# CVEs published 2025-02-27

275 CVEs were published on February 27, 2025: 19 critical, 112 high. Days are UTC.

- [CVE-2024-12811](https://cve.now/CVE-2024-12811.md): Traveler \<= 3.1.9 - Authenticated (Contributor+) Local File Inclusion via Shortcode (CVSS 8.8, ShineTheme Travel Booking WordPress Theme)
- [CVE-2025-1687](https://cve.now/CVE-2025-1687.md): Cardealer \<= 1.6.4 - Cross-Site Request Forgery to User Update via update\_user\_profile (CVSS 8.8, ThemeMakers Car Dealer Automotive WordPress Theme – Respons…)
- [CVE-2025-1682](https://cve.now/CVE-2025-1682.md): Cardealer \<= 1.6.4 - Arbitrary Theme Option Update to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, ThemeMakers Car Dealer Automotive WordPress Theme – Respons…)
- [CVE-2025-1681](https://cve.now/CVE-2025-1681.md): Cardealer \<= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Change and Delete JS and CSS Files (CVSS 5.4, ThemeMakers Car Dealer Automotive WordPress Theme – Respons…)
- [CVE-2025-24832](https://cve.now/CVE-2025-24832.md): Arbitrary file overwrite during home directory recovery due to improper symbolic link handling. (CVSS 4.4, Acronis Backup plugin for cPanel & WHM · Acronis Backup ext…)
- [CVE-2025-21824](https://cve.now/CVE-2025-21824.md): gpu: host1x: Fix a use of uninitialized mutex (CVSS 5.5, Linux)
- [CVE-2025-21823](https://cve.now/CVE-2025-21823.md): batman-adv: Drop unmanaged ELP metric worker (CVSS 7.8, Linux)
- [CVE-2025-21822](https://cve.now/CVE-2025-21822.md): ptp: vmclock: Set driver data before its usage (no CVSS, Linux)
- [CVE-2025-21821](https://cve.now/CVE-2025-21821.md): fbdev: omap: use threaded IRQ for LCD DMA (no CVSS, Linux)
- [CVE-2025-21820](https://cve.now/CVE-2025-21820.md): tty: xilinx\_uartps: split sysrq handling (no CVSS, Linux)
- [CVE-2025-21819](https://cve.now/CVE-2025-21819.md): Revert "drm/amd/display: Use HW lock mgr for PSR1" (no CVSS, Linux)
- [CVE-2025-21817](https://cve.now/CVE-2025-21817.md): block: mark GFP\_NOIO around sysfs -\>store() (no CVSS, Linux)
- [CVE-2025-21816](https://cve.now/CVE-2025-21816.md): hrtimers: Force migrate away hrtimers queued after CPUHP\_AP\_HRTIMERS\_DYING (no CVSS, Linux)
- [CVE-2025-21815](https://cve.now/CVE-2025-21815.md): mm/compaction: fix UBSAN shift-out-of-bounds warning (no CVSS, Linux)
- [CVE-2025-21814](https://cve.now/CVE-2025-21814.md): ptp: Ensure info-\>enable callback is always set (no CVSS, Linux)
- [CVE-2025-21813](https://cve.now/CVE-2025-21813.md): timers/migration: Fix off-by-one root mis-connection (no CVSS, Linux)
- [CVE-2025-21812](https://cve.now/CVE-2025-21812.md): ax25: rcu protect dev-\>ax25\_ptr (CVSS 7.8, Linux)
- [CVE-2025-21811](https://cve.now/CVE-2025-21811.md): nilfs2: protect access to buffers with no active references (CVSS 7.8, Linux)
- [CVE-2025-21810](https://cve.now/CVE-2025-21810.md): driver core: class: Fix wild pointer dereferences in API class\_dev\_iter\_next() (CVSS 7.8, Linux)
- [CVE-2025-21809](https://cve.now/CVE-2025-21809.md): rxrpc, afs: Fix peer hash locking vs RCU callback (CVSS 7.5, Linux)
- [CVE-2025-21808](https://cve.now/CVE-2025-21808.md): net: xdp: Disallow attaching device-bound programs in generic mode (CVSS 7.8, Linux)
- [CVE-2025-21807](https://cve.now/CVE-2025-21807.md): block: fix queue freeze vs limits lock order in sysfs store methods (no CVSS, Linux)
- [CVE-2025-21806](https://cve.now/CVE-2025-21806.md): net: let net.core.dev\_weight always be non-zero (no CVSS, Linux)
- [CVE-2025-21805](https://cve.now/CVE-2025-21805.md): RDMA/rtrs: Add missing deinit() call (CVSS 9.8, Linux)
- [CVE-2025-21804](https://cve.now/CVE-2025-21804.md): PCI: rcar-ep: Fix incorrect variable used when calling devm\_request\_mem\_region() (CVSS 7.1, Linux)
- [CVE-2025-21803](https://cve.now/CVE-2025-21803.md): LoongArch: Fix warnings during S3 suspend (no CVSS, Linux)
- [CVE-2025-21802](https://cve.now/CVE-2025-21802.md): net: hns3: fix oops when unload drivers paralleling (no CVSS, Linux)
- [CVE-2025-21801](https://cve.now/CVE-2025-21801.md): net: ravb: Fix missing rtnl lock in suspend/resume path (CVSS 7.8, Linux)
- [CVE-2025-21800](https://cve.now/CVE-2025-21800.md): net/mlx5: HWS, fix definer's HWS\_SET32 macro for negative offset (no CVSS, Linux)
- [CVE-2025-21799](https://cve.now/CVE-2025-21799.md): net: ethernet: ti: am65-cpsw: fix freeing IRQ in am65\_cpsw\_nuss\_remove\_tx\_chns() (no CVSS, Linux)
- [CVE-2025-21798](https://cve.now/CVE-2025-21798.md): firewire: test: Fix potential null dereference in firewire kunit test (CVSS 5.5, Linux)
- [CVE-2024-58042](https://cve.now/CVE-2024-58042.md): rhashtable: Fix potential deadlock by moving schedule\_work outside lock (CVSS 5.5, Linux)
- [CVE-2024-58034](https://cve.now/CVE-2024-58034.md): memory: tegra20-emc: fix an OF node reference bug in tegra\_emc\_find\_node\_by\_ram\_code() (CVSS 7.8, Linux)
- [CVE-2024-58022](https://cve.now/CVE-2024-58022.md): mailbox: th1520: Fix a NULL vs IS\_ERR() bug (CVSS 5.5, Linux)
