CVEs from 2025
Total
8,834
critical
critical 1,313
high
high 1,950
medium
medium 1,966
low
low 200
% Critical
14.9%
% with KEV
2.1%
% with exploit
2.8%
Top vendors
- qualcomm 1,123
- fabian 285
- campcodes 232
- phpgurukul 189
- code-projects 121
- redhat 108
- microsoft 107
- portabilis 94
Top products
- i-educar 80
- office_long_term_servicing_channel 35
- office 34
- best_salon_management_system 33
- apartment_management_system 30
- gcp 29
- inventory_management_system 28
- online_learning_management_system 21
Top packages
- Go/github.com/mattermost/mattermost/server/v8 258
- Go/github.com/mattermost/mattermost-server 249
- Packagist/magento/community-edition 231
- Packagist/moodle/moodle 162
- Go/github.com/mattermost/mattermost-server/v5 99
- Go/github.com/mattermost/mattermost-server/v6 99
- Maven/com.liferay.portal:release.dxp.bom 61
- Maven/org.apache.tomcat.embed:tomcat-embed-core 53
| CVE | Severity | CVSS | Risk | Flags | OS | Vendor | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-62728 | unknown | — | — | 6mo ago | Hive Metastore Server is vulnerable to SQL Injection | |||
| CVE-2025-59390 | unknown | — | — | 6mo ago | Apache Druid’s Kerberos authenticator uses a weak fallback secret | |||
| CVE-2025-66021 | unknown | — | — | 6mo ago | OWASP Java HTML Sanitizer is vulnerable to XSS via noscript tag and improper style tag sanitization | |||
| CVE-2025-9624 | unknown | — | — | 6mo ago | OpenSearch is vulnerable to DoS via complex query_string inputs | |||
| CVE-2025-21621 | unknown | — | — | 6mo ago | GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format | |||
| CVE-2025-65998 | unknown | — | — | 6mo ago | Apache Syncope's AES encryption stores hard-coded passwords in internal database | |||
| CVE-2025-47914 | unknown | — | — | 7mo ago | SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read. | |||
| CVE-2025-58181 | unknown | — | — | 7mo ago | SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption. | |||
| CVE-2025-64408 | unknown | — | — | 7mo ago | Apache Causeway vulnerable to deserialization in Java | |||
| CVE-2025-65089 | unknown | — | — | 7mo ago | XWiki view file macro: User can view content of office file without view rights on the attachment | |||
| CVE-2025-12383 | unknown | — | — | 7mo ago | Eclipse Jersey has a Race Condition | |||
| CVE-2025-65015 | unknown | — | — | 7mo ago | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In versions from 1.3.3 to before 1.3.5 and from 1.4.0 to before 1.4.2, the … | |||
| CVE-2025-54990 | unknown | — | — | 7mo ago | XWiki AdminTools application doesn't set permissions on the AdminTools space | |||
| CVE-2025-65073 | unknown | — | — | 7mo ago | OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization. | |||
| CVE-2025-13265 | unknown | — | — | 7mo ago | lsFusion Server is vulnerable to Path Traversal through its unpackFile function | |||
| CVE-2025-13266 | unknown | — | — | 7mo ago | vlife-base has Path Traversal vulnerability | |||
| CVE-2025-13261 | unknown | — | — | 7mo ago | lsFusion Platform has a Path Traversal vulnerability | |||
| CVE-2025-64507 | unknown | — | — | 7mo ago | Incus is a system container and virtual machine manager. An issue in versions prior to 6.0.6 and 6.19.0 affects any Incus user in an environment where an unprivileged user may have root access to a c… | |||
| CVE-2025-64500 | unknown | — | — | 7mo ago | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Symfony's HttpFoundation component defines an object-oriented layer for the HTTP specification. Start… | |||
| CVE-2025-64099 | unknown | — | — | 7mo ago | OpenAM: Using arbitrary OIDC requested claims values in id_token and user_info is allowed | |||
| CVE-2025-63396 | unknown | — | — | 7mo ago | An issue was discovered in PyTorch v2.5 and v2.7.1. Omission of profiler.stop() can cause torch.profiler.profile (PythonTracer) to crash or hang during finalization, leading to a Denial of Service (D… | |||
