CVEs published February 25, 2025
144 CVEs were published on February 25, 2025: 11 critical, 45 high.
- Published
- 144
- Critical
- 11
- High
- 45
- Medium
- 71
- Low
- 17
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 30
Most affected products
- NVIDIA CUDA Toolkit
- 10
- xserver · Red Hat Enterprise Linux
- 8
- Benner ModernaNet
- 5
- glpi-project glpi
- 5
- zephyrproject-rtos Zephyr
- 3
- Zoom Communications Zoom Workplace Apps
- 3
- Zoom Communications Zoom Workplace Apps and SDKs
- 3
- Kriesi Enfold - Responsive Multi-Purpose Theme
- 2
- Odoo Community · Odoo Enterprise
- 2
- Tenable Identity Exposure
- 2
Critical 11
- CVE-2023-25574JupyterHub's LTI13Authenticator: JWT signature not validatedjupyterhub ltiauthenticator · jupyterhub-ltiauthenticator
- CVE-2025-26974WordPress WP Multi Store Locator plugin <= 2.5.1 - SQL Injection vulnerabilityWPExperts.io WP Multistore Locator
- CVE-2025-26966WordPress PrivateContent plugin <= 8.11.5 - Unauthenticated Account Takeover vulnerabilityAldo Latino PrivateContent
- CVE-2025-26943WordPress Easy Quotes plugin <= 1.2.2 - SQL Injection vulnerabilityJürgen Müller Easy Quotes
- CVE-2025-26900WordPress Flexmls® IDX Plugin Plugin <= 3.14.27 - PHP Object Injection vulnerabilityFlexmls® IDX
- CVE-2025-1128Everest Forms <= 3.0.9.4 - Unauthenticated Arbitrary File Upload, Read, and Deletionwpeverest Everest Forms – Contact Form, Payment Form, Quiz,…
- CVE-2025-25516Seacms <=13.3 is vulnerable to SQL Injection in admin_paylog.php.
- CVE-2025-25517Seacms <=13.3 is vulnerable to SQL Injection in admin_reslib.php.
- CVE-2025-25519Seacms <=13.3 is vulnerable to SQL Injection in admin_zyk.php.
- CVE-2025-25520Seacms <13.3 is vulnerable to SQL Injection in admin_pay.php.
- CVE-2025-25521Seacms <=13.3 is vulnerable to SQL Injection in admin_type_news.php.
High 45
- CVE-2025-0514Executable hyperlink Windows path targets executed unconditionally on activationThe Document Foundation LibreOffice
- CVE-2025-27148Gradle vulnerable to local privilege escalation through system temporary directorygradle
- CVE-2024-0148NVIDIA Jetson Linux and IGX OS image contains a vulnerability in the UEFI firmware RCM boot mode, where an unprivileged attacker with physicNVIDIA IGX Orin · NVIDIA Jetson AGX Orin Series
- CVE-2025-27110Libmodsecurity3 has possible bypass of encoded HTML entitiesowasp-modsecurity ModSecurity
- CVE-2024-45421Zoom Apps - Buffer OverflowZoom Communications Zoom Apps
- CVE-2024-36259Improper access control in mail module of Odoo Community 17.0 and Odoo Enterprise 17.0 allows remote authenticated attackers to extract sensOdoo Community · Odoo Enterprise
- CVE-2025-27135RAGFlow SQL Injection vulnerabilityinfiniflow ragflow
- CVE-2024-12368Improper access control in the auth_oauth module of Odoo Community 15.0 and Odoo Enterprise 15.0 allows an internal user to export the OAuthOdoo Community · Odoo Enterprise
- CVE-2025-1204The "update" binary in the firmware of the affected product sends attempts to mount to a hard-coded, routable IP address, bypassing existingContec Health CMS8000 Patient Monitor
- CVE-2025-1068There is a code injection vulnerability in Esri ArcGIS AllSourceEsri ArcGIS AllSource
- CVE-2025-1067There is a code injection vulnerability in ArcGIS ProEsri ArcGIS Pro
- CVE-2025-26601Xorg: xwayland: use-after-free in syncinittrigger()xserver · Red Hat Enterprise Linux
- CVE-2025-26600Xorg: xwayland: use-after-free in playreleasedevents()xserver · Red Hat Enterprise Linux
- CVE-2025-26599Xorg: xwayland: use of uninitialized pointer in compredirectwindow()xserver · Red Hat Enterprise Linux
- CVE-2025-26598Xorg: xwayland: out-of-bounds write in createpointerbarrierclient()xserver · Red Hat Enterprise Linux
