CVE-2025-49xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
814 records · Page 3 of 9
- CVE-2025-49786: Not used Rejected
Not used
Updated · Rejected record - CVE-2025-49785: Not used Rejected
Not used
Updated · Rejected record An improper neutralization of special elements used in an sql command ('sql injection') vulnerability in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, FortiAnalyzer 7.4.0 through 7.4.7, FortiAnalyzer 7.2 all versions, FortiAnalyzer 7.0 all versions, FortiAnalyzer 6.4 all versions, FortiAnalyzer-BigData 7.6.0, FortiAnalyzer-BigData 7.4.0 through 7.4.4, FortiAnalyzer-BigData 7.2 all versions, FortiAna
UpdatedESI plugin does not have the limit for maximum inclusion depth, and that allows excessive memory consumption if malicious instructions are inserted. Users can use a new setting for the plugin (--max-inclusion-depth) to limit it. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.5, from 9.0.0 through 9.2.10. Users are recommended to upgrade to version 9.2.11 or 10.0.6, which fix
Updated- CVE-2025-49762: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability 7.0 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Updated Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
UpdatedExternal control of file name or path in Windows Storage allows an authorized attacker to perform spoofing over a network.
UpdatedImproper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
UpdatedImproper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
Updated- CVE-2025-49757: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 8.8 High
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
Updated Use of a broken or risky cryptographic algorithm in Office Developer Platform allows an authorized attacker to bypass a security feature locally.
UpdatedUser interface (ui) misrepresentation of critical information in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
Updated- CVE-2025-49753: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 8.8 High
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
Updated Azure Bastion Elevation of Privilege Vulnerability
UpdatedMissing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network.
UpdatedMissing authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.
UpdatedImproper authorization in Azure Machine Learning allows an authorized attacker to elevate privileges over a network.
UpdatedImproper neutralization of input during web page generation ('cross-site scripting') in Microsoft Dynamics 365 (on-premises) allows an unauthorized attacker to perform spoofing over a network.
UpdatedHeap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
UpdatedConcurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
UpdatedInteger overflow or wraparound in Microsoft Graphics Component allows an authorized attacker to execute code locally.
UpdatedNo cwe for this issue in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
UpdatedProtection mechanism failure in Windows SmartScreen allows an unauthorized attacker to bypass a security feature over a network.
UpdatedImproper link resolution before file access ('link following') in Visual Studio allows an unauthorized attacker to elevate privileges over a network.
UpdatedImproper link resolution before file access ('link following') in Microsoft PC Manager allows an authorized attacker to elevate privileges locally.
UpdatedConcurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Teams allows an authorized attacker to elevate privileges locally.
UpdatedThe ui performs the wrong action in Microsoft Edge for Android allows an unauthorized attacker to perform spoofing over a network.
UpdatedUse after free in Windows KDC Proxy Service (KPSSVC) allows an unauthorized attacker to execute code over a network.
UpdatedImproper restriction of communication channel to intended endpoints in Windows PowerShell allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
UpdatedImproper handling of insufficient permissions or privileges in Microsoft Teams allows an authorized attacker to elevate privileges over a network.
Updated- CVE-2025-49730: Microsoft Windows QoS Scheduler Driver Elevation of Privilege Vulnerability 7.8 High
Time-of-check time-of-use (toctou) race condition in Microsoft Windows QoS scheduler allows an authorized attacker to elevate privileges locally.
Updated - CVE-2025-49729: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 8.8 High
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
Updated Cleartext storage of sensitive information in Microsoft PC Manager allows an unauthorized attacker to bypass a security feature locally.
UpdatedHeap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Notification allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Windows Notification allows an authorized attacker to elevate privileges locally.
Updated- CVE-2025-49724: Windows Connected Devices Platform Service Remote Code Execution Vulnerability 8.8 High
Use after free in Windows Connected Devices Platform Service allows an unauthorized attacker to execute code over a network.
Updated Missing authorization in Windows StateRepository API allows an authorized attacker to perform tampering locally.
UpdatedUncontrolled resource consumption in Windows Print Spooler Components allows an authorized attacker to deny service over an adjacent network.
UpdatedHeap-based buffer overflow in Windows Fast FAT Driver allows an unauthorized attacker to elevate privileges locally.
UpdatedImproper input validation in SQL Server allows an unauthorized attacker to disclose information over a network.
UpdatedUse of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network.