- [CVE-2025-22624](https://cve.now/CVE-2025-22624.md): FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry and Carousel 2.4.29 - Reflected cross-site scripting (XSS) (CVSS 5.1, bradvin FooGallery - Responsive Photo Gallery, Image Viewer…)
- [CVE-2025-0767](https://cve.now/CVE-2025-0767.md): WP Activity Log 5.3.2 - Insecure deserialization (CVSS 6.3, Melapress WP Activity Log)
- [CVE-2025-1745](https://cve.now/CVE-2025-1745.md): LinZhaoguan pb-cms Logout cross-site request forgery (CVSS 5.3, LinZhaoguan pb-cms)
- [CVE-2025-1743](https://cve.now/CVE-2025-1743.md): zyx0814 Pichome index.php path traversal (CVSS 6.9, zyx0814 Pichome)
- [CVE-2025-27399](https://cve.now/CVE-2025-27399.md): Mastodon's domain blocks & rationales ignore user approval when visibility set as "users" (CVSS 5.3, mastodon)
- [CVE-2025-27157](https://cve.now/CVE-2025-27157.md): Mastodon's rate-limits are missing on \`/auth/setup\` (CVSS 5.3, mastodon)
- [CVE-2025-1742](https://cve.now/CVE-2025-1742.md): pihome-shc PiHome home.php cross site scripting (CVSS 5.3, pihome-shc PiHome)
- [CVE-2024-9285](https://cve.now/CVE-2024-9285.md): Tu Yafeng Via Browser Javascript Bridge cross site scripting (CVSS 5.3, Tu Yafeng Via Browser)
- [CVE-2025-23687](https://cve.now/CVE-2025-23687.md): WordPress Woo Store Mode plugin \<= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, simonhunter Woo Store Mode)
- [CVE-2025-0914](https://cve.now/CVE-2025-0914.md): Velociraptor Shell Plugin Prevent\_execve Bypass (CVSS 3.8, Rapid7 Velociraptor)
- [CVE-2025-1741](https://cve.now/CVE-2025-1741.md): b1gMail Admin Page users.php deserialization (CVSS 5.1, b1gMail)
- [CVE-2025-1756](https://cve.now/CVE-2025-1756.md): MongoDB Shell may be susceptible to local privilege escalation in Windows (CVSS 7.5, MongoDB mongosh · mongosh)
- [CVE-2025-1755](https://cve.now/CVE-2025-1755.md): MongoDB Compass may be susceptible to local privilege escalation in Windows (CVSS 7.5, MongoDB Compass)
- [CVE-2024-54170](https://cve.now/CVE-2024-54170.md): IBM EntireX denial of service (CVSS 5.5, IBM EntireX)
- [CVE-2024-54169](https://cve.now/CVE-2024-54169.md): IBM EntireX path traversal (CVSS 6.5, IBM EntireX)
- [CVE-2025-0759](https://cve.now/CVE-2025-0759.md): IBM EntireX race condition (CVSS 3.3, IBM EntireX)
- [CVE-2024-56810](https://cve.now/CVE-2024-56810.md): IBM EntireX information disclosure (CVSS 3.3, IBM EntireX)
- [CVE-2024-56496](https://cve.now/CVE-2024-56496.md): IBM EntireX information disclosure (CVSS 3.3, IBM EntireX)
- [CVE-2024-56495](https://cve.now/CVE-2024-56495.md): IBM EntireX information disclosure (CVSS 3.3, IBM EntireX)
- [CVE-2024-56811](https://cve.now/CVE-2024-56811.md): IBM EntireX information disclosure (CVSS 3.3, IBM EntireX)
- [CVE-2024-56493](https://cve.now/CVE-2024-56493.md): IBM EntireX information disclosure (CVSS 3.3, IBM EntireX)
- [CVE-2024-56494](https://cve.now/CVE-2024-56494.md): IBM EntireX information disclosure (CVSS 3.3, IBM EntireX)
- [CVE-2024-56812](https://cve.now/CVE-2024-56812.md): IBM EntireX information disclosure (CVSS 3.3, IBM EntireX)
- [CVE-2024-13148](https://cve.now/CVE-2024-13148.md): SQLi in Yukseloglu Filter's B2B Login Platform (CVSS 9.8, Yukseloglu Filter B2B Login Platform)
- [CVE-2025-22280](https://cve.now/CVE-2025-22280.md): WordPress DefendWP Firewall Plugin \<= 1.1.0 - Broken Access Control vulnerability (CVSS 7.6, revmakx DefendWP Firewall)
- [CVE-2024-9334](https://cve.now/CVE-2024-9334.md): Information Disclosure in E-Kent's Pallium Vehicle Tracking (CVSS 8.2, E-Kent Pallium Vehicle Tracking)
- [CVE-2025-27154](https://cve.now/CVE-2025-27154.md): Spotipy's cache file, containing spotify auth token, is created with overly broad permissions (CVSS 8.4, spotipy-dev spotipy · spotipy)
- [CVE-2024-13402](https://cve.now/CVE-2024-13402.md): BuddyBoss Platform \<= 2.7.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'link\_title' (CVSS 6.4, Boss Media BuddyBoss Platform)
- [CVE-2025-1739](https://cve.now/CVE-2025-1739.md): Multiple vulnerabilities in Trivision Camera NC227WF (CVSS 7.1, Trivision Camera NC227WF)
- [CVE-2025-1693](https://cve.now/CVE-2025-1693.md): MongoDB Shell may be susceptible to control character Injection via shell output (CVSS 3.9, MongoDB mongosh · mongosh)
- [CVE-2025-1692](https://cve.now/CVE-2025-1692.md): MongoDB Shell may be susceptible to control character injection via pasting (CVSS 6.3, MongoDB mongosh · mongosh)
- [CVE-2025-1691](https://cve.now/CVE-2025-1691.md): MongoDB Shell may be susceptible to Control Character Injection via autocomplete (CVSS 7.6, MongoDB mongosh · mongosh)
- [CVE-2025-1738](https://cve.now/CVE-2025-1738.md): Multiple vulnerabilities in Trivision Camera NC227WF (CVSS 6.2, Trivision Camera NC227WF)
- [CVE-2025-1751](https://cve.now/CVE-2025-1751.md): SQL Injection CIGES (CVSS 9.8, ATISoluciones CIGES)
- [CVE-2024-10918](https://cve.now/CVE-2024-10918.md): Stack-based Buffer Overflow in libmodbus library (CVSS 4.8, libmodbus)
- [CVE-2024-13217](https://cve.now/CVE-2024-13217.md): Jeg Elementor Kit \<= 2.6.11 - Authenticated (Contributor+) Sensitive Information Exposure via Countdown and Off-Canvas (CVSS 4.3, jegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…)
