CVEs from 2025
Total
8,951
critical
critical 1,361
high
high 2,043
medium
medium 2,040
low
low 203
% Critical
15.2%
% with KEV
2.0%
% with exploit
2.8%
Top vendors
- qualcomm 1,123
- fabian 285
- campcodes 232
- phpgurukul 189
- code-projects 121
- redhat 110
- microsoft 107
- portabilis 94
Top products
- i-educar 80
- office_long_term_servicing_channel 35
- office 34
- best_salon_management_system 33
- apartment_management_system 30
- gcp 29
- inventory_management_system 28
- online_learning_management_system 21
Top packages
- Go/github.com/mattermost/mattermost/server/v8 258
- Go/github.com/mattermost/mattermost-server 249
- Packagist/magento/community-edition 231
- Packagist/moodle/moodle 162
- Go/github.com/mattermost/mattermost-server/v5 99
- Go/github.com/mattermost/mattermost-server/v6 99
- Maven/com.liferay.portal:release.dxp.bom 61
- Maven/org.apache.tomcat.embed:tomcat-embed-core 53
| CVE | Severity | CVSS | Risk | Flags | OS | Vendor | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-71085 | medium | — | 5.5 | 3mo ago | Moderate: kernel security update | |||
| CVE-2025-40168 | medium | — | 5.5 | 3mo ago | Moderate: kernel security update | |||
| CVE-2025-14905 | medium | — | 5.5 | 3mo ago | RHSA-2026:5513: 389-ds:1.4 security update (Moderate) | |||
| CVE-2025-38129 | medium | — | 5.5 | 3mo ago | Moderate: kernel security update | |||
| CVE-2025-38206 | medium | — | 5.5 | 3mo ago | Moderate: kernel security update | |||
| CVE-2025-15281 | medium | — | 5.5 | 4mo ago | RHSA-2026:4772: glibc security update (Moderate) | |||
| CVE-2025-68349 | medium | — | 5.5 | 4mo ago | Moderate: kernel security update | |||
| CVE-2025-40064 | medium | — | 5.5 | 4mo ago | Moderate: kernel security update | |||
| CVE-2025-40304 | medium | — | 5.5 | 4mo ago | Moderate: kernel security update | |||
| CVE-2025-40322 | medium | — | 5.5 | 4mo ago | Moderate: kernel security update | |||
| CVE-2025-68811 | medium | — | 5.5 | 4mo ago | Moderate: kernel security update | |||
| CVE-2025-41117 | medium | — | 5.5 | 4mo ago | Grafana has a Cross-site Scripting issue | |||
| CVE-2025-43403 | medium | 5.5 | 5.5 | 4mo ago | An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26. An app may be able to access sensitive user data. | |||
| CVE-2025-15572 | medium | 5.5 | 5.5 | 4mo ago | A vulnerability has been found in wasm3 up to 0.5.0. The affected element is the function NewCodePage. The manipulation leads to memory leak. The attack must be carried out locally. The exploit has b… | |||
| CVE-2025-15571 | medium | 5.5 | 5.5 | 4mo ago | A security vulnerability has been detected in ckolivas lrzip up to 0.651. This vulnerability affects the function ucompthread of the file stream.c. Such manipulation leads to null pointer dereference… | |||
| CVE-2025-40170 | medium | — | 5.5 | 4mo ago | Moderate: kernel security update | |||
| CVE-2025-40318 | medium | — | 5.5 | 4mo ago | Moderate: kernel security update | |||
| CVE-2025-38403 | medium | — | 5.5 | 4mo ago | Moderate: kernel security update | |||
| CVE-2025-38415 | medium | — | 5.5 | 4mo ago | Moderate: kernel security update | |||
| CVE-2025-38022 | medium | — | 5.5 | 4mo ago | Moderate: kernel security update | |||
| CVE-2025-38730 | medium | — | 5.5 | 4mo ago | Moderate: kernel security update | |||
| CVE-2025-40135 | medium | — | 5.5 | 4mo ago | Moderate: kernel security update | |||
| CVE-2025-38459 | medium | — | 5.5 | 4mo ago | Moderate: kernel security update | |||
| CVE-2025-40269 | medium | — | 5.5 | 4mo ago | Moderate: kernel security update | |||