- CVE-2025-26597Xorg: xwayland: buffer overflow in xkbchangetypesofkey()xserver · Red Hat Enterprise Linux
- CVE-2025-26596Xorg: xwayland: heap overflow in xkbwritekeysyms()xserver · Red Hat Enterprise Linux
- CVE-2025-26595Xorg: xwayland: buffer overflow in xkbvmodmasktext()xserver · Red Hat Enterprise Linux
- CVE-2025-26594X.org: xwayland: use-after-free of the root cursorxserver · Red Hat Enterprise Linux
- CVE-2025-26993WordPress Visual Website Collaboration Atarim plugin <= 4.1.0 - Reflected Cross Site Scripting (XSS) vulnerabilityVito Peleg Atarim
- CVE-2025-26991WordPress WPPizza plugin <= 3.19.4 - Reflected Cross Site Scripting (XSS) vulnerabilityollybach WPPizza
- CVE-2025-26981WordPress Web Accessibility By accessiBe plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerabilityWeb Accessibility By accessiBe
- CVE-2025-26979WordPress Funnel Builder by FunnelKit plugin <= 3.9.0 - Local File Inclusion vulnerabilityAman Funnel Builder by FunnelKit
- CVE-2025-26971WordPress Poll Maker <= 5.6.5 - SQL Injection vulnerabilityAys Pro Poll Maker
- CVE-2025-26964WordPress Eventin plugin <= 4.0.20 - Local File Inclusion vulnerabilityArraytics Eventin
- CVE-2025-26957WordPress Affiliate Coupons plugin <= 1.7.3 - Local File Inclusion vulnerabilityDeetronix Affiliate Coupons
- CVE-2025-26946WordPress WP Yelp Review Slider Plugin <= 8.1 - SQL Injection vulnerabilityjgwhite33 WP Yelp Review Slider
- CVE-2025-26935WordPress WP Job Portal plugin <= 2.2.8 - Local File Inclusion vulnerabilitywpjobportal WP Job Portal
- CVE-2025-26932WordPress WPBot plugin <= 6.3.5 - Local File Inclusion vulnerabilityQuantumCloud ChatBot
- CVE-2025-26931WordPress Tribulant Gallery Voting plugin <= 1.2.1 - CSRF to Stored XSS vulnerabilityTribulant Software Tribulant Gallery Voting
- CVE-2025-26915WordPress Wishlist Plugin <= 1.0.41 - SQL Injection vulnerabilityPickPlugins Wishlist
- CVE-2025-26907WordPress Estatik Mortgage Calculator plugin <= 2.0.12 - Local File Inclusion vulnerabilityMortgage Calculator Estatik
- CVE-2025-26905WordPress Estatik plugin <= 4.3.0 - Local File Inclusion vulnerabilityEstatik
- CVE-2025-26868WordPress Fast Flow plugin <= 1.2.16 - Reflected Cross Site Scripting (XSS) vulnerabilityfastflow Fast Flow
- CVE-2025-26753WordPress VideoWhisper Live Streaming Integration plugin <= 6.2 - Arbitrary File Download vulnerabilityvideowhisper Broadcast Live Video
- CVE-2025-26752WordPress VideoWhisper Live Streaming Integration plugin <= 6.2 - Arbitrary File Deletion vulnerabilityvideowhisper Broadcast Live Video
- CVE-2025-26751WordPress Alphabetic Pagination Plugin <= 3.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityFahad Mahmood Alphabetic Pagination
- CVE-2025-26987WordPress Frontend Admin by DynamiApps plugin <= 3.25.17 - Reflected Cross Site Scripting (XSS) vulnerabilityShabti Kaplan Frontend Admin by DynamiApps
- CVE-2025-26985WordPress Majestic Support plugin <= 1.0.6 - Local File Inclusion vulnerabilityMajestic Support
- CVE-2025-1675Out of bounds read in dns_copy_qnamezephyrproject-rtos Zephyr
- CVE-2025-1674Out of bounds read when unpacking DNS answerszephyrproject-rtos Zephyr
- CVE-2025-1673Out of bounds read when calling crc16_ansi and strlen in dns_validate_msgzephyrproject-rtos Zephyr
- CVE-2025-1648Yawave <= 2.9.1 - Unauthenticated SQL Injectionyawaveadmin Yawave
- CVE-2025-22210Extension - hikashop.com - SQL injection in Hikashop component version 3.3.0 - 5.1.4 for Joomlahikashop.com Hikashop component for Joomla
- CVE-2025-25515Seacms <=13.3 is vulnerable to SQL Injection in admin_collect.php that allows an authenticated attacker to exploit the database.