- [CVE-2025-1450](https://cve.now/CVE-2025-1450.md): Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button, WhatsApp – Chaty \<= 3.3.5 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4, premio Floating Chat Widget: Contact Chat Icons, Telegram C…)
- [CVE-2024-13734](https://cve.now/CVE-2024-13734.md): Card Elements for Elementor \<= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Profile Card Widget (CVSS 6.4, techeshta Card Elements for Elementor)
- [CVE-2025-1282](https://cve.now/CVE-2025-1282.md): Car Dealer Automotive WordPress Theme – Responsive \<= 1.6.3 - Authenticated (Subscriber+) Arbitrary File Deletion and Read (CVSS 8.8, ThemeMakers Car Dealer Automotive WordPress Theme – Respons…)
- [CVE-2025-1690](https://cve.now/CVE-2025-1690.md): ThemeMakers Stripe Checkout \<= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, ThemeMakers Stripe Checkout)
- [CVE-2025-1717](https://cve.now/CVE-2025-1717.md): Login Me Now \<= 1.7.2 - Authentication Bypass (CVSS 8.1, pluginly Login Me Now – Passwordless, Magic Link, OTP & Soc…)
- [CVE-2024-5848](https://cve.now/CVE-2024-5848.md): Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products Due to Improper Input Validation (CVSS 6.1, WSO2 API Manager · WSO2 Open Banking AM)
- [CVE-2024-0392](https://cve.now/CVE-2024-0392.md): Cross-Site Request Forgery (CSRF) in WSO2 Enterprise Integrator 6.6.0 Management Console Due to Missing CSRF Token Validation (CVSS 5.4, WSO2 Enterprise Integrator)
- [CVE-2025-1689](https://cve.now/CVE-2025-1689.md): ThemeMakers PayPal Express Checkout \<= 1.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, ThemeMakers PayPal Express Checkout)
- [CVE-2024-13907](https://cve.now/CVE-2024-13907.md): Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid \<= 1.16.8 - Authenticated (Administrator+) Server-Side Request Forgery (CVSS 4.9, Total Upkeep – WordPress Backup Plugin plus Restore & Migra…)
- [CVE-2024-2297](https://cve.now/CVE-2024-2297.md): Bricksbuilder \<= 1.9.6.1 - Authenticated (Contributor+) Privilege Escalation via create\_autosave (CVSS 7.1, Bricks Builder Bricks)
- [CVE-2024-6261](https://cve.now/CVE-2024-6261.md): Image Photo Gallery Final Tiles Grid \<= 3.6.0 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting (CVSS 6.4, wpchill Image Photo Gallery Final Tiles Grid)
- [CVE-2025-1295](https://cve.now/CVE-2025-1295.md): Templines Elementor Helper Core \<= 2.7 - Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, Templines Elementor Helper Core)
- [CVE-2025-1686](https://cve.now/CVE-2025-1686.md): Versions of the package io.pebbletemplates:pebble from 0 and before 4.1.0 are vulnerable to External Control of File Name or Path via the in (CVSS 6.1, io.pebbletemplates:pebble)
- [CVE-2024-13905](https://cve.now/CVE-2024-13905.md): OneStore Sites \<= 0.1.1 - Unauthenticated Blind Server-Side Request Forgery (CVSS 5.3, sainwp OneStore Sites)
- [CVE-2024-13647](https://cve.now/CVE-2024-13647.md): School Management System – SakolaWP \<= 1.0.8 - Cross-Site Request Forgery to Exam Setting Manipulation (CVSS 4.3, themesawesome School Management System – SakolaWP)
- [CVE-2025-0469](https://cve.now/CVE-2025-0469.md): Forminator \<= 1.39.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2024-2321](https://cve.now/CVE-2024-2321.md): Incorrect Authorization in Multiple WSO2 Products Allows API Access via Refresh Token (CVSS 5.6, WSO2 API Manager · WSO2 Identity Server +2)
- [CVE-2025-21797](https://cve.now/CVE-2025-21797.md): HID: corsair-void: Add missing delayed work cancel for headset status (CVSS 7.8, Linux)
- [CVE-2025-21796](https://cve.now/CVE-2025-21796.md): nfsd: clear acl\_access/acl\_default after releasing them (CVSS 9.8, Linux)
- [CVE-2025-21795](https://cve.now/CVE-2025-21795.md): NFSD: fix hang in nfsd4\_shutdown\_callback (CVSS 7.5, Linux)
- [CVE-2025-21794](https://cve.now/CVE-2025-21794.md): HID: hid-thrustmaster: fix stack-out-of-bounds read in usb\_check\_int\_endpoints() (CVSS 7.1, Linux)
- [CVE-2025-21793](https://cve.now/CVE-2025-21793.md): spi: sn-f-ospi: Fix division by zero (CVSS 5.5, Linux)
- [CVE-2025-21792](https://cve.now/CVE-2025-21792.md): ax25: Fix refcount leak caused by setting SO\_BINDTODEVICE sockopt (CVSS 7.8, Linux)
- [CVE-2025-21791](https://cve.now/CVE-2025-21791.md): vrf: use RCU protection in l3mdev\_l3\_out() (CVSS 7.8, Linux)
- [CVE-2025-21790](https://cve.now/CVE-2025-21790.md): vxlan: check vxlan\_vnigroup\_init() return value (CVSS 5.5, Linux)
- [CVE-2025-21789](https://cve.now/CVE-2025-21789.md): LoongArch: csum: Fix OoB access in IP checksum code for negative lengths (CVSS 7.3, Linux)
- [CVE-2025-21788](https://cve.now/CVE-2025-21788.md): net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases (CVSS 7.5, Linux)
- [CVE-2025-21787](https://cve.now/CVE-2025-21787.md): team: better TEAM\_OPTION\_TYPE\_STRING validation (no CVSS, Linux)
- [CVE-2025-21786](https://cve.now/CVE-2025-21786.md): workqueue: Put the pwq after detaching the rescuer from the pool (CVSS 7.8, Linux)
