93,331 indexed
CVECVE vulnerabilities
93,331 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 7,251–7,300 of 8,161 in High · page 146 of 164
| ID | Title | Summary |
|---|---|---|
| CVE-2025-1572 | CVE-2025-1572 CVSS 8.8 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the ‘u_id’ parameter in all versions up to, and… |
| CVE-2025-1568 | CVE-2025-1568 CVSS 8.8 | Access Control Vulnerability in Gerrit chromiumos project configuration in Google ChromeOS 16063.87.0 allows an attacker with a registered Gerrit account to in… |
| CVE-2025-15620 | CVE-2025-15620 CVSS 8.6belden | HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web interface that allows re… |
| CVE-2025-15617 | CVE-2025-15617 CVSS 6.5wazuh | Wazuh version 4.12.0 contains an exposure vulnerability in GitHub Actions workflow artifacts that allows attackers to extract the GITHUB_TOKEN from uploaded ar… |
| CVE-2025-15612 | CVE-2025-15612 CVSS 4.8wazuh | Wazuh provisioning scripts and Dockerfiles contain an insecure transport vulnerability where curl is invoked with the -k/--insecure flag, disabling SSL/TLS cer… |
| CVE-2025-15602 | CVE-2025-15602 CVSS 8.8snipeitapp | Snipe-IT versions prior to 8.3.7 contain sensitive user attributes related to account privileges that are insufficiently protected against mass assignment. An … |
| CVE-2025-15582 | CVE-2025-15582 CVSS 8.1 | A security flaw has been discovered in detronetdip E-commerce 1.0.0. The impacted element is the function Delete/Update of the component Product Management Mod… |
| CVE-2025-15568 | CVE-2025-15568 CVSS 8.0 | A command injection vulnerability was identified in the web module of Archer AXE75 v1.6/v1.0 router. An authenticated attacker with adjacent-network access ma… |
| CVE-2025-15566 | CVE-2025-15566 CVSS 8.8 | A security issue was discovered in ingress-nginx where the `nginx.ingress.kubernetes.io/auth-proxy-set-headers` Ingress annotation can be used to inject config… |
| CVE-2025-15560 | CVE-2025-15560 CVSS 8.8 | An authenticated attacker with minimal permissions can exploit a SQL injection in the WorkTime server "widget" API endpoint to inject SQL queries. If the Fireb… |
| CVE-2025-15558 | CVE-2025-15558 CVSS 8.0docker | Docker CLI for Windows searches for plugin binaries in C:\ProgramData\Docker\cli-plugins, a directory that does not exist by default. A low-privileged attacker… |
| CVE-2025-15557 | CVE-2025-15557 CVSS 8.8 | An Improper Certificate Validation vulnerability in TP-Link Tapo H100 v1 and Tapo P100 v1 allows an on-path attacker on the same network segment to intercept a… |
| CVE-2025-15556 | Notepad++ Download of Code Without Integrity Check Vulnerability KEVCVSS 7.5Notepad++ | Notepad++ when using the WinGUp updater, contains a download of code without integrity check vulnerability that could allow an attacker to intercept or redirec… |
| CVE-2025-15555 | CVE-2025-15555 CVSS 8.2 | A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function hss_ogs_diam_cx_mar_cb of the file src/hss/hss-cx-pa… |
| CVE-2025-15547 | CVE-2025-15547 CVSS 8.8 | By default, jailed processes cannot mount filesystems, including nullfs(4). However, the allow.mount.nullfs option enables mounting nullfs filesystems, subjec… |
| CVE-2025-15540 | CVE-2025-15540 CVSS 8.8 | "Functions" module in Raytha CMS allows privileged users to write custom code to add functionality to application. Due to a lack of sandboxing or access restri… |
| CVE-2025-15517 | CVE-2025-15517 CVSS 8.1 | A missing authentication check in the HTTP server on TP-Link Archer NX200, NX210, NX500 and NX600 to certain cgi endpoints allows unauthenticated access intend… |
| CVE-2025-15494 | CVE-2025-15494 CVSS 8.8 | A vulnerability has been found in RainyGao DocSys up to 2.02.37. This affects an unknown function of the file com/DocSystem/mapping/UserMapper.xml. The manipul… |
| CVE-2025-15492 | CVE-2025-15492 CVSS 8.8 | A vulnerability was detected in RainyGao DocSys up to 2.02.36. The affected element is an unknown function of the file src/com/DocSystem/mapping/GroupMemberMap… |
| CVE-2025-15467 | CVE-2025-15467 CVSS 8.8openssl | Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact sum… |
| CVE-2025-15462 | CVE-2025-15462 CVSS 8.8utt | A vulnerability has been found in UTT 进取 520W 1.7.7-180627. This issue affects the function strcpy of the file /goform/ConfigAdvideo. The manipulation of the a… |
| CVE-2025-15461 | CVE-2025-15461 CVSS 8.8utt | A flaw has been found in UTT 进取 520W 1.7.7-180627. This vulnerability affects the function strcpy of the file /goform/formTaskEdit. Executing a manipulation of… |
| CVE-2025-15460 | CVE-2025-15460 CVSS 8.8utt | A vulnerability was detected in UTT 进取 520W 1.7.7-180627. This affects the function strcpy of the file /goform/formPptpClientConfig. Performing a manipulation … |
| CVE-2025-15459 | CVE-2025-15459 CVSS 8.8utt | A security vulnerability has been detected in UTT 进取 520W 1.7.7-180627. Affected by this issue is the function strcpy of the file /goform/formUser. Such manipu… |