Medium, low and unrated 88
- CVE-2025-0760Stored Credential Disclosure VulnerabilityTenable Identity Exposure
- CVE-2025-1091Broken Authorization SchemaTenable Identity Exposure
- CVE-2024-30150An unauthenticated privilege escalation vulnerability affects HCL MyCloudHCL Software MyCloud
- CVE-2025-22211Extension - webdesigner-profi.de - SQL injection in JoomShopping component version 1.0.0 - 5.5.5 for Joomlawebdesigner-profi.de JoomShopping component for Joomla
- CVE-2024-53879NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a maNVIDIA CUDA Toolkit
- CVE-2024-53878NVIDIA CUDA toolkit for Linux and Windows contains a vulnerability in the cuobjdump binary, where a user could cause a crash by passing a maNVIDIA CUDA Toolkit
- CVE-2024-27239Zoom Workplace Apps and SDKs - Divide By ZeroZoom Communications Zoom Workplace Apps and SDKs
- CVE-2024-27246Zoom Workplace Apps and SDKs - Use After FreeZoom Communications Zoom Workplace Apps and SDKs
- CVE-2024-27245Zoom Workplace Apps and SDKs - Buffer OverflowZoom Communications Zoom Workplace Apps and SDKs
- CVE-2024-53877NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause a NULL pointer exception by NVIDIA CUDA Toolkit
- CVE-2024-53876NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause an out-of-bounds read by pasNVIDIA CUDA Toolkit
- CVE-2024-53875NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by paNVIDIA CUDA Toolkit
- CVE-2024-53874NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by paNVIDIA CUDA Toolkit
- CVE-2024-53873NVIDIA CUDA toolkit for Windows contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by passing NVIDIA CUDA Toolkit
- CVE-2024-53872NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by paNVIDIA CUDA Toolkit
- CVE-2024-53871NVIDIA CUDA toolkit for all platforms contains a vulnerability in the nvdisasm binary, where a user could cause an out-of-bounds read by pasNVIDIA CUDA Toolkit
- CVE-2024-53870NVIDIA CUDA toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a user could cause an out-of-bounds read by paNVIDIA CUDA Toolkit
- CVE-2025-27146Matrix IRC Bridge allows IRC command injection to own puppeted usermatrix-org matrix-appservice-irc · matrix-appservice-irc
- CVE-2025-27142LocalSend path traversal vulnerability in the file upload endpoint allows nearby devices to execute arbitrary commandslocalsend
- CVE-2024-45418Zoom Apps for macOS - Symbolic Link FollowingZoom Communications Zoom Apps for macOS
- CVE-2025-27139Combodo iTop vulnerable to stored self Cross-site Scripting in preferencesCombodo iTop
- CVE-2024-45417Zoom Apps for macOS - Uncontrolled Resource ConsumptionZoom Communications Zoom Apps for macOS
- CVE-2024-45426Zoom Workplace Apps - Incorrect Ownership AssignmentZoom Communications Zoom Workplace Apps
- CVE-2024-45425Zoom Workplace Apps - Incorrect User ManagementZoom Communications Zoom Workplace Apps
- CVE-2024-45424Zoom Workplace Apps - Business Logic ErrorZoom Communications Zoom Workplace Apps
- CVE-2025-25192GLPI allows unauthorized access to debug modeglpi-project glpi
- CVE-2025-23046GLPI vulnerable to unauthorized authentication by email using the OAuthIMAP pluginglpi-project glpi
- CVE-2025-23024GLPI: Plugins are disabled accessing one pageglpi-project glpi
- CVE-2025-21627GLPI Cross-site Scripting vulnerabilityglpi-project glpi
- CVE-2025-21626GLPI vulnerable to exposure of sensitive information in the `status.php` endpointglpi-project glpi
- CVE-2024-11955GLPI index.php redirectGLPI
- CVE-2025-26995WordPress Market Exporter plugin <= 2.0.21 - Broken Access Control vulnerabilityAnton Vanyukov Market Exporter