- [CVE-2025-21785](https://cve.now/CVE-2025-21785.md): arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CVSS 7.8, Linux)
- [CVE-2025-21784](https://cve.now/CVE-2025-21784.md): drm/amdgpu: bail out when failed to load fw in psp\_init\_cap\_microcode() (no CVSS, Linux)
- [CVE-2025-21783](https://cve.now/CVE-2025-21783.md): gpiolib: Fix crash on error in gpiochip\_get\_ngpios() (CVSS 5.5, Linux)
- [CVE-2025-21782](https://cve.now/CVE-2025-21782.md): orangefs: fix a oob in orangefs\_debug\_write (no CVSS, Linux)
- [CVE-2025-21781](https://cve.now/CVE-2025-21781.md): batman-adv: fix panic during interface removal (no CVSS, Linux)
- [CVE-2025-21780](https://cve.now/CVE-2025-21780.md): drm/amdgpu: avoid buffer overflow attach in smu\_sys\_set\_pp\_table() (CVSS 7.8, Linux)
- [CVE-2025-21779](https://cve.now/CVE-2025-21779.md): KVM: x86: Reject Hyper-V's SEND\_IPI hypercalls if local APIC isn't in-kernel (no CVSS, Linux)
- [CVE-2025-21778](https://cve.now/CVE-2025-21778.md): tracing: Do not allow mmap() of persistent ring buffer (CVSS 7.8, Linux)
- [CVE-2025-21777](https://cve.now/CVE-2025-21777.md): ring-buffer: Validate the persistent meta data subbuf array (no CVSS, Linux)
- [CVE-2025-21776](https://cve.now/CVE-2025-21776.md): USB: hub: Ignore non-compliant devices with too many configs or interfaces (no CVSS, Linux)
- [CVE-2025-21775](https://cve.now/CVE-2025-21775.md): can: ctucanfd: handle skb allocation failure (CVSS 5.5, Linux)
- [CVE-2025-21774](https://cve.now/CVE-2025-21774.md): can: rockchip: rkcanfd\_handle\_rx\_fifo\_overflow\_int(): bail out if skb cannot be allocated (CVSS 5.5, Linux)
- [CVE-2025-21773](https://cve.now/CVE-2025-21773.md): can: etas\_es58x: fix potential NULL pointer dereference on udev-\>serial (CVSS 5.5, Linux)
- [CVE-2025-21772](https://cve.now/CVE-2025-21772.md): partitions: mac: fix handling of bogus partition table (CVSS 7.8, Linux)
- [CVE-2025-21771](https://cve.now/CVE-2025-21771.md): sched\_ext: Fix incorrect autogroup migration detection (no CVSS, Linux)
- [CVE-2025-21770](https://cve.now/CVE-2025-21770.md): iommu: Fix potential memory leak in iopf\_queue\_remove\_device() (CVSS 5.5, Linux)
- [CVE-2025-21769](https://cve.now/CVE-2025-21769.md): ptp: vmclock: Add .owner to vmclock\_miscdev\_fops (CVSS 5.5, Linux)
- [CVE-2025-21768](https://cve.now/CVE-2025-21768.md): net: ipv6: fix dst ref loops in rpl, seg6 and ioam6 lwtunnels (no CVSS, Linux)
- [CVE-2025-21767](https://cve.now/CVE-2025-21767.md): clocksource: Use migrate\_disable() to avoid calling get\_random\_u32() in atomic context (no CVSS, Linux)
- [CVE-2025-21766](https://cve.now/CVE-2025-21766.md): ipv4: use RCU protection in \_\_ip\_rt\_update\_pmtu() (CVSS 8.1, Linux)
- [CVE-2025-21765](https://cve.now/CVE-2025-21765.md): ipv6: use RCU protection in ip6\_default\_advmss() (CVSS 8.1, Linux)
- [CVE-2025-21764](https://cve.now/CVE-2025-21764.md): ndisc: use RCU protection in ndisc\_alloc\_skb() (CVSS 7.8, Linux)
- [CVE-2025-21763](https://cve.now/CVE-2025-21763.md): neighbour: use RCU protection in \_\_neigh\_notify() (CVSS 7.8, Linux)
- [CVE-2025-21762](https://cve.now/CVE-2025-21762.md): arp: use RCU protection in arp\_xmit() (CVSS 8.1, Linux)
- [CVE-2025-21761](https://cve.now/CVE-2025-21761.md): openvswitch: use RCU protection in ovs\_vport\_cmd\_fill\_info() (CVSS 7.8, Linux)
- [CVE-2025-21760](https://cve.now/CVE-2025-21760.md): ndisc: extend RCU protection in ndisc\_send\_skb() (CVSS 8.1, Linux)
- [CVE-2025-21759](https://cve.now/CVE-2025-21759.md): ipv6: mcast: extend RCU protection in igmp6\_send() (CVSS 7.8, Linux)
- [CVE-2025-21758](https://cve.now/CVE-2025-21758.md): ipv6: mcast: add RCU protection to mld\_newpack() (CVSS 7.8, Linux)
- [CVE-2025-21756](https://cve.now/CVE-2025-21756.md): vsock: Keep the binding until socket destruction (CVSS 7.8, Linux · :linux\_kernel:)
- [CVE-2024-58021](https://cve.now/CVE-2024-58021.md): HID: winwing: Add NULL check in winwing\_init\_led() (CVSS 5.5, Linux)
- [CVE-2024-58020](https://cve.now/CVE-2024-58020.md): HID: multitouch: Add NULL check in mt\_input\_configured (no CVSS, Linux)
- [CVE-2024-57852](https://cve.now/CVE-2024-57852.md): firmware: qcom: scm: smc: Handle missing SCM device (no CVSS, Linux)
- [CVE-2024-57834](https://cve.now/CVE-2024-57834.md): media: vidtv: Fix a null-ptr-deref in vidtv\_mux\_stop\_thread (no CVSS, Linux)
- [CVE-2024-54458](https://cve.now/CVE-2024-54458.md): scsi: ufs: bsg: Set bsg\_queue to NULL after removal (CVSS 7.8, Linux)
- [CVE-2024-54456](https://cve.now/CVE-2024-54456.md): NFS: Fix potential buffer overflowin nfs\_sysfs\_link\_rpc\_client() (CVSS 7.8, Linux)
- [CVE-2024-52560](https://cve.now/CVE-2024-52560.md): fs/ntfs3: Mark inode as bad as soon as error detected in mi\_enum\_attr() (CVSS 7.8, Linux)
- [CVE-2024-52559](https://cve.now/CVE-2024-52559.md): drm/msm/gem: prevent integer overflow in msm\_ioctl\_gem\_submit() (CVSS 7.8, Linux)
- [CVE-2024-52557](https://cve.now/CVE-2024-52557.md): drm: zynqmp\_dp: Fix integer overflow in zynqmp\_dp\_rate\_get() (CVSS 5.5, Linux)
