93,331 indexed
CVECVE vulnerabilities
93,331 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 7,601–7,650 of 8,161 in High · page 153 of 164
| ID | Title | Summary |
|---|---|---|
| CVE-2025-12921 | CVE-2025-12921 CVSS 4.3openclinica | A vulnerability has been found in OpenClinica Community Edition up to 3.12.2/3.13. Affected by this issue is some unknown functionality of the file /ImportCRFD… |
| CVE-2025-12907 | CVE-2025-12907 CVSS 8.8google | Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to execute arbitrary code via user act… |
| CVE-2025-1290 | CVE-2025-1290 CVSS 8.1 | A race condition Use-After-Free vulnerability exists in the virtio_transport_space_update function within the Kernel 5.4 on ChromeOS. Concurrent allocation and… |
| CVE-2025-12879 | CVE-2025-12879 CVSS 8.8 | The User Generator and Importer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 1.2.2. This is due to missing … |
| CVE-2025-12865 | CVE-2025-12865 CVSS 8.8edetw | U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, mo… |
| CVE-2025-12864 | CVE-2025-12864 CVSS 8.8edetw | U-Office Force developed by e-Excellence has a SQL Injection vulnerability, allowing authenticated remote attacker to inject arbitrary SQL commands to read, mo… |
| CVE-2025-12851 | CVE-2025-12851 CVSS 8.1 | The My auctions allegro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.32 via the 'controller' parameter.… |
| CVE-2025-12846 | CVE-2025-12846 CVSS 8.8 | The Blocksy Companion plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 2.1.19. This is due to in… |
| CVE-2025-12845 | CVE-2025-12845 CVSS 8.8 | The Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent plugin for WordPress is vulnerable to unauthorized access of data that leads … |
| CVE-2025-12824 | CVE-2025-12824 CVSS 8.8 | The Player Leaderboard plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.2 via the 'player_leaderboard' shor… |
| CVE-2025-12821 | CVE-2025-12821 CVSS 8.8 | The NewsBlogger theme for WordPress is vulnerable to Cross-Site Request Forgery in versions 0.2.5.6 to 0.2.5.9. This is due to missing or incorrect nonce vali… |
| CVE-2025-1282 | CVE-2025-1282 CVSS 8.8 | The Car Dealer Automotive WordPress Theme – Responsive theme for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in… |
| CVE-2025-12819 | CVE-2025-12819 CVSS 8.1 | Untrusted search path in auth_query connection handler in PgBouncer before 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentica… |
| CVE-2025-12816 | CVE-2025-12816 CVSS 8.6 | An interpretation-conflict (CWE-436) vulnerability in node-forge versions 1.3.1 and earlier enables unauthenticated attackers to craft ASN.1 structures to desy… |
| CVE-2025-12805 | CVE-2025-12805 CVSS 8.1 | A flaw was found in Red Hat OpenShift AI (RHOAI) llama-stack-operator. This vulnerability allows unauthorized access to Llama Stack services deployed in other … |
| CVE-2025-1279 | CVE-2025-1279 CVSS 8.8 | The BM Content Builder plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capabilit… |
| CVE-2025-12779 | CVE-2025-12779 CVSS 8.8 | Improper handling of the authentication token in the Amazon WorkSpaces client for Linux, versions 2023.0 through 2024.8, may expose the authentication token fo… |
| CVE-2025-12775 | CVE-2025-12775 CVSS 8.8 | The WP Dropzone plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 1.1.0 via the `ajax_upload_hand… |
| CVE-2025-12763 | CVE-2025-12763 CVSS 6.8pgadmin | pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup … |
| CVE-2025-12744 | CVE-2025-12744 CVSS 8.8 | A flaw was found in the ABRT daemon’s handling of user-supplied mount information.ABRT copies up to 12 characters from an untrusted input and places them direc… |
| CVE-2025-12733 | CVE-2025-12733 CVSS 8.8 | The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and inclu… |
| CVE-2025-12727 | CVE-2025-12727 CVSS 8.8google | Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
| CVE-2025-12725 | CVE-2025-12725 CVSS 8.8google | Out of bounds read in WebGPU in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker to perform an out of bounds memory write via a craft… |
| CVE-2025-12716 | CVE-2025-12716 CVSS 8.7 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 that, under certain c… |