- CVE-2025-26983WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.3 - Broken Access Control vulnerabilityWPZOOM Recipe Card Blocks for Gutenberg & Elementor
- CVE-2025-26980WordPress Wired Impact Volunteer Management plugin <= 2.5 - Stored Cross Site Scripting (XSS) vulnerabilityWired Impact Volunteer Management
- CVE-2025-26977WordPress FileBird plugin <= 6.4.2.1 - Insecure Direct Object References (IDOR) vulnerabilityNinja Team Filebird
- CVE-2025-26975WordPress Strong Testimonials plugin <= 3.2.3 - Broken Access Control vulnerabilityWP Chill Strong Testimonials
- CVE-2025-26965WordPress Amelia plugin <= 1.2.16 - Insecure Direct Object References (IDOR) vulnerabilityameliabooking Amelia
- CVE-2025-26963WordPress ClickWhale plugin <= 2.4.3 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityClickWhale
- CVE-2025-26962WordPress Contact Form Plugin plugin <= 1.1.25 - Cross Site Scripting (XSS) vulnerabilityGhozyLab Easy Contact Form Lite
- CVE-2025-26960WordPress Small Package Quotes – Unishippers Edition plugin <= 2.4.9 - Broken Access Control vulnerabilityenituretechnology Small Package Quotes – Unishippers Edition
- CVE-2025-26952WordPress Business Card Block plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerabilitybPlugins Business Card Block
- CVE-2025-26949WordPress Team Section Block plugin <= 1.0.9 - Cross Site Scripting (XSS) vulnerabilitybPlugins Team Section Block
- CVE-2025-26948WordPress Pie Register Premium plugin <= 3.8.3.2 - Broken Access Control vulnerabilityNotFound Pie Register Premium
- CVE-2025-26947WordPress Services Section block plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerabilitybPlugins Services Section block
- CVE-2025-26945WordPress Info Cards plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerabilitybPlugins Info Cards
- CVE-2025-26939WordPress Counters Block plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerabilitybPlugins Counters Block
- CVE-2025-26938WordPress Countdown Timer block plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerabilitybPlugins Countdown Timer
- CVE-2025-26937WordPress Icon List Block plugin <= 1.1.3 - Cross Site Scripting (XSS) vulnerabilitybPlugins Icon List Block
- CVE-2025-26928WordPress Order Limit for WooCommerce plugin <= 3.0.2 - Broken Access Control vulnerabilityXfinitysoft Order Limit for WooCommerce
- CVE-2025-26926WordPress Booknetic plugin < 5.10.4 - Cross Site Request Forgery (CSRF) vulnerabilityBooknetic
- CVE-2025-26913WordPress AR for WordPress plugin <= 7.7 - Cross Site Scripting (XSS) vulnerabilitywebandprint AR For WordPress
- CVE-2025-26912WordPress Easy Elementor Addons plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerabilityhashthemes Easy Elementor Addons
- CVE-2025-26911WordPress System Dashboard plugin <= 2.8.18 - Sensitive Data Exposure vulnerabilityBowo System Dashboard
- CVE-2025-26904WordPress WP Responsive Auto Fit Text plugin <= 0.2 - Cross Site Scripting (XSS) vulnerabilitygal_op WP Responsive Auto Fit Text
- CVE-2025-26897WordPress List Related Attachments plugin <= 2.1.6 - Cross Site Scripting (XSS) vulnerabilityBaden List Related Attachments
- CVE-2025-26896WordPress PiwigoPress plugin <= 2.33 - Cross Site Scripting (XSS) vulnerabilityvpiwigo PiwigoPress
- CVE-2025-26893WordPress Easy Charts plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerabilityKiran Potphode Easy Charts
- CVE-2025-26891WordPress Ibtana plugin <= 1.2.5.9 - Cross Site Scripting (XSS) vulnerabilityVW THEMES Ibtana