| CVE-2025-40163 | unknown | — | — | 7mo ago | In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Stop dl_server before CPU goes offline IBM CI tool reported kernel warning[1] when running a CPU removal operatio… | |||
| CVE-2025-64518 | unknown | — | — | 7mo ago | CycloneDX Core (Java): BOM validation is vulnerable to XML External Entity injection | |||
| CVE-2025-67897 | unknown | — | — | 7mo ago | In Sequoia before 2.1.0, aes_key_unwrap panics if passed a ciphertext that is too short. A remote attacker can take advantage of this issue to crash an application by sending a victim an encrypted me… | |||
| CVE-2025-10713 | unknown | — | — | 7mo ago | WSO2 Carbon Mediation vulnerable to XML External Entity (XXE) attacks | |||
| CVE-2025-62275 | unknown | — | — | 7mo ago | Liferay Portal and DXP do not check permissions of images in a blog entry | |||
| CVE-2025-62276 | unknown | — | — | 7mo ago | Liferay Portal and DXP use an incorrect cache-control header | |||
| CVE-2025-62267 | unknown | — | — | 7mo ago | Liferay Portal and DXP affected by multiple cross-site scripting (XSS) vulnerabilities in web content template’s select structure page | |||
| CVE-2025-62264 | unknown | — | — | 7mo ago | Liferay Portal Vulnerable to Reflected XSS via the selectedLanguageId Parameter | |||
| CVE-2025-57108 | unknown | — | — | 7mo ago | Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap use-after-free vulnerability in vtkGLTFDocumentLoader. The vulnerability manifests during mesh object copy operations where vector me… | |||
| CVE-2025-57107 | unknown | — | — | 7mo ago | Kitware VTK (Visualization Toolkit) through 9.5.0 contains a heap buffer overflow vulnerability in vtkGLTFDocumentLoader. When processing specially crafted GLTF files, the copy constructor of Accesso… | |||
| CVE-2025-57106 | unknown | — | — | 7mo ago | Kitware VTK (Visualization Toolkit) up to 9.5.0 is vulnerable to Buffer Overflow in vtkGLTFDocumentLoader. The vulnerability occurs in the BufferDataExtractionWorker template function when processing… | |||
| CVE-2025-62265 | unknown | — | — | 7mo ago | Liferay Portal is vulnerable to XSS in the Blogs widget | |||
| CVE-2025-62266 | unknown | — | — | 7mo ago | Liferay Portal is vulnerable to DNS rebinding attacks | |||
| CVE-2025-62257 | unknown | — | — | 7mo ago | Liferay Portal vulnerable to password enumeration | |||
| CVE-2025-13327 | unknown | — | — | 7mo ago | A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that … | |||
| CVE-2025-64150 | unknown | — | — | 7mo ago | Jenkins Publish to Bitbucket Plugin is missing a permissions check | |||
| CVE-2025-64147 | unknown | — | — | 7mo ago | Jenkins Curseforge Publisher Plugin does not mask API Keys displayed on the job configuration form | |||
| CVE-2025-64149 | unknown | — | — | 7mo ago | Jenkins Publish to Bitbucket Plugin vulnerable to CSRF and missing permissions check | |||
| CVE-2025-64148 | unknown | — | — | 7mo ago | Jenkins Publish to Bitbucket Plugin is missing a permissions check | |||
| CVE-2025-64140 | unknown | — | — | 7mo ago | Jenkins Azure CLI Plugin does not restrict the commands it executes | |||
| CVE-2025-64135 | unknown | — | — | 7mo ago | Jenkins Eggplant Runner Plugin protection mechanism disabled | |||
| CVE-2025-64145 | unknown | — | — | 7mo ago | Jenkins ByteGuard Build Actions Plugin does not mask API tokens displayed on the job configuration form | |||
| CVE-2025-64133 | unknown | — | — | 7mo ago | Jenkins Extensible Choice Parameter Plugin vulnerable to cross-site request forgery | |||
| CVE-2025-64143 | unknown | — | — | 7mo ago | Jenkins OpenShift Pipeline Plugin stores authorization tokens unencrypted in job config.xml files | |||