- [CVE-2024-49570](https://cve.now/CVE-2024-49570.md): drm/xe/tracing: Fix a potential TP\_printk UAF (CVSS 7.8, Linux)
- [CVE-2025-21754](https://cve.now/CVE-2025-21754.md): btrfs: fix assertion failure when splitting ordered extent after transaction abort (no CVSS, Linux)
- [CVE-2025-21753](https://cve.now/CVE-2025-21753.md): btrfs: fix use-after-free when attempting to join an aborted transaction (CVSS 7.8, Linux)
- [CVE-2025-21752](https://cve.now/CVE-2025-21752.md): btrfs: don't use btrfs\_set\_item\_key\_safe on RAID stripe-extents (no CVSS, Linux)
- [CVE-2025-21751](https://cve.now/CVE-2025-21751.md): net/mlx5: HWS, change error flow on matcher disconnect (CVSS 7.8, Linux)
- [CVE-2025-21750](https://cve.now/CVE-2025-21750.md): wifi: brcmfmac: Check the return value of of\_property\_read\_string\_index() (no CVSS, Linux)
- [CVE-2025-21749](https://cve.now/CVE-2025-21749.md): net: rose: lock the socket in rose\_bind() (no CVSS, Linux)
- [CVE-2025-21748](https://cve.now/CVE-2025-21748.md): ksmbd: fix integer overflows on 32 bit systems (CVSS 9.8, Linux)
- [CVE-2025-21747](https://cve.now/CVE-2025-21747.md): drm/ast: astdp: Fix timeout for enabling video signal (no CVSS, Linux)
- [CVE-2025-21746](https://cve.now/CVE-2025-21746.md): Input: synaptics - fix crash when enabling pass-through port (no CVSS, Linux)
- [CVE-2025-21745](https://cve.now/CVE-2025-21745.md): blk-cgroup: Fix class @block\_class's subsystem refcount leakage (no CVSS, Linux)
- [CVE-2025-21744](https://cve.now/CVE-2025-21744.md): wifi: brcmfmac: fix NULL pointer dereference in brcmf\_txfinalize() (no CVSS, Linux)
- [CVE-2025-21743](https://cve.now/CVE-2025-21743.md): usbnet: ipheth: fix possible overflow in DPE length check (CVSS 7.1, Linux)
- [CVE-2025-21742](https://cve.now/CVE-2025-21742.md): usbnet: ipheth: use static NDP16 location in URB (CVSS 7.1, Linux)
- [CVE-2025-21741](https://cve.now/CVE-2025-21741.md): usbnet: ipheth: fix DPE OoB read (CVSS 7.1, Linux)
- [CVE-2025-21739](https://cve.now/CVE-2025-21739.md): scsi: ufs: core: Fix use-after free in init error and remove paths (CVSS 7.8, Linux)
- [CVE-2025-21738](https://cve.now/CVE-2025-21738.md): ata: libata-sff: Ensure that we cannot write outside the allocated buffer (CVSS 7.8, Linux)
- [CVE-2025-21737](https://cve.now/CVE-2025-21737.md): ceph: fix memory leak in ceph\_mds\_auth\_match() (CVSS 5.5, Linux)
- [CVE-2025-21736](https://cve.now/CVE-2025-21736.md): nilfs2: fix possible int overflows in nilfs\_fiemap() (no CVSS, Linux)
- [CVE-2025-21735](https://cve.now/CVE-2025-21735.md): NFC: nci: Add bounds checking in nci\_hci\_create\_pipe() (CVSS 8.8, Linux)
- [CVE-2025-21734](https://cve.now/CVE-2025-21734.md): misc: fastrpc: Fix copy buffer page size (CVSS 7.8, Linux)
- [CVE-2025-21733](https://cve.now/CVE-2025-21733.md): tracing/osnoise: Fix resetting of tracepoints (no CVSS, Linux)
- [CVE-2025-21732](https://cve.now/CVE-2025-21732.md): RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error (no CVSS, Linux)
- [CVE-2024-58019](https://cve.now/CVE-2024-58019.md): nvkm/gsp: correctly advance the read pointer of GSP message queue (CVSS 7.8, Linux)
- [CVE-2024-58018](https://cve.now/CVE-2024-58018.md): nvkm: correctly calculate the available space of the GSP cmdq buffer (no CVSS, Linux)
- [CVE-2024-58017](https://cve.now/CVE-2024-58017.md): printk: Fix signed integer overflow when defining LOG\_BUF\_LEN\_MAX (no CVSS, Linux)
- [CVE-2024-58016](https://cve.now/CVE-2024-58016.md): safesetid: check size of policy writes (no CVSS, Linux)
- [CVE-2024-58015](https://cve.now/CVE-2024-58015.md): wifi: ath12k: Fix for out-of bound access error (no CVSS, Linux)
- [CVE-2024-58014](https://cve.now/CVE-2024-58014.md): wifi: brcmsmac: add gain range check to wlc\_phy\_iqcal\_gainparams\_nphy() (no CVSS, Linux)
- [CVE-2024-58013](https://cve.now/CVE-2024-58013.md): Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt\_remove\_adv\_monitor\_sync (CVSS 7.8, Linux)
- [CVE-2024-58012](https://cve.now/CVE-2024-58012.md): ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params (CVSS 5.5, Linux)
- [CVE-2024-58011](https://cve.now/CVE-2024-58011.md): platform/x86: int3472: Check for adev == NULL (CVSS 5.5, Linux)
- [CVE-2024-58010](https://cve.now/CVE-2024-58010.md): binfmt\_flat: Fix integer overflow bug on 32 bit systems (CVSS 7.8, Linux)
- [CVE-2024-58009](https://cve.now/CVE-2024-58009.md): Bluetooth: L2CAP: handle NULL sock pointer in l2cap\_sock\_alloc (no CVSS, Linux)
- [CVE-2024-58008](https://cve.now/CVE-2024-58008.md): KEYS: trusted: dcp: fix improper sg use with CONFIG\_VMAP\_STACK=y (CVSS 7.8, Linux)
- [CVE-2024-58007](https://cve.now/CVE-2024-58007.md): soc: qcom: socinfo: Avoid out of bounds read of serial number (no CVSS, Linux)
- [CVE-2024-58006](https://cve.now/CVE-2024-58006.md): PCI: dwc: ep: Prevent changing BAR size/flags in pci\_epc\_set\_bar() (CVSS 9.6, Linux)
- [CVE-2024-58005](https://cve.now/CVE-2024-58005.md): tpm: Change to kvalloc() in eventlog/acpi.c (no CVSS, Linux)