| CVE-2025-12638 | CVE-2025-12638 CVSS 8.0 | Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.get_file() function when extracting tar archives. The vulnerability arise… |
| CVE-2025-12637 | CVE-2025-12637 CVSS 8.8 | The Elastic Theme Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a dynamic code generation feature in the process_theme function in… |
| CVE-2025-12615 | CVE-2025-12615 CVSS 8.1 | A security vulnerability has been detected in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /onps/settings.py. Such manip… |
| CVE-2025-12613 | CVE-2025-12613 CVSS 8.6 | Versions of the package cloudinary before 2.7.0 are vulnerable to Arbitrary Argument Injection due to improper parsing of parameter values containing an ampers… |
| CVE-2025-12609 | CVE-2025-12609 CVSS 8.8 | A vulnerability was found in CodeAstro Gym Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/update-progress.php. … |
| CVE-2025-12556 | CVE-2025-12556 CVSS 8.8 | An argument injection vulnerability exists in the affected product that could allow an attacker to execute arbitrary code within the context of the host machin… |
| CVE-2025-12550 | CVE-2025-12550 CVSS 8.1 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jwsthemes OchaHouse ochahouse allows P… |
| CVE-2025-12549 | CVE-2025-12549 CVSS 8.1 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in magentech Rozy - Flower Shop rozy allo… |
| CVE-2025-12547 | CVE-2025-12547 CVSS 3.7logicaldoc | A vulnerability was identified in LogicalDOC Community Edition up to 9.2.1. This vulnerability affects unknown code of the file /login.jsp of the component Adm… |
| CVE-2025-12529 | CVE-2025-12529 CVSS 8.8 | The Cost Calculator Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteOrdersFiles() f… |
| CVE-2025-12528 | CVE-2025-12528 CVSS 8.1 | The Pie Forms for WP plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.6 via the format_classic function. Thi… |
| CVE-2025-12509 | CVE-2025-12509 CVSS 8.4 | On a client with an admin user, a Global_Shipping script can be implemented. The script could later be executed on the BRAIN2 server with administrator rights. |
| CVE-2025-12508 | CVE-2025-12508 CVSS 8.4 | When using domain users as BRAIN2 users, communication with Active Directory services is unencrypted. This can lead to the interception of authentication data … |
| CVE-2025-12507 | CVE-2025-12507 CVSS 8.8 | The service Bizerba Communication Server (BCS) has an unquoted service path. Due to the way Windows searches the executable for the BCS service, malicious prog… |
| CVE-2025-12497 | CVE-2025-12497 CVSS 8.1 | The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.3.10 via the … |
| CVE-2025-12490 | CVE-2025-12490 CVSS 8.8 | Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affecte… |
| CVE-2025-12486 | CVE-2025-12486 CVSS 8.8 | Heimdall Data Database Proxy Cross-Site Scripting Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on … |
| CVE-2025-12485 | CVE-2025-12485 CVSS 8.8devolutions | Improper privilege management during pre-MFA cookie handling in Devolutions Server allows a low-privileged authenticated user to impersonate another account by… |
| CVE-2025-12479 | CVE-2025-12479 CVSS 8.8 | Systemic Lack of Cross-Site Request Forgery (CSRF) Token Implementation.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 . |
| CVE-2025-1247 | CVE-2025-1247 CVSS 8.3 | A flaw was found in Quarkus REST that allows request parameters to leak between concurrent requests if endpoints use field injection without a CDI scope. This … |
| CVE-2025-1244 | CVE-2025-1244 CVSS 8.8 | A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnera… |
| CVE-2025-12438 | CVE-2025-12438 CVSS 8.8google | Use after free in Ozone in Google Chrome on Linux and ChromeOS prior to 142.0.7444.59 allowed a remote attacker to potentially exploit object corruption via a … |
| CVE-2025-12432 | CVE-2025-12432 CVSS 8.8google | Race in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security… |
| CVE-2025-12429 | CVE-2025-12429 CVSS 8.8google | Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (… |
| CVE-2025-12428 | CVE-2025-12428 CVSS 8.8google | Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium secur… |
| CVE-2025-1240 | CVE-2025-1240 CVSS 8.8 | WinZip 7Z File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affecte… |