UpdatedHeap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network.
UpdatedUncontrolled resource consumption in Windows Netlogon allows an unauthorized attacker to deny service over a network.
Updated- CVE-2025-49715: Dynamics 365 FastTrack Implementation Assets Information Disclosure Vulnerability 7.5 High
Exposure of private personal information to an unauthorized actor in Dynamics 365 FastTrack Implementation Assets allows an unauthorized attacker to disclose information over a network.
Updated Trust boundary violation in Visual Studio Code - Python extension allows an unauthorized attacker to execute code locally.
UpdatedAccess of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
UpdatedDeserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
UpdatedUse after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally.
Updated- CVE-2025-49710: Integer overflow in OrderedHashTable 9.8 Critical
An integer overflow was present in `OrderedHashTable` used by the JavaScript engine. This vulnerability was fixed in Firefox 139.0.4.
Updated - CVE-2025-49709: Memory corruption in canvas surfaces 9.8 Critical
Certain canvas operations could have lead to memory corruption. This vulnerability was fixed in Firefox 139.0.4.
Updated Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network.
UpdatedImproper access control in Azure Virtual Machines allows an authorized attacker to perform spoofing locally.
UpdatedImproper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
UpdatedHeap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally.
UpdatedImproper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
UpdatedUse after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
UpdatedAccess of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally.
UpdatedImproper authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
UpdatedUse after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
UpdatedUse after free in Microsoft Office allows an unauthorized attacker to execute code locally.
UpdatedUse after free in Microsoft Office Word allows an unauthorized attacker to execute code locally.
UpdatedHeap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.
UpdatedOut-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally.
UpdatedUse after free in Microsoft Office allows an unauthorized attacker to execute code locally.
UpdatedNull pointer dereference in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
UpdatedDouble free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
UpdatedImproper access control in Azure Windows Virtual Machine Agent allows an authorized attacker to elevate privileges locally.
UpdatedHeap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over an adjacent network.
Updated- CVE-2025-49690: Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability 7.4 High
Concurrent execution using shared resource with improper synchronization ('race condition') in Capability Access Management Service (camsvc) allows an unauthorized attacker to elevate privileges locally.
Updated Integer overflow or wraparound in Virtual Hard Disk (VHDX) allows an unauthorized attacker to elevate privileges locally.
Updated- CVE-2025-49688: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 8.8 High
Double free in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
Updated Out-of-bounds read in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.
UpdatedNull pointer dereference in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
UpdatedBuffer over-read in Storage Port Driver allows an authorized attacker to disclose information locally.
UpdatedInteger overflow or wraparound in Virtual Hard Disk (VHDX) allows an unauthorized attacker to execute code locally.
UpdatedUse after free in Windows Media allows an authorized attacker to elevate privileges locally.
UpdatedOut-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
UpdatedImproper link resolution before file access ('link following') in Windows Performance Recorder allows an authorized attacker to deny service locally.
UpdatedNumeric truncation error in Windows Shell allows an authorized attacker to elevate privileges locally.
UpdatedNull pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.
UpdatedUse after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
Updated- CVE-2025-49676: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 8.8 High
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
Updated - CVE-2025-49675: Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability 7.8 High
Use after free in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.
Updated - CVE-2025-49674: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 8.8 High
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
Updated - CVE-2025-49673: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 8.8 High
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
Updated - CVE-2025-49672: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 8.8 High
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
Updated Exposure of sensitive information to an unauthorized actor in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
Updated- CVE-2025-49670: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 6.5 Medium
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
Updated - CVE-2025-49669: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 8.8 High
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
Updated - CVE-2025-49668: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 8.8 High
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
Updated Double free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.
Updated- CVE-2025-49666: Windows Server Setup and Boot Event Collection Remote Code Execution Vulnerability 7.2 High
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to execute code over a network.
Updated Concurrent execution using shared resource with improper synchronization ('race condition') in Workspace Broker allows an authorized attacker to elevate privileges locally.
Updated- CVE-2025-49664: Windows User-Mode Driver Framework Host Information Disclosure Vulnerability 5.5 Medium
Exposure of sensitive information to an unauthorized actor in Windows User-Mode Driver Framework Host allows an authorized attacker to disclose information locally.
Updated - CVE-2025-49663: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability 8.8 High
Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.
Updated - CVE-2025-49661: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability 7.8 High
Untrusted pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
Updated