- [CVE-2024-58004](https://cve.now/CVE-2024-58004.md): media: intel/ipu6: remove cpu latency qos request on error (CVSS 7.8, Linux)
- [CVE-2024-58003](https://cve.now/CVE-2024-58003.md): media: i2c: ds90ub9x3: Fix extra fwnode\_handle\_put() (CVSS 7.8, Linux)
- [CVE-2024-58002](https://cve.now/CVE-2024-58002.md): media: uvcvideo: Remove dangling pointers (CVSS 7.8, Linux)
- [CVE-2024-58001](https://cve.now/CVE-2024-58001.md): ocfs2: handle a symlink read error correctly (no CVSS, Linux)
- [CVE-2025-21731](https://cve.now/CVE-2025-21731.md): nbd: don't allow reconnect after disconnect (CVSS 7.8, Linux)
- [CVE-2025-21730](https://cve.now/CVE-2025-21730.md): wifi: rtw89: avoid to init mgnt\_entry list twice when WoWLAN failed (CVSS 7.8, Linux)
- [CVE-2025-21729](https://cve.now/CVE-2025-21729.md): wifi: rtw89: fix race between cancel\_hw\_scan and hw\_scan completion (CVSS 7.8, Linux)
- [CVE-2025-21728](https://cve.now/CVE-2025-21728.md): bpf: Send signals asynchronously if !preemptible (no CVSS, Linux)
- [CVE-2025-21727](https://cve.now/CVE-2025-21727.md): padata: fix UAF in padata\_reorder (CVSS 7.8, Linux)
- [CVE-2025-21726](https://cve.now/CVE-2025-21726.md): padata: avoid UAF for reorder\_work (CVSS 7.8, Linux)
- [CVE-2025-21725](https://cve.now/CVE-2025-21725.md): smb: client: fix oops due to unset link speed (CVSS 7.5, Linux)
- [CVE-2025-21724](https://cve.now/CVE-2025-21724.md): iommufd/iova\_bitmap: Fix shift-out-of-bounds in iova\_bitmap\_offset\_to\_index() (no CVSS, Linux)
- [CVE-2025-21723](https://cve.now/CVE-2025-21723.md): scsi: mpi3mr: Fix possible crash when setting up bsg fails (CVSS 5.5, Linux)
- [CVE-2025-21722](https://cve.now/CVE-2025-21722.md): nilfs2: do not force clear folio if buffer is referenced (CVSS 7.8, Linux)
- [CVE-2025-21721](https://cve.now/CVE-2025-21721.md): nilfs2: handle errors that nilfs\_prepare\_chunk() may return (no CVSS, Linux)
- [CVE-2025-21720](https://cve.now/CVE-2025-21720.md): xfrm: delete intermediate secpath entry in packet offload mode (CVSS 7.5, Linux)
- [CVE-2025-21719](https://cve.now/CVE-2025-21719.md): ipmr: do not call mr\_mfc\_uses\_dev() for unres entries (CVSS 7.1, Linux)
- [CVE-2025-21718](https://cve.now/CVE-2025-21718.md): net: rose: fix timer races against user threads (CVSS 7.8, Linux)
- [CVE-2025-21717](https://cve.now/CVE-2025-21717.md): net/mlx5e: add missing cpu\_to\_node to kvzalloc\_node in mlx5e\_open\_xdpredirect\_sq (CVSS 7.8, Linux)
- [CVE-2025-21716](https://cve.now/CVE-2025-21716.md): vxlan: Fix uninit-value in vxlan\_vnifilter\_dump() (CVSS 5.5, Linux)
- [CVE-2025-21715](https://cve.now/CVE-2025-21715.md): net: davicom: fix UAF in dm9000\_drv\_remove (CVSS 7.8, Linux)
- [CVE-2025-21714](https://cve.now/CVE-2025-21714.md): RDMA/mlx5: Fix implicit ODP use after free (CVSS 7.8, Linux)
- [CVE-2025-21713](https://cve.now/CVE-2025-21713.md): powerpc/pseries/iommu: Don't unset window if it was never set (CVSS 5.5, Linux)
- [CVE-2025-21712](https://cve.now/CVE-2025-21712.md): md/md-bitmap: Synchronize bitmap\_get\_stats() with bitmap lifetime (CVSS 7.8, Linux)
- [CVE-2025-21711](https://cve.now/CVE-2025-21711.md): net/rose: prevent integer overflows in rose\_setsockopt() (no CVSS, Linux)
- [CVE-2025-21710](https://cve.now/CVE-2025-21710.md): tcp: correct handling of extreme memory squeeze (CVSS 8.2, Linux)
- [CVE-2025-21709](https://cve.now/CVE-2025-21709.md): kernel: be more careful about dup\_mmap() failures and uprobe registering (CVSS 7.8, Linux)
- [CVE-2025-21708](https://cve.now/CVE-2025-21708.md): net: usb: rtl8150: enable basic endpoint checking (no CVSS, Linux)
- [CVE-2025-21707](https://cve.now/CVE-2025-21707.md): mptcp: consolidate suboption status (CVSS 9.8, Linux)
- [CVE-2025-21706](https://cve.now/CVE-2025-21706.md): mptcp: pm: only set fullmesh for subflow endp (no CVSS, Linux)
- [CVE-2025-21705](https://cve.now/CVE-2025-21705.md): mptcp: handle fastopen disconnect correctly (no CVSS, Linux)
- [CVE-2024-58000](https://cve.now/CVE-2024-58000.md): io\_uring: prevent reg-wait speculations (no CVSS, Linux)
- [CVE-2024-57999](https://cve.now/CVE-2024-57999.md): powerpc/pseries/iommu: IOMMU incorrectly marks MMIO range in DDW (CVSS 8.8, Linux)
- [CVE-2024-57998](https://cve.now/CVE-2024-57998.md): OPP: add index check to assert to avoid buffer overflow in \_read\_freq() (CVSS 7.3, Linux)
- [CVE-2024-57997](https://cve.now/CVE-2024-57997.md): wifi: wcn36xx: fix channel survey memory allocation size (CVSS 8.8, Linux)
- [CVE-2024-57996](https://cve.now/CVE-2024-57996.md): net\_sched: sch\_sfq: don't allow 1 packet limit (CVSS 7.8, Linux)
- [CVE-2024-57995](https://cve.now/CVE-2024-57995.md): wifi: ath12k: fix read pointer after free in ath12k\_mac\_assign\_vif\_to\_vdev() (CVSS 8.8, Linux)
- [CVE-2024-57994](https://cve.now/CVE-2024-57994.md): ptr\_ring: do not block hard interrupts in ptr\_ring\_resize\_multiple() (no CVSS, Linux)
- [CVE-2024-57993](https://cve.now/CVE-2024-57993.md): HID: hid-thrustmaster: Fix warning in thrustmaster\_probe by adding endpoint check (no CVSS, Linux)