- CVE-2025-26887WordPress EZ SQL Reports Shortcode Widget and DB Backup plugin <= 5.21.35 - Cross Site Scripting (XSS) vulnerabilityEli EZ SQL Reports Shortcode Widget and DB Backup
- CVE-2025-26884WordPress Greenshift plugin <= 10.8 - Cross Site Scripting (XSS) vulnerabilitywpsoul Greenshift
- CVE-2025-26882WordPress Popup Builder plugin <= 1.1.33 - Cross Site Scripting (XSS) vulnerabilityGhozyLab Popup Builder
- CVE-2025-26881WordPress Sticky Content plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilitybPlugins Sticky Content
- CVE-2025-26878WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.8.0.1 - Cross Site Scripting (XSS) vulnerabilitypatternsinthecloud Autoship Cloud for WooCommerce Subscript…
- CVE-2025-26877WordPress Front End Users Plugin <= 3.2.30 - Cross Site Scripting (XSS) vulnerabilityRustaurius Front End Users
- CVE-2025-26876WordPress Search with Typesense Plugin <= 2.0.8 - Path Traversal vulnerabilityCodeManas Search with Typesense
- CVE-2025-26871WordPress Essential Blocks plugin <= 4.8.3 - Broken Access Control vulnerabilityWPDeveloper Essential Blocks for Gutenberg
- CVE-2024-54444WordPress Elementor plugin <= 3.25.10 - Cross Site Scripting (XSS) vulnerabilityElementor Website Builder
- CVE-2025-27000WordPress Simple Photo Feed Plugin <= 1.4.0 - Broken Access Control vulnerabilityGeorge Pattichis Simple Photo Feed
- CVE-2024-51539The Dell Secure Connect Gateway (SCG) Application and Appliance, versions prior to 5.28, contains a SQL injection vulnerability due to improDell Secure Connect Gateway - Application · Dell Secure Con…
- CVE-2025-1262Advanced Google reCaptcha <= 1.27 - Built-in Math CAPTCHA Bypasswebfactory Advanced Google reCAPTCHA
- CVE-2025-1676hzmanyun Education and Training System pdf2swf os command injectionhzmanyun Education and Training System
- CVE-2024-13695Enfold <= 6.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery via attachment_idKriesi Enfold - Responsive Multi-Purpose Theme
- CVE-2024-13693Enfold <= 6.0.9 - Missing Authorization to Sensitive Information Disclosure in avia-export-class.phpKriesi Enfold - Responsive Multi-Purpose Theme
- CVE-2024-13494WordPress File Upload <= 4.25.2 - Cross-Site Request Forgery in wfu_file_detailsnickboss Iptanus File Upload
- CVE-2025-1063Classified Listing – Classified ads & Business Directory Plugin <= 4.0.4 - Unauthenticated Settings Exposuretechlabpro1 Classified Listing – AI-Powered Classified ads…
- CVE-2024-10545NextGEN Gallery < 3.59.9 - Admin+ Stored XSSPhoto Gallery, Sliders, Proofing and Themes
- CVE-2025-1646Lumsoft ERP ASPX File UploadAjaxAPI.ashx unrestricted uploadLumsoft ERP
- CVE-2025-1645Benner Connecta EditarLogado resource injectionBenner Connecta
- CVE-2025-27145copyparty renders unsanitized filenames as HTML when user uploads empty files9001 copyparty · copyparty
- CVE-2025-1644Benner ModernaNet SG_Gravar cross-site request forgeryBenner ModernaNet
- CVE-2025-1643Benner ModernaNet SG_AlterarSenha cross-site request forgeryBenner ModernaNet
- CVE-2025-1642Benner ModernaNet GetImageMedico resource injectionBenner ModernaNet
- CVE-2025-1641Benner ModernaNet GetHorariosDoDia sql injectionBenner ModernaNet
- CVE-2025-1640Benner ModernaNet JS_CarregaCombo sql injectionBenner ModernaNet
- CVE-2024-34034An issue was discovered in FlexRIC 2.0.0.
- CVE-2024-34035An issue was discovered in O-RAN Near Realtime RIC H-Release.
- CVE-2024-34036An issue was discovered in O-RAN Near Realtime RIC I-Release.
- CVE-2025-25514Seacms <=13.3 is vulnerable to SQL Injection in admin_collect_news.php.