93,331 indexed
CVECVE vulnerabilities
93,331 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 7,401–7,450 of 8,161 in High · page 149 of 164
| ID | Title | Summary |
|---|---|---|
| CVE-2025-14328 | CVE-2025-14328 CVSS 8.8mozilla | Privilege escalation in the Netmonitor component. This vulnerability was fixed in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. |
| CVE-2025-14323 | CVE-2025-14323 CVSS 8.8mozilla | Privilege escalation in the DOM: Notifications component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Firefox ESR 140.6, Thunderbird 146, … |
| CVE-2025-14322 | CVE-2025-14322 CVSS 8.0mozilla | Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 146, Firefox ESR 115.31, Fi… |
| CVE-2025-14314 | CVE-2025-14314 CVSS 8.5 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Roxnor PopupKit popup-builder-block allows Blind SQL Inje… |
| CVE-2025-14307 | CVE-2025-14307 CVSS 8.1 | An insecure temporary file creation vulnerability exists in the AutoExtract component of Robocode version 1.9.3.6. The createTempFile method fails to securely … |
| CVE-2025-14300 | CVE-2025-14300 CVSS 8.1tp-link | The HTTPS service on Tapo C200 v3, v5, C425 v1.2 and C100 v5 exposes a connectAP interface without proper authentication. An unauthenticated attacker on the s… |
| CVE-2025-14287 | CVE-2025-14287 CVSS 8.8lfprojects | A command injection vulnerability exists in mlflow/mlflow versions before v3.7.0, specifically in the `mlflow/sagemaker/__init__.py` file at lines 161-167. The… |
| CVE-2025-14279 | CVE-2025-14279 CVSS 8.1 | MLFlow versions up to and including 3.4.0 are vulnerable to DNS rebinding attacks due to a lack of Origin header validation in the MLFlow REST server. This vul… |
| CVE-2025-14273 | CVE-2025-14273 CVSS 8.3 | Mattermost versions 11.1.x <= 11.1.0, 11.0.x <= 11.0.5, 10.12.x <= 10.12.3, 10.11.x <= 10.11.7 with the Jira plugin enabled and Mattermost Jira plugin versions… |
| CVE-2025-1426 | CVE-2025-1426 CVSS 8.8 | Heap buffer overflow in GPU in Google Chrome on Android prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted … |
| CVE-2025-14230 | CVE-2025-14230 CVSS 6.3carmelo | A vulnerability was detected in code-projects Daily Time Recording System 4.5.0. The impacted element is an unknown function of the file /admin/add_payroll.php… |
| CVE-2025-14229 | CVE-2025-14229 CVSS 4.7warren-daloyan | A security vulnerability has been detected in SourceCodester Inventory Management System 1.0. The affected element is an unknown function of the component SVC … |
| CVE-2025-14225 | CVE-2025-14225 CVSS 6.3dlink | A vulnerability was determined in D-Link DCS-930L 1.15.04. This affects an unknown part of the file /setSystemAdmin of the component alphapd. Executing manipul… |
| CVE-2025-14222 | CVE-2025-14222 CVSS 6.3carmelogarcia | A flaw has been found in code-projects Employee Profile Management System 1.0. Affected is an unknown function of the file /print_personnel_report.php. This ma… |
| CVE-2025-14214 | CVE-2025-14214 CVSS 6.3angeljudesuarez | A vulnerability has been found in itsourcecode Student Information System 1.0. This affects an unknown part of the file /section_edit1.php. The manipulation of… |
| CVE-2025-14203 | CVE-2025-14203 CVSS 8.8 | A flaw has been found in code-projects Question Paper Generator up to 1.0. This vulnerability affects unknown code of the file /selectquestionuser.php. This ma… |
| CVE-2025-14196 | CVE-2025-14196 CVSS 8.8 | A weakness has been identified in H3C Magic B1 up to 100R004. The affected element is the function sub_44de0 of the file /goform/aspForm. This manipulation of … |
| CVE-2025-14195 | CVE-2025-14195 CVSS 6.3carmelogarcia | A security flaw has been discovered in code-projects Employee Profile Management System 1.0. Impacted is an unknown function of the file /profiling/add_file_qu… |
| CVE-2025-14193 | CVE-2025-14193 CVSS 6.3carmelogarcia | A vulnerability was determined in code-projects Employee Profile Management System 1.0. This vulnerability affects unknown code of the file /view_personnel.php… |
| CVE-2025-14178 | CVE-2025-14178 CVSS 8.2 | In PHP versions:8.1.* before 8.1.34, 8.2.* before 8.2.30, 8.3.* before 8.3.29, 8.4.* before 8.4.16, 8.5.* before 8.5.1, a heap buffer overflow occurs in array_… |
| CVE-2025-14174 | Google Chromium Out of Bounds Memory Access Vulnerability KEVCVSS 8.8Google | Google Chromium contains an out of bounds memory access vulnerability in ANGLE that could allow a remote attacker to perform out of bounds memory access via a … |
| CVE-2025-14136 | CVE-2025-14136 CVSS 8.8linksys | A security flaw has been discovered in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This … |
| CVE-2025-14135 | CVE-2025-14135 CVSS 8.8linksys | A vulnerability was identified in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affec… |
| CVE-2025-14134 | CVE-2025-14134 CVSS 8.8 | A vulnerability was determined in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected b… |