| CVE-2025-15431 | CVE-2025-15431 CVSS 8.8utt | A flaw has been found in UTT 进取 512W 1.7.7-171114. This affects the function strcpy of the file /goform/formFtpServerDirConfig. Executing a manipulation of the… |
| CVE-2025-15430 | CVE-2025-15430 CVSS 8.8utt | A vulnerability was detected in UTT 进取 512W 1.7.7-171114. Affected by this issue is the function strcpy of the file /goform/formFtpServerShareDirSelcet. Perfor… |
| CVE-2025-15429 | CVE-2025-15429 CVSS 8.8utt | A security vulnerability has been detected in UTT 进取 512W 1.7.7-171114. Affected by this vulnerability is the function strcpy of the file /goform/formConfigCli… |
| CVE-2025-15428 | CVE-2025-15428 CVSS 8.8utt | A weakness has been identified in UTT 进取 512W 1.7.7-171114. Affected is the function strcpy of the file /goform/formRemoteControl. This manipulation of the arg… |
| CVE-2025-15423 | CVE-2025-15423 CVSS 6.3phome | A vulnerability has been found in EmpireSoft EmpireCMS up to 8.0. Impacted is the function CheckSaveTranFiletype of the file e/class/connect.php. Such manipula… |
| CVE-2025-15406 | CVE-2025-15406 CVSS 6.3phpgurukul | A flaw has been found in PHPGurukul Online Course Registration up to 3.1. This affects an unknown function. This manipulation causes missing authorization. Rem… |
| CVE-2025-15405 | CVE-2025-15405 CVSS 8.8 | A vulnerability was detected in PHPEMS up to 11.0. The impacted element is an unknown function. The manipulation results in cross-site request forgery. The att… |
| CVE-2025-15404 | CVE-2025-15404 CVSS 6.3campcodes | A security vulnerability has been detected in campcodes School File Management System 1.0. The affected element is an unknown function of the file /save_file.p… |
| CVE-2025-15398 | CVE-2025-15398 CVSS 3.7uatech | A security vulnerability has been detected in Uasoft badaso up to 2.9.7. Affected is the function forgetPassword of the file src/Controllers/BadasoAuthControll… |
| CVE-2025-15393 | CVE-2025-15393 CVSS 6.3kodicms-kohana | A security vulnerability has been detected in Kohana KodiCMS up to 13.82.135. This impacts the function Save of the file cms/modules/kodicms/classes/kodicms/mo… |
| CVE-2025-15392 | CVE-2025-15392 CVSS 6.3kodicms-kohana | A weakness has been identified in Kohana KodiCMS up to 13.82.135. This affects the function like of the file cms/modules/pages/classes/kodicms/model/page.php o… |
| CVE-2025-15390 | CVE-2025-15390 CVSS 8.8 | A security flaw has been discovered in PHPGurukul Small CRM 4.0. This impacts an unknown function of the file /admin/edit-user.php. The manipulation results in… |
| CVE-2025-15389 | CVE-2025-15389 CVSS 8.8 | VPN Firewall developed by QNO Technology has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and… |
| CVE-2025-15388 | CVE-2025-15388 CVSS 8.8 | VPN Firewall developed by QNO Technology has an OS Command Injection vulnerability, allowing authenticated remote attackers to inject arbitrary OS commands and… |
| CVE-2025-15387 | CVE-2025-15387 CVSS 8.8 | VPN Firewall developed by QNO Technology has a Insufficient Entropy vulnerability, allowing unauthenticated remote attackers to obtain any logged-in user sessi… |
| CVE-2025-15386 | CVE-2025-15386 CVSS 8.8 | The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules tha… |
| CVE-2025-15382 | CVE-2025-15382 CVSS 8.1wolfssh | A heap buffer over-read vulnerability exists in the wolfSSH_CleanPath() function in wolfSSH. An authenticated remote attacker can trigger the issue via crafted… |
| CVE-2025-1538 | CVE-2025-1538 CVSS 8.8 | A vulnerability classified as critical was found in D-Link DAP-1320 1.00. Affected by this vulnerability is the function set_ws_action of the file /dws/api/. T… |
| CVE-2025-15375 | CVE-2025-15375 CVSS 8.8 | A flaw has been found in EyouCMS up to 1.7.7. The impacted element is the function unserialize of the file application/api/controller/Ajax.php of the component… |
| CVE-2025-15368 | CVE-2025-15368 CVSS 8.8 | The SportsPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.7.26 via shortcodes 'template_name' attribut… |
| CVE-2025-15356 | CVE-2025-15356 CVSS 8.8 | A vulnerability has been found in Tenda AC20 up to 16.03.08.12. The impacted element is the function sscanf of the file /goform/PowerSaveSet. The manipulation … |
| CVE-2025-15347 | CVE-2025-15347 CVSS 8.8 | The Creator LMS – The LMS for Creators, Coaches, and Trainers plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privileg… |
| CVE-2025-15344 | CVE-2025-15344 CVSS 8.8 | Tanium addressed a SQL injection vulnerability in Asset. |
| CVE-2025-15330 | CVE-2025-15330 CVSS 8.8 | Tanium addressed an improper input validation vulnerability in Deploy. |
| CVE-2025-15314 | CVE-2025-15314 CVSS 8.1 | Tanium addressed an arbitrary file deletion vulnerability in end-user-cx. |
| CVE-2025-15280 | CVE-2025-15280 CVSS 8.8 | FontForge SFD File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected… |