| CVE-2025-38024 | medium | — | 5.5 | 4mo ago | Moderate: kernel security update | |||
| CVE-2025-40141 | medium | — | 5.5 | 4mo ago | Moderate: kernel security update | |||
| CVE-2025-37819 | medium | — | 5.5 | 4mo ago | Moderate: kernel security update | |||
| CVE-2025-37789 | medium | — | 5.5 | 4mo ago | Moderate: kernel security update | |||
| CVE-2025-40158 | medium | — | 5.5 | 4mo ago | Moderate: kernel security update | |||
| CVE-2025-15564 | medium | 5.5 | 5.5 | 4mo ago | A vulnerability has been found in Mapnik up to 4.2.0. This vulnerability affects the function mapnik::detail::mod<...>::operator of the file src/value.cpp. The manipulation leads to divide by zero. T… | |||
| CVE-2025-14104 | medium | — | 5.5 | 4mo ago | Moderate: util-linux security update | |||
| CVE-2025-38568 | medium | — | 5.5 | 4mo ago | Moderate: kernel security update | |||
| CVE-2025-40251 | medium | 5.5 | 5.5 | 4mo ago | Moderate: kernel security update | |||
| CVE-2025-40154 | medium | — | 5.5 | 4mo ago | Moderate: kernel security update | |||
| CVE-2025-71191 | medium | 5.5 | 5.5 | 4mo ago | In the Linux kernel, the following vulnerability has been resolved: dmaengine: at_hdmac: fix device leak on of_dma_xlate() Make sure to drop the reference taken when looking up the DMA platform dev… | |||
| CVE-2025-71190 | medium | 5.5 | 5.5 | 4mo ago | In the Linux kernel, the following vulnerability has been resolved: dmaengine: bcm-sba-raid: fix device leak on probe Make sure to drop the reference taken when looking up the mailbox device during… | |||
| CVE-2025-71189 | medium | 5.5 | 5.5 | 4mo ago | In the Linux kernel, the following vulnerability has been resolved: dmaengine: dw: dmamux: fix OF node leak on route allocation failure Make sure to drop the reference taken to the DMA master OF no… | |||
| CVE-2025-71188 | medium | 5.5 | 5.5 | 4mo ago | In the Linux kernel, the following vulnerability has been resolved: dmaengine: lpc18xx-dmamux: fix device leak on route allocation Make sure to drop the reference taken when looking up the DMA mux … | |||
| CVE-2025-71186 | medium | 5.5 | 5.5 | 4mo ago | In the Linux kernel, the following vulnerability has been resolved: dmaengine: stm32: dmamux: fix device leak on route allocation Make sure to drop the reference taken when looking up the DMA mux p… | |||
| CVE-2025-71185 | medium | 5.5 | 5.5 | 4mo ago | In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: dma-crossbar: fix device leak on am335x route allocation Make sure to drop the reference taken when looking up the… | |||
| CVE-2025-54349 | medium | — | 5.5 | 4mo ago | RHSA-2026:1592: iperf3 security update (Moderate) | |||
| CVE-2025-14177 | medium | — | 5.5 | 4mo ago | RHSA-2026:2470: php:7.4 security update (Moderate) | |||
| CVE-2025-14178 | medium | — | 5.5 | 4mo ago | RHSA-2026:2470: php:7.4 security update (Moderate) | |||
| CVE-2025-12084 | medium | — | 5.5 | 4mo ago | Moderate: python3.12 security update | |||
| CVE-2025-71161 | medium | 5.5 | 5.5 | 4mo ago | In the Linux kernel, the following vulnerability has been resolved: dm-verity: disable recursive forward error correction There are two problems with the recursive correction: 1. It may cause deni… | |||
| CVE-2025-4763 | medium | 5.5 | 5.5 | 5mo ago | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Aida Computer Information Technology Inc. Hotel Guest Hotspot allows Reflected XSS. This … | |||
| CVE-2025-67726 | medium | — | 5.5 | 5mo ago | RHSA-2026:0930: pcs security update (Moderate) | |||
| CVE-2025-67725 | medium | — | 5.5 | 5mo ago | RHSA-2026:0930: pcs security update (Moderate) | |||
