93,331 indexed
CVECVE vulnerabilities
93,331 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 7,351–7,400 of 8,161 in High · page 148 of 164
| ID | Title | Summary |
|---|---|---|
| CVE-2025-14994 | CVE-2025-14994 CVSS 8.8 | A flaw has been found in Tenda FH1201 and FH1206 1.2.0.14(408)/1.2.0.8(8155). This impacts the function strcat of the file /goform/webtypelibrary of the compon… |
| CVE-2025-14993 | CVE-2025-14993 CVSS 8.8tenda | A vulnerability was detected in Tenda AC18 15.03.05.05. This affects the function sprintf of the file /goform/SetDlnaCfg of the component HTTP Request Handler.… |
| CVE-2025-14992 | CVE-2025-14992 CVSS 8.8 | A security vulnerability has been detected in Tenda AC18 15.03.05.05. The impacted element is the function strcpy of the file /goform/GetParentControlInfo of t… |
| CVE-2025-14977 | CVE-2025-14977 CVSS 8.1 | The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy plugin for WordPress is vulnerable to Insecure Direct Ob… |
| CVE-2025-14975 | CVE-2025-14975 CVSS 8.1 | The Custom Login Page Customizer WordPress plugin before 2.5.4 does not have a proper password reset process, allowing a few unauthenticated requests to reset … |
| CVE-2025-14909 | CVE-2025-14909 CVSS 8.1 | A weakness has been identified in JeecgBoot up to 3.9.0. The impacted element is the function SysUserOnlineController of the file jeecg-boot/jeecg-module-syste… |
| CVE-2025-14908 | CVE-2025-14908 CVSS 6.3jeecg | A security flaw has been discovered in JeecgBoot up to 3.9.0. The affected element is an unknown function of the file jeecg-boot/jeecg-module-system/jeecg-syst… |
| CVE-2025-14885 | CVE-2025-14885 CVSS 8.8 | A flaw has been found in SourceCodester Client Database Management System 1.0. This affects an unknown part of the file /user_leads.php of the component Leads … |
| CVE-2025-14868 | CVE-2025-14868 CVSS 8.8 | The Career Section plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to Path Traversal and Arbitrary File Deletion in all versions up to… |
| CVE-2025-14866 | CVE-2025-14866 CVSS 8.8 | The Melapress Role Editor plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.1. This is due to a misconfigure… |
| CVE-2025-14861 | CVE-2025-14861 CVSS 8.8mozilla | Memory safety bugs present in Firefox 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could h… |
| CVE-2025-14856 | CVE-2025-14856 CVSS 8.8 | A security vulnerability has been detected in y_project RuoYi up to 4.8.1. The affected element is an unknown function of the file /monitor/cache/getnames. Suc… |
| CVE-2025-14847 | MongoDB and MongoDB Server Improper Handling of Length Parameter Inconsistency Vulnerability KEVCVSS 7.5MongoDB | MongoDB Server contains an improper handling of length parameter inconsistency vulnerability in Zlib compressed protocol headers. This vulnerability may allow … |
| CVE-2025-14834 | CVE-2025-14834 CVSS 8.8 | A weakness has been identified in code-projects Simple Stock System 1.0. This affects an unknown function of the file /checkuser.php. Executing a manipulation … |
| CVE-2025-14800 | CVE-2025-14800 CVSS 8.1 | The Redirection for Contact Form 7 plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'move_file_to_upload… |
| CVE-2025-14766 | CVE-2025-14766 CVSS 8.8google | Out of bounds read and write in V8 in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
| CVE-2025-14765 | CVE-2025-14765 CVSS 8.8google | Use after free in WebGPU in Google Chrome prior to 143.0.7499.147 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Ch… |
| CVE-2025-14756 | CVE-2025-14756 CVSS 8.8 | Command injection vulnerability was found in the admin interface component of TP-Link Archer MR600 v5 firmware, allowing authenticated attackers to execute sys… |
| CVE-2025-14749 | CVE-2025-14749 CVSS 6.3shenzhenningyuandatechnology | A vulnerability was identified in Ningyuanda TC155 57.0.2.0. This impacts an unknown function of the file /onvif/device_service of the component ONVIF PTZ Cont… |
| CVE-2025-14737 | CVE-2025-14737 CVSS 8.0 | Command Injection vulnerability in TP-Link WA850RE (httpd modules) allows authenticated adjacent attacker to inject arbitrary commands.This issue affects: ≤ WA… |
| CVE-2025-14727 | CVE-2025-14727 CVSS 8.3 | A vulnerability exists in NGINX Ingress Controller's nginx.org/rewrite-target annotation validation. Note: Software versions which have reached End of Techn… |
| CVE-2025-14656 | CVE-2025-14656 CVSS 8.8tenda | A weakness has been identified in Tenda AC20 16.03.08.12. This affects the function httpd of the file /goform/openSchedWifi. Executing a manipulation of the ar… |
| CVE-2025-14655 | CVE-2025-14655 CVSS 8.8tenda | A security flaw has been discovered in Tenda AC20 16.03.08.12. The impacted element is the function formSetRebootTimer of the file /goform/SetSysAutoRebbotCfg … |
