | Medium | 5.8 | 2025-11-28 | UAF vulnerability in the USB driver module. Impact: Successful exploitation of this vulnerability will affect availability and confidentiality. |
CVE-2025-58308 | High | 7.3 | 2025-11-28 | Vulnerability of improper criterion security check in the call module. Impact: Successful exploitation of this vulnerability may cause features to perform abno… |
CVE-2025-58305 | Medium | 6.2 | 2025-11-28 | Identity authentication bypass vulnerability in the Gallery app. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58304 | Medium | 4.9 | 2025-11-28 | Permission control vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58302 | High | 8.4 | 2025-11-28 | Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-13737 | Medium | 4.3 | 2025-11-28 | The Nextend Social Login and Register plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.1.21. This is du… |
CVE-2025-64315 | Medium | 4.4 | 2025-11-28 | Configuration defect vulnerability in the file management module. Impact: Successful exploitation of this vulnerability may affect app data confidentiality and… |
CVE-2025-64314 | Critical | 9.3 | 2025-11-28 | Permission control vulnerability in the memory management module. Impact: Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2025-64313 | Medium | 5.3 | 2025-11-28 | Denial of service (DoS) vulnerability in the office service. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-64311 | Medium | 5.1 | 2025-11-28 | Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58316 | High | 7.3 | 2025-11-28 | DoS vulnerability in the video-related system service module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58315 | Medium | 5.5 | 2025-11-28 | Permission control vulnerability in the Wi-Fi module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58314 | Medium | 6.6 | 2025-11-28 | Vulnerability of accessing invalid memory in the component driver module. Impact: Successful exploitation of this vulnerability will affect availability and co… |
CVE-2025-58312 | Medium | 5.1 | 2025-11-28 | Permission control vulnerability in the App Lock module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58310 | High | 8.0 | 2025-11-28 | Permission control vulnerability in the distributed component. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-58309 | Medium | 6.8 | 2025-11-28 | Permission control vulnerability in the startup recovery module. Impact: Successful exploitation of this vulnerability will affect availability and confidentia… |
CVE-2025-58307 | Medium | 6.4 | 2025-11-28 | UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58303 | High | 8.4 | 2025-11-28 | UAF vulnerability in the screen recording framework module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2025-58294 | Medium | 6.2 | 2025-11-28 | Permission control vulnerability in the print module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2025-66361 | Medium | 6.5 | 2025-11-28 | An issue was discovered in Logpoint before 7.7.0. Sensitive information is exposed in System Processes for an extended period during high CPU load. |
CVE-2025-66360 | High | 8.8 | 2025-11-28 | An issue was discovered in Logpoint before 7.7.0. An improperly configured access control policy exposes sensitive Logpoint internal service (Redis) informatio… |
CVE-2025-66359 | High | 8.5 | 2025-11-28 | An issue was discovered in Logpoint before 7.7.0. Insufficient input validation and a lack of output escaping in multiple components leads to a cross-site scri… |
CVE-2025-12421 | Critical | 9.9 | 2025-11-27 | Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that the token used during the code exchange… |
CVE-2025-12559 | Medium | 4.3 | 2025-11-27 | Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to sanitize team email addresses to be visible only to Tea… |
CVE-2025-13765 | Medium | 4.3 | 2025-11-27 | Exposure of email service credentials to users without administrative rights in Devolutions Server.This issue affects Devolutions Server: before 2025.2.21, bef… |
CVE-2025-13758 | Low | 3.5 | 2025-11-27 | Exposure of credentials in unintended requests in Devolutions Server.This issue affects Server: through 2025.2.20, through 2025.3.8. |
CVE-2025-13757 | High | 8.8 | 2025-11-27 | SQL Injection vulnerability in last usage logs in Devolutions Server.This issue affects Devolutions Server: through 2025.2.20, through 2025.3.8. |
CVE-2025-12419 | Critical | 9.9 | 2025-11-27 | Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly validate OAuth state tokens during OpenID Conn… |
CVE-2025-8890 | | 2025-11-27 | Firmware in SDMC NE6037 routers prior to version 7.1.12.2.44 has a network diagnostics tool vulnerable to a shell command injection attacks. In order to exploi… | |
CVE-2025-13692 | High | 7.2 | 2025-11-27 | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and includin… |
CVE-2025-12140 | | 2025-11-27 | The application contains an insecure 'redirectToUrl' mechanism that incorrectly processes the value of the 'redirectUrlParameter' parameter. The application in… | |
CVE-2025-12971 | Medium | 4.3 | 2025-11-27 | The Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager plugin for WordPress is vulnerable to unauthorized modification of… |
CVE-2025-59454 | Medium | 4.3 | 2025-11-27 | In Apache CloudStack, a gap in access control checks affected the APIs - createNetworkACL - listNetworkACLs - listResourceDetails - listVirtualMachinesUsageHis… |
CVE-2025-59302 | Medium | 4.7 | 2025-11-27 | In Apache CloudStack improper control of generation of code ('Code Injection') vulnerability is found in the following APIs which are accessible only to admin… |
CVE-2025-54057 | Medium | 6.1 | 2025-11-27 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache SkyWalking. This issue affects Apache SkyWalking: <= 10… |
CVE-2025-59890 | High | 7.3 | 2025-11-27 | Improper input sanitization in the file archives upload functionality of Eaton Galileo software allows traversing paths which could lead into an attacker with… |
CVE-2025-13742 | Medium | 6.1 | 2025-11-27 | Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replac… |
CVE-2025-10476 | Medium | 4.3 | 2025-11-27 | The WP Fastest Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wpfc_db_fix_callback() fu… |
CVE-2025-59026 | Medium | 5.4 | 2025-11-27 | Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the conte… |
CVE-2025-59025 | Medium | 6.1 | 2025-11-27 | Malicious e-mail content can be used to execute script code. Unintended actions can be executed in the context of the users account, including exfiltration of… |
CVE-2025-30190 | Medium | 5.4 | 2025-11-27 | Malicious content at office documents can be used to inject script code when editing a document. Unintended actions can be executed in the context of the users… |
CVE-2025-30186 | Medium | 5.4 | 2025-11-27 | Malicious content uploaded as file can be used to execute script code when following attacker-controlled links. Unintended actions can be executed in the conte… |
CVE-2025-13381 | Medium | 5.3 | 2025-11-27 | The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'ay… |
CVE-2025-13378 | Medium | 6.5 | 2025-11-27 | The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including… |
CVE-2025-12584 | Medium | 5.3 | 2025-11-27 | The Quick View for WooCommerce plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.2.17 via the 'wqv_popup_conte… |
CVE-2025-13536 | High | 8.8 | 2025-11-27 | The Blubrry PowerPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in all versions up to, and includi… |
CVE-2025-13441 | Medium | 5.3 | 2025-11-27 | The Hide Category by User Role for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.3.1. This is… |
CVE-2025-13157 | Medium | 5.3 | 2025-11-27 | The QODE Wishlist for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.2.7 via the 'q… |
CVE-2025-13525 | Medium | 6.1 | 2025-11-27 | The WP Directory Kit plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'order_by' parameter in all versions up to, and including, 1… |
CVE-2025-13143 | Medium | 4.3 | 2025-11-27 | The Poll, Survey & Quiz Maker Plugin by Opinion Stage plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 19… |