- [CVE-2024-57992](https://cve.now/CVE-2024-57992.md): wifi: wilc1000: unregister wiphy only if it has been registered (no CVSS, Linux)
- [CVE-2024-57991](https://cve.now/CVE-2024-57991.md): wifi: rtw89: chan: fix soft lockup in rtw89\_entity\_recalc\_mgnt\_roles() (CVSS 5.5, Linux)
- [CVE-2024-57990](https://cve.now/CVE-2024-57990.md): wifi: mt76: mt7925: fix off by one in mt7925\_load\_clc() (CVSS 7.8, Linux)
- [CVE-2024-57989](https://cve.now/CVE-2024-57989.md): wifi: mt76: mt7925: fix NULL deref check in mt7925\_change\_vif\_links (CVSS 5.5, Linux)
- [CVE-2024-57988](https://cve.now/CVE-2024-57988.md): Bluetooth: btbcm: Fix NULL deref in btbcm\_get\_board\_name() (CVSS 5.5, Linux)
- [CVE-2024-57987](https://cve.now/CVE-2024-57987.md): Bluetooth: btrtl: check for NULL in btrtl\_setup\_realtek() (CVSS 5.5, Linux)
- [CVE-2024-57986](https://cve.now/CVE-2024-57986.md): HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections (CVSS 7.1, Linux)
- [CVE-2024-57985](https://cve.now/CVE-2024-57985.md): firmware: qcom: scm: Cleanup global '\_\_scm' on probe failures (CVSS 7.0, Linux)
- [CVE-2024-57984](https://cve.now/CVE-2024-57984.md): i3c: dw: Fix use-after-free in dw\_i3c\_master driver due to race condition (CVSS 7.8, Linux)
- [CVE-2024-57983](https://cve.now/CVE-2024-57983.md): mailbox: th1520: Fix memory corruption due to incorrect array size (CVSS 7.8, Linux)
- [CVE-2024-57982](https://cve.now/CVE-2024-57982.md): xfrm: state: fix out-of-bounds read during lookup (CVSS 7.8, Linux)
- [CVE-2024-57981](https://cve.now/CVE-2024-57981.md): usb: xhci: Fix NULL pointer dereference on certain command aborts (no CVSS, Linux)
- [CVE-2024-57980](https://cve.now/CVE-2024-57980.md): media: uvcvideo: Fix double free in error path (no CVSS, Linux)
- [CVE-2024-57979](https://cve.now/CVE-2024-57979.md): pps: Fix a use-after-free (CVSS 7.8, Linux)
- [CVE-2024-57978](https://cve.now/CVE-2024-57978.md): media: imx-jpeg: Fix potential error pointer dereference in detach\_pm() (no CVSS, Linux)
- [CVE-2024-57977](https://cve.now/CVE-2024-57977.md): memcg: fix soft lockup in the OOM process (no CVSS, Linux)
- [CVE-2024-57976](https://cve.now/CVE-2024-57976.md): btrfs: do proper folio cleanup when cow\_file\_range() failed (CVSS 7.8, Linux)
- [CVE-2024-57975](https://cve.now/CVE-2024-57975.md): btrfs: do proper folio cleanup when run\_delalloc\_nocow() failed (CVSS 7.8, Linux)
- [CVE-2024-57974](https://cve.now/CVE-2024-57974.md): udp: Deal with race between UDP socket address change and rehash (no CVSS, Linux)
- [CVE-2024-57973](https://cve.now/CVE-2024-57973.md): rdma/cxgb4: Prevent potential integer overflow on 32bit (CVSS 8.1, Linux)
- [CVE-2024-57953](https://cve.now/CVE-2024-57953.md): rtc: tps6594: Fix integer overflow on 32bit systems (CVSS 5.5, Linux)
- [CVE-2024-36046](https://cve.now/CVE-2024-36046.md): Infoblox NIOS through 8.6.4 executes with more privileges than required. (CVSS 9.8)
- [CVE-2024-36047](https://cve.now/CVE-2024-36047.md): Infoblox NIOS through 8.6.4 and 9.x through 9.0.3 has Improper Input Validation. (CVSS 9.8)
- [CVE-2024-37566](https://cve.now/CVE-2024-37566.md): Infoblox NIOS through 8.6.4 has Improper Authentication for Grids. (CVSS 9.8)
- [CVE-2024-37567](https://cve.now/CVE-2024-37567.md): Infoblox NIOS through 8.6.4 has Improper Access Control for Grids. (CVSS 9.1)
- [CVE-2024-38290](https://cve.now/CVE-2024-38290.md): In XIQ-SE before 24.2.11, a server misconfiguration may allow user enumeration when specific conditions are met. (CVSS 5.3)
- [CVE-2024-38291](https://cve.now/CVE-2024-38291.md): In XIQ-SE before 24.2.11, a low-privileged user may be able to access admin passwords, which could lead to privilege escalation. (CVSS 8.8)
- [CVE-2024-38292](https://cve.now/CVE-2024-38292.md): In Extreme Networks XIQ-SE before 24.2.11, due to a missing access control check, a path traversal is possible, which may lead to privilege (CVSS 9.8)
- [CVE-2024-41334](https://cve.now/CVE-2024-41334.md): Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior (CVSS 8.8)
- [CVE-2024-41335](https://cve.now/CVE-2024-41335.md): Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior (CVSS 7.5)
- [CVE-2024-41336](https://cve.now/CVE-2024-41336.md): Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862/2926 prior (CVSS 7.5)
- [CVE-2024-41338](https://cve.now/CVE-2024-41338.md): A NULL pointer dereference in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to (CVSS 7.5)
- [CVE-2024-41339](https://cve.now/CVE-2024-41339.md): An issue in the CGI endpoint used to upload configurations in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3. (CVSS 8.8)
- [CVE-2024-41340](https://cve.now/CVE-2024-41340.md): An issue in Draytek devices Vigor 165/166 prior to v4.2.6 , Vigor 2620/LTE200 prior to v3.9.8.8, Vigor 2860/2925 prior to v3.9.7, Vigor 2862 (CVSS 8.4)
- [CVE-2024-51138](https://cve.now/CVE-2024-51138.md): Vigor165/166 4.2.7 and earlier; Vigor2620/LTE200 3.9.8.9 and earlier; Vigor2860/2925 3.9.8 and earlier; Vigor2862/2926 3.9.9.5 and earlier; (CVSS 9.8)