| CVE-2025-64139 | unknown | — | — | 7mo ago | Jenkins Start Windocks Containers Plugin is missing a permission check | |||
| CVE-2025-64137 | unknown | — | — | 7mo ago | Jenkins Themis Plugin is missing a permission check | |||
| CVE-2025-64136 | unknown | — | — | 7mo ago | Jenkins Themis Plugin vulnerable to cross-site request forgery | |||
| CVE-2025-64132 | unknown | — | — | 7mo ago | Jenkins MCP Server Plugin does not perform permission checks in multiple MCP tools | |||
| CVE-2025-64142 | unknown | — | — | 7mo ago | Jenkins Nexus Task Runner Plugin is missing a permission check | |||
| CVE-2025-64144 | unknown | — | — | 7mo ago | Jenkins ByteGuard Build Actions Plugin stores API tokens unencrypted in job config.xml files | |||
| CVE-2025-64138 | unknown | — | — | 7mo ago | Jenkins Start Windocks Containers Plugin vulnerable to cross-site request forgery | |||
| CVE-2025-64141 | unknown | — | — | 7mo ago | Jenkins Nexus Task Runner Plugin vulnerable to cross-site request forgery | |||
| CVE-2025-64131 | unknown | — | — | 7mo ago | Jenkins SAML Plugin does not implement a replay cache | |||
| CVE-2025-64134 | unknown | — | — | 7mo ago | Jenkins JDepend Plugin vulnerable to XML external entity attacks | |||
| CVE-2025-62727 | unknown | — | — | 7mo ago | Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-ti… | |||
| CVE-2025-62784 | unknown | — | — | 7mo ago | InventoryGui allows item duplication in GUIs which use GuiStorageElement | |||
| CVE-2025-12390 | unknown | — | — | 7mo ago | Keycloak vulnerable to session takeovers due to reuse of session identifiers | |||
| CVE-2025-62171 | unknown | — | — | 7mo ago | ImageMagick is an open source software suite for displaying, converting, and editing raster image files. In ImageMagick versions prior to 7.1.2-7 and 6.9.13-32, an integer overflow vulnerability exis… | |||
| CVE-2025-40039 | unknown | — | — | 7mo ago | In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix race condition in RPC handle list access The 'sess->rpc_handle_list' XArray manages RPC handles within a ksmbd session… | |||
| CVE-2025-62258 | unknown | — | — | 7mo ago | Liferay Portal Vulnerable to CSRF in Headless APIs | |||
| CVE-2025-62260 | unknown | — | — | 7mo ago | Liferay Portal Vulnerable to DoS via Crafted Headless API Request | |||
| CVE-2025-62259 | unknown | — | — | 7mo ago | Liferay Portal Does Not Limit Access to APIs Before Email Verification | |||
| CVE-2025-62261 | unknown | — | — | 7mo ago | Liferay Portal Stores Password Reset Tokens in Plain Text | |||
| CVE-2025-62594 | unknown | — | — | 7mo ago | ImageMagick is a software suite to create, edit, compose, or convert bitmap images. ImageMagick versions prior to 7.1.2-8 are vulnerable to denial-of-service due to unsigned integer underflow and div… | |||
| CVE-2025-62262 | unknown | — | — | 7mo ago | Liferay Portal Vulnerable to Information Exposure Through a Log File Vulnerability in LDAP Import Feature | |||
| CVE-2025-62253 | unknown | — | — | 7mo ago | Liferay Portal Vulnerable to Open Redirect via the _com_liferay_layout_admin_web_portlet_GroupPagesPortlet_redirect parameter | |||
| CVE-2025-62263 | unknown | — | — | 7mo ago | Liferay Portal Vulnerable to Cross-Site Scripting | |||
| CVE-2025-11419 | unknown | — | — | 7mo ago | Keycloak TLS Client-Initiated Renegotiation Denial of Service | |||
| CVE-2025-62782 | unknown | — | — | 7mo ago | InventoryGui allows item duplication with experimental "Bundle" item in GUIs which use GuiStorageElement | |||
| CVE-2025-62783 | unknown | — | — | 7mo ago | InventoryGui affected by item duplication in GUIs which use GuiStorageElement | |||
| CVE-2025-12194 | unknown | — | — | 7mo ago | Bouncy Castle Vulnerable to Uncontrolled Resource Consumption | |||