| CVE-2025-14133 | CVE-2025-14133 CVSS 8.8linksys | A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected by thi… |
| CVE-2025-14126 | CVE-2025-14126 CVSS 8.8 | A vulnerability has been found in TOZED ZLT M30S and ZLT M30S PRO 1.47/3.09.06. Affected is an unknown function of the component Web Interface. Such manipulati… |
| CVE-2025-14124 | CVE-2025-14124 CVSS 8.6 | The Team WordPress plugin before 5.0.11 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to u… |
| CVE-2025-1412 | CVE-2025-1412 CVSS 8.8 | Mattermost versions 9.11.x <= 9.11.6, 10.4.x <= 10.4.1 fail to invalidate all active sessions when converting a user to a bot, with allows the converted user t… |
| CVE-2025-14115 | CVE-2025-14115 CVSS 8.4 | IBM Sterling Connect:Direct for UNIX Container 6.3.0.0 through 6.3.0.6 Interim Fix 016, and 6.4.0.0 through 6.4.0.3 Interim Fix 019 IBM® Sterling Connect:Direc… |
| CVE-2025-14111 | CVE-2025-14111 CVSS 8.1 | A security vulnerability has been detected in Rarlab RAR App up to 7.11 Build 127 on Android. This affects an unknown part of the component com.rarlab.rar. Suc… |
| CVE-2025-14108 | CVE-2025-14108 CVSS 8.8zspace | A weakness has been identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this issue is the function zfilev2_api.OpenSafe of the file /v2/file/safe/open … |
| CVE-2025-14107 | CVE-2025-14107 CVSS 8.8zspace | A security flaw has been discovered in ZSPACE Q2C NAS up to 1.1.0210050. Affected by this vulnerability is the function zfilev2_api.SafeStatus of the file /v2/… |
| CVE-2025-14106 | CVE-2025-14106 CVSS 8.8zspace | A vulnerability was identified in ZSPACE Q2C NAS up to 1.1.0210050. Affected is the function zfilev2_api.CloseSafe of the file /v2/file/safe/close of the compo… |
| CVE-2025-14096 | CVE-2025-14096 CVSS 8.4 | A vulnerability exists in multiple Radiometer products that allow an attacker with physical access to the analyzer possibility to extract credential informatio… |
| CVE-2025-14086 | CVE-2025-14086 CVSS 8.8 | A vulnerability was found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is an unknown function of the file /app-api/v1/members/openid/. The manipulation of t… |
| CVE-2025-14085 | CVE-2025-14085 CVSS 8.8 | A vulnerability has been found in youlaitech youlai-mall 1.0.0/2.0.0. This impacts an unknown function of the file /app-api/v1/orders/. The manipulation of the… |
| CVE-2025-14051 | CVE-2025-14051 CVSS 8.8 | A flaw has been found in youlaitech youlai-mall 1.0.0/2.0.0. Affected is the function getById/updateAddress/deleteAddress of the file /mall-ums/app-api/v1/addr… |
| CVE-2025-14044 | CVE-2025-14044 CVSS 8.1 | The Visitor Logic Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.0.3 via deserialization of untrusted … |
| CVE-2025-14037 | CVE-2025-14037 CVSS 8.1 | The Invelity Product Feeds plugin for WordPress is vulnerable to arbitrary file deletion via path traversal in all versions up to, and including, 1.2.6. This i… |
| CVE-2025-1403 | CVE-2025-1403 CVSS 8.6 | Qiskit SDK 0.45.0 through 1.2.4 could allow a remote attacker to cause a denial of service using a maliciously crafted QPY file containing a malformed symengin… |
| CVE-2025-14025 | CVE-2025-14025 CVSS 8.5 | A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operat… |
| CVE-2025-14016 | CVE-2025-14016 CVSS 8.1 | A security vulnerability has been detected in macrozheng mall-swarm up to 1.0.3. Affected is the function delete of the file /member/readHistory/delete. Such m… |
| CVE-2025-14002 | CVE-2025-14002 CVSS 8.1 | The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak … |
| CVE-2025-13982 | CVE-2025-13982 CVSS 8.1 | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Login Time Restriction allows Cross Site Request Forgery.This issue affects Login Time Restriction: f… |
| CVE-2025-13970 | CVE-2025-13970 CVSS 8.0 | OpenPLC_V3 is vulnerable to a cross-site request forgery (CSRF) attack due to the absence of proper CSRF validation. This issue allows an unauthenticated att… |
| CVE-2025-1395 | CVE-2025-1395 CVSS 8.2 | Generation of Error Message Containing Sensitive Information vulnerability in Codriapp Innovation and Software Technologies Inc. HeyGarson allows Fuzzing for a… |
| CVE-2025-13943 | CVE-2025-13943 CVSS 8.8 | A post-authentication command injection vulnerability in the log file download function of the Zyxel EX3301-T0 firmware versions through 5.50(ABVY.7)C0 could a… |
| CVE-2025-13941 | CVE-2025-13941 CVSS 8.8 | A local privilege escalation vulnerability exists in the Foxit PDF Reader/Editor Update Service. During plugin installation, incorrect file system permissions … |
| CVE-2025-13914 | CVE-2025-13914 CVSS 8.7juniper | A Key Exchange without Entity Authentication vulnerability in the SSH implementation of Juniper Networks Apstra allows a unauthenticated, MITM attacker to im… |
| CVE-2025-1389 | CVE-2025-1389 CVSS 8.8 | Orca HCM from Learning Digital has a SQL Injection vulnerability, allowing attackers with regular privileges to inject arbitrary SQL commands to read, modify, … |