- [CVE-2024-51139](https://cve.now/CVE-2024-51139.md): Buffer Overflow vulnerability in Vigor2620/LTE200 3.9.8.9 and earlier and Vigor2860/2925 3.9.8 and earlier and Vigor2862/2926 3.9.9.5 and ea (CVSS 9.8)
- [CVE-2024-53408](https://cve.now/CVE-2024-53408.md): AVE System Web Client v2.1.131.13992 was discovered to contain a cross-site scripting (XSS) vulnerability. (CVSS 5.4)
- [CVE-2024-53944](https://cve.now/CVE-2024-53944.md): An issue was discovered on Tuoshi/Dionlink LT15D 4G Wi-Fi devices through M7628NNxlSPv2xUI\_v1.0.1802.10.08\_P4 and LT21B devices through M762 (CVSS 9.8)
- [CVE-2024-54957](https://cve.now/CVE-2024-54957.md): Nagios XI 2024R1.2.2 is vulnerable to an open redirect flaw on the Tools page, exploitable by users with read-only permissions. (CVSS 6.1)
- [CVE-2024-55160](https://cve.now/CVE-2024-55160.md): GFast between v2 to v3.2 was discovered to contain a SQL injection vulnerability via the OrderBy parameter at /system/operLog/list. (CVSS 9.8)
- [CVE-2025-22952](https://cve.now/CVE-2025-22952.md): elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be (CVSS 9.8, github.com/usememos/memos)
- [CVE-2025-25323](https://cve.now/CVE-2025-25323.md): An issue in Qianjin Network Information Technology (Shanghai) Co., Ltd 51Job iOS 14.22.0 allows attackers to access sensitive user informati (CVSS 5.5)
- [CVE-2025-25324](https://cve.now/CVE-2025-25324.md): An issue in Shandong Provincial Big Data Center AiShanDong iOS 5.0.0 allows attackers to access sensitive user information via supplying a c (CVSS 5.5)
- [CVE-2025-25325](https://cve.now/CVE-2025-25325.md): An issue in Yibin Fengguan Network Technology Co., Ltd YuPao DirectHire iOS 8.8.0 allows attackers to access sensitive user information via (CVSS 5.5)
- [CVE-2025-25326](https://cve.now/CVE-2025-25326.md): An issue in Merchants Union Consumer Finance Company Limited Merchants Union Finance iOS 6.19.0 allows attackers to access sensitive user in (CVSS 5.5)
- [CVE-2025-25329](https://cve.now/CVE-2025-25329.md): An issue in Tencent Technology (Beijing) Company Limited Tencent MicroVision iOS 8.137.0 allows attackers to access sensitive user informati (CVSS 5.5)
- [CVE-2025-25330](https://cve.now/CVE-2025-25330.md): An issue in Boohee Technology Boohee Health iOS 13.0.13 allows attackers to access sensitive user information via supplying a crafted link. (CVSS 5.5)
- [CVE-2025-25331](https://cve.now/CVE-2025-25331.md): An issue in Beitatong Technology LianJia iOS 9.83.50 allows attackers to access sensitive user information via supplying a crafted link. (CVSS 5.5)
- [CVE-2025-25333](https://cve.now/CVE-2025-25333.md): An issue in IKEA CN iOS 4.13.0 allows attackers to access sensitive user information via supplying a crafted link. (CVSS 7.5)
- [CVE-2025-25334](https://cve.now/CVE-2025-25334.md): An issue in Suning Commerce Group Suning EMall iOS 9.5.198 allows attackers to access sensitive user information via supplying a crafted lin (CVSS 5.5)
- [CVE-2025-25477](https://cve.now/CVE-2025-25477.md): A host header injection vulnerability in SysPass 3.2x allows an attacker to load malicious JS files from an arbitrary domain which would be (CVSS 8.1)
- [CVE-2025-25570](https://cve.now/CVE-2025-25570.md): Vue Vben Admin 2.10.1 allows unauthorized login to the backend due to an issue with hardcoded credentials. (CVSS 9.8)
- [CVE-2025-25727](https://cve.now/CVE-2025-25727.md): Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to store passwords in cleartext. (CVSS 6.2)
- [CVE-2025-25728](https://cve.now/CVE-2025-25728.md): Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 were discovered to send communications to the upd (CVSS 6.5)
- [CVE-2025-25729](https://cve.now/CVE-2025-25729.md): An information disclosure vulnerability in Bosscomm IF740 Firmware versions:11001.7078 & v11001.0000 and System versions: 6.25 & 6.00 allows (CVSS 7.5)
- [CVE-2025-25730](https://cve.now/CVE-2025-25730.md): An issue in Motorola Mobility Droid Razr HD (Model XT926) System Version: 9.18.94.XT926.Verizon.en.US allows physically proximate unauthoriz (CVSS 4.6)
- [CVE-2025-25759](https://cve.now/CVE-2025-25759.md): An issue in the component admin\_template.php of SUCMS v1.0 allows attackers to execute a directory traversal and arbitrary file deletion via (CVSS 7.5)
- [CVE-2025-25760](https://cve.now/CVE-2025-25760.md): A Server-Side Request Forgery (SSRF) in the component admin\_webgather.php of SUCMS v1.0 allows attackers to access internal data and service (CVSS 7.5)
- [CVE-2025-25761](https://cve.now/CVE-2025-25761.md): HkCms v2.3.2.240702 was discovered to contain an arbitrary file write vulnerability in the component Appcenter.php. (CVSS 7.2)
- [CVE-2025-26264](https://cve.now/CVE-2025-26264.md): GeoVision GV-ASWeb with the version 6.1.2.0 or less (fixed in 6.2.0), contains a Remote Code Execution (RCE) vulnerability within its Notifi (CVSS 8.8)
- [CVE-2025-26325](https://cve.now/CVE-2025-26325.md): ShopXO 6.4.0 is vulnerable to File Upload in ThemeDataService.php. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-02-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.