| CVE-2025-15537 | medium | 5.5 | 5.5 | 5mo ago | A security vulnerability has been detected in Mapnik up to 4.2.0. This issue affects the function mapnik::dbf_file::string_value of the file plugins/input/shape/dbfile.cpp. Such manipulation leads to… | |||
| CVE-2025-15536 | medium | 5.5 | 5.5 | 5mo ago | A weakness has been identified in BYVoid OpenCC up to 1.1.9. This vulnerability affects the function opencc::MaxMatchSegmentation of the file src/MaxMatchSegmentation.cpp. This manipulation causes he… | |||
| CVE-2025-46397 | medium | — | 5.5 | 5mo ago | RHSA-2026:0756: transfig security update (Moderate) | |||
| CVE-2025-13454 | medium | 5.5 | 5.5 | 5mo ago | A potential vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to gain access to sensitive device information. | |||
| CVE-2025-14242 | medium | — | 5.5 | 5mo ago | RHSA-2026:0608: vsftpd security update (Moderate) | |||
| CVE-2025-68823 | medium | 5.5 | 5.5 | 5mo ago | In the Linux kernel, the following vulnerability has been resolved: ublk: fix deadlock when reading partition table When one process(such as udev) opens ublk block device (e.g., to read the partiti… | |||
| CVE-2025-12817 | medium | — | 5.5 | 5mo ago | Moderate: postgresql:15 security update | |||
| CVE-2025-12818 | medium | — | 5.5 | 5mo ago | Moderate: postgresql:15 security update | |||
| CVE-2025-40240 | medium | — | 5.5 | 5mo ago | Moderate: kernel security update | |||
| CVE-2025-39840 | medium | — | 5.5 | 5mo ago | Moderate: kernel security update | |||
| CVE-2025-39883 | medium | — | 5.5 | 5mo ago | Moderate: kernel security update | |||
| CVE-2025-15504 | medium | 5.5 | 5.5 | 5mo ago | LIEF is vulnerable to segmentation fault | |||
| CVE-2025-61915 | medium | — | 5.5 | 5mo ago | RHSA-2026:0596: cups security update (Moderate) | |||
| CVE-2025-58436 | medium | — | 5.5 | 5mo ago | RHSA-2026:0596: cups security update (Moderate) | |||
| CVE-2025-32365 | medium | — | 5.5 | 5mo ago | Poppler before 25.04.0 allows crafted input files to trigger out-of-bounds reads in the JBIG2Bitmap::combine function in JBIG2Stream.cc because of a misplaced isOk check. | |||
| CVE-2025-45582 | medium | — | 5.5 | 5mo ago | Moderate: tar security update | |||
| CVE-2025-15419 | medium | 5.5 | 5.5 | 5mo ago | A weakness has been identified in Open5GS up to 2.7.6. Affected by this issue is the function sgwc_s5c_handle_create_session_response of the file src/sgwc/s5c-handler.c of the component GTPv2-C Flow … | |||
| CVE-2025-15418 | medium | 5.5 | 5.5 | 5mo ago | A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function ogs_gtp2_parse_bearer_qos in the library lib/gtp/v2/types.c of the component Bearer QoS IE L… | |||
| CVE-2025-15417 | medium | 5.5 | 5.5 | 5mo ago | A vulnerability was identified in Open5GS up to 2.7.6. Affected is the function sgwc_s11_handle_create_session_request of the file src/sgwc/s11-handler.c of the component GTPv2-C F-TEID Handler. Such… | |||
| CVE-2025-14957 | medium | 5.5 | 5.5 | 6mo ago | A vulnerability was identified in WebAssembly Binaryen up to 125. This affects the function IRBuilder::makeLocalGet/IRBuilder::makeLocalSet/IRBuilder::makeLocalTee of the file src/wasm/wasm-ir-builde… | |||
| CVE-2025-5987 | medium | — | 5.5 | 6mo ago | Moderate: libssh security update | |||
| CVE-2025-1735 | medium | — | 5.5 | 6mo ago | RHSA-2026:2470: php:7.4 security update (Moderate) | |||
| CVE-2025-1220 | medium | — | 5.5 | 6mo ago | RHSA-2026:2470: php:7.4 security update (Moderate) | |||
| CVE-2025-6491 | medium | — | 5.5 | 6mo ago | RHSA-2026:2470: php:7.4 security update (Moderate) | |||