| CVE-2025-40022 | unknown | — | — | 7mo ago | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Fix incorrect boolean values in af_alg_ctx Commit 1b34cbbf4f01 ("crypto: af_alg - Disallow concurrent writes in … | |||
| CVE-2025-62254 | unknown | — | — | 7mo ago | Liferay Portal ComboServlet denial of service via large file combination | |||
| CVE-2025-62255 | unknown | — | — | 7mo ago | Liferay Portal Self Cross-site scripting (XSS) vulnerability on the edit Knowledge Base article page | |||
| CVE-2025-60837 | unknown | — | — | 7mo ago | MCMS reflected cross-site scripting (XSS) vulnerability | |||
| CVE-2025-12110 | unknown | — | — | 7mo ago | Keycloak does not invalidate offline sessions when the offline_access scope is removed | |||
| CVE-2025-62256 | unknown | — | — | 7mo ago | Liferay Portal and DXP do not properly restrict access to OpenAPI | |||
| CVE-2025-11429 | unknown | — | — | 7mo ago | Keycloak does not invalidate sessions when "Remember Me" is disabled | |||
| CVE-2025-62247 | unknown | — | — | 7mo ago | Liferay Portal and DXP are Missing Authorization in Collection Provider | |||
| CVE-2025-62248 | unknown | — | — | 7mo ago | Liferay Portal and Liferay DXP vulnerable to reflected cross-site scripting (XSS) | |||
| CVE-2025-62710 | unknown | — | — | 7mo ago | Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl | |||
| CVE-2025-11966 | unknown | — | — | 7mo ago | Vert.x-Web vulnerable to Stored Cross-site Scripting in directory listings via file names | |||
| CVE-2025-11965 | unknown | — | — | 7mo ago | Vert.x-Web Access Control Flaw in StaticHandler’s Hidden File Protection for Files Under Hidden Directories | |||
| CVE-2025-62249 | unknown | — | — | 7mo ago | Liferay Portal reflected cross-site scripting (XSS) vulnerability in the google_gaget | |||
| CVE-2025-62250 | unknown | — | — | 8mo ago | Liferay Portal fails to verify messages from the cluster network is trusted | |||
| CVE-2025-57738 | unknown | — | — | 8mo ago | Apache Syncope allows malicious administrators to inject Groovy code | |||
| CVE-2025-47410 | unknown | — | — | 8mo ago | Apache Geode: CSRF attacks through GET requests to the Management and Monitoring REST API that can execute gfsh commands on the target system | |||
| CVE-2025-56316 | unknown | — | — | 8mo ago | MCMS vulnerable SQL injection via the content_title parameter | |||
| CVE-2025-34281 | unknown | — | — | 8mo ago | ThingsBoard vulnerable to stored cross-site scripting (XSS) vulnerability in the dashboard's Image Upload Gallery feature | |||
| CVE-2025-10044 | unknown | — | — | 8mo ago | Keycloak error_description injection on error pages that can trigger phishing attacks | |||
| CVE-2025-41254 | unknown | — | — | 8mo ago | Spring Framework STOMP over WebSocket applications may allow attackers to send unauthorized messages | |||
| CVE-2025-41253 | unknown | — | — | 8mo ago | Spring Cloud Gateway Server Webflux is vulnerable to Expression Language Injection | |||
| CVE-2025-62371 | unknown | — | — | 8mo ago | OpenSearch Data Prepper plugins trust all SSL certificates by default | |||
| CVE-2025-59419 | unknown | — | — | 8mo ago | Netty has SMTP Command Injection Vulnerability that Allows Email Forgery | |||
| CVE-2025-55039 | unknown | — | — | 8mo ago | Apache Spark has Inadequate Encryption Strength | |||
| CVE-2025-39997 | unknown | — | — | 8mo ago | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free The previous commit 0718a78f6a9f ("ALSA: usb-audio: Kill timer pro… | |||
| CVE-2025-39977 | unknown | — | — | 8mo ago | In the Linux kernel, the following vulnerability has been resolved: futex: Prevent use-after-free during requeue-PI syzbot managed to trigger the following race: T1 … | |||
| CVE-2025-59250 | unknown | — | — | 8mo ago | JDBC Driver for SQL Server has improper input validation issue | |||
| CVE-2025-62251 | unknown | — | — | 8mo ago | Liferay has Incorrect Permission Assignment for Critical Resource |