| CVE-2025-14654 | CVE-2025-14654 CVSS 8.8tenda | A vulnerability was identified in Tenda AC20 16.03.08.12. The affected element is the function formSetPPTPUserList of the file /goform/setPptpUserList of the c… |
| CVE-2025-14589 | CVE-2025-14589 CVSS 6.3carmelo | A weakness has been identified in code-projects Prison Management System 2.0. This issue affects some unknown processing of the file /admin/search.php. Executi… |
| CVE-2025-14572 | CVE-2025-14572 CVSS 8.8utt | A vulnerability was found in UTT 进取 512W up to 1.7.7-171114. This affects an unknown part of the file /goform/formWebAuthGlobalConfig. Performing manipulation … |
| CVE-2025-14551 | CVE-2025-14551 CVSS 8.1canonical | In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report … |
| CVE-2025-14549 | CVE-2025-14549 CVSS 8.1 | In the Eclipse OMR compiler component, since release 0.7.0, an optimization enabled for Eclipse OpenJ9 consumers of OMR on Z processors incorrectly handles NUL… |
| CVE-2025-14526 | CVE-2025-14526 CVSS 8.8tenda | A security flaw has been discovered in Tenda CH22 1.0.0.1. This affects the function frmL7ImForm of the file /goform/L7Im. Performing a manipulation of the arg… |
| CVE-2025-14523 | CVE-2025-14523 CVSS 8.2 | A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front pr… |
| CVE-2025-14516 | CVE-2025-14516 CVSS 6.3yalantis | A vulnerability was found in Yalantis uCrop 2.2.11. Affected by this issue is the function downloadFile of the file com.yalantis.ucrop.task.BitmapLoadTask.java… |
| CVE-2025-14510 | CVE-2025-14510 CVSS 8.1 | Incorrect Implementation of Authentication Algorithm vulnerability in ABB ABB Ability OPTIMAX.This issue affects ABB Ability OPTIMAX: 6.1, 6.2, from 6.3.0 befo… |
| CVE-2025-14499 | CVE-2025-14499 CVSS 8.8 | IceWarp gmaps Cross-Site Scripting Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected install… |
| CVE-2025-14476 | CVE-2025-14476 CVSS 8.8 | The Doubly – Cross Domain Copy Paste for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.46 via … |
| CVE-2025-14475 | CVE-2025-14475 CVSS 8.1 | The Extensive VC Addons for WPBakery page builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9.1 via th… |
| CVE-2025-14472 | CVE-2025-14472 CVSS 8.1 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Acquia Content Hub allows Cross Site Request Forgery.This issue affects Acquia Content Hub: from 0.0.… |
| CVE-2025-14459 | CVE-2025-14459 CVSS 8.5 | A flaw was found in KubeVirt Containerized Data Importer (CDI). This vulnerability allows a user to clone PersistentVolumeClaims (PVCs) from unauthorized names… |
| CVE-2025-14431 | CVE-2025-14431 CVSS 8.1 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in THEMELOGI Navian navian allows PHP Loc… |
| CVE-2025-14430 | CVE-2025-14430 CVSS 8.1 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove Brook brook allows PHP Local… |
| CVE-2025-14429 | CVE-2025-14429 CVSS 8.1 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove AeroLand aeroland allows PHP… |
| CVE-2025-1441 | CVE-2025-1441 CVSS 8.8 | The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.1007. This … |
| CVE-2025-14397 | CVE-2025-14397 CVSS 8.8 | The Postem Ipsum plugin for WordPress is vulnerable to unauthorized modification of data to Privilege Escalation due to a missing capability check on the poste… |
| CVE-2025-14390 | CVE-2025-14390 CVSS 8.8 | The Video Merchant plugin for WordPress is vulnerable to Cross-Site Request Forgery in version <= 5.0.4. This is due to missing or incorrect nonce validation o… |
| CVE-2025-14386 | CVE-2025-14386 CVSS 8.8 | The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authentication bypass … |
| CVE-2025-14364 | CVE-2025-14364 CVSS 8.8 | The Demo Importer Plus plugin for WordPress is vulnerable to unauthorized modification of data, loss of data, and privilege escalation due to a missing capabil… |
| CVE-2025-14359 | CVE-2025-14359 CVSS 8.1 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in brandexponents Oshine allows PHP Local… |
| CVE-2025-14349 | CVE-2025-14349 CVSS 8.8uni-yaz | Privilege Defined With Unsafe Actions, Missing Authentication for Critical Function vulnerability in Universal Software Inc. FlexCity/Kiosk allows Accessing Fu… |
| CVE-2025-14341 | CVE-2025-14341 CVSS 8.3 | Improperly controlled modification of Dynamically-Determined object attributes, Allocation of resources without limits or throttling vulnerability in DivvyDriv… |
| CVE-2025-14333 | CVE-2025-14333 CVSS 8.1mozilla | Memory safety bugs present in Firefox ESR 140.5, Thunderbird ESR 140.5, Firefox 145 and Thunderbird 145. Some of these bugs showed evidence of memory corruptio… |
| CVE-2025-14329 | CVE-2025-14329 CVSS 8.8mozilla | Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. |