| CVE-2025-8291 | medium | — | 5.5 | 6mo ago | The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD re… | |||
| CVE-2025-61984 | medium | — | 5.5 | 6mo ago | ssh in OpenSSH before 10.1 allows control characters in usernames that originate from certain possibly untrusted sources, potentially leading to code execution when a ProxyCommand is used. The untrus… | |||
| CVE-2025-38499 | medium | 5.5 | 5.5 | 6mo ago | Important: kernel security update | |||
| CVE-2025-61985 | medium | — | 5.5 | 6mo ago | ssh in OpenSSH before 10.1 allows the '\0' character in an ssh:// URI, potentially leading to code execution when a ProxyCommand is used. | |||
| CVE-2025-53069 | medium | — | 5.5 | 6mo ago | RHSA-2025:23137: mysql:8.4 security update (Moderate) | |||
| CVE-2025-53062 | medium | — | 5.5 | 6mo ago | RHSA-2025:23137: mysql:8.4 security update (Moderate) | |||
| CVE-2025-53045 | medium | — | 5.5 | 6mo ago | RHSA-2025:23137: mysql:8.4 security update (Moderate) | |||
| CVE-2025-53044 | medium | — | 5.5 | 6mo ago | RHSA-2025:23137: mysql:8.4 security update (Moderate) | |||
| CVE-2025-53040 | medium | — | 5.5 | 6mo ago | RHSA-2025:23137: mysql:8.4 security update (Moderate) | |||
| CVE-2025-53054 | medium | — | 5.5 | 6mo ago | RHSA-2025:23137: mysql:8.4 security update (Moderate) | |||
| CVE-2025-53053 | medium | — | 5.5 | 6mo ago | RHSA-2025:23137: mysql:8.4 security update (Moderate) | |||
| CVE-2025-53042 | medium | — | 5.5 | 6mo ago | RHSA-2025:23137: mysql:8.4 security update (Moderate) | |||
| CVE-2025-39979 | medium | — | 5.5 | 6mo ago | Moderate: kernel security update | |||
| CVE-2025-39925 | medium | — | 5.5 | 6mo ago | Moderate: kernel security update | |||
| CVE-2025-48600 | medium | 5.5 | 5.5 | 6mo ago | In multiple files, there is a possible way to reveal information across users due to a missing permission check. This could lead to local information disclosure with no additional execution privilege… | |||
| CVE-2025-11222 | medium | — | 5.5 | 6mo ago | Central Dogma's Login Function Has an Open Redirect Vulnerability | |||
| CVE-2025-14010 | medium | 5.5 | 5.5 | 6mo ago | Ansible Community General Collection is vulnerable to exposure of sensitive information | |||
| CVE-2025-40186 | medium | — | 5.5 | 6mo ago | In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). syzbot reported the splat below in tcp_conn_request(). [0] If a l… | |||
| CVE-2025-40185 | medium | — | 5.5 | 6mo ago | Moderate: kernel security update | |||
| CVE-2025-9714 | medium | 5.5 | 5.5 | 6mo ago | Uncontrolled recursion in XPath evaluation in libxml2 up to and including version 2.9.14 allows a local attacker to cause a stack overflow via crafted expressions. XPath processing functions `xmlXPat… | |||
| CVE-2025-40058 | medium | — | 5.5 | 6mo ago | Moderate: kernel security update | |||
| CVE-2025-39981 | medium | — | 5.5 | 6mo ago | Moderate: kernel security update | |||
| CVE-2025-39955 | medium | — | 5.5 | 6mo ago | Moderate: kernel security update | |||
| CVE-2025-39918 | medium | — | 5.5 | 6mo ago | Moderate: kernel security update | |||
| CVE-2025-39898 | medium | — | 5.5 | 6mo ago | Moderate: kernel security update | |||
| CVE-2025-39843 | medium | 5.5 | 5.5 | 6mo ago | Moderate: kernel security update | |||
| CVE-2025-58183 | medium | — | 5.5 | 7mo ago | Moderate: image-builder security update | |||
| CVE-2025-40047 | medium | — | 5.5 | 7mo ago | In the Linux kernel, the following vulnerability has been resolved: io_uring/waitid: always prune wait queue entry in io_waitid_wait() For a successful return, always remove our entry from the wait… |