CVE-2025 records published in April 2025

This page lists the 3,694 CVE-2025 records published in April 2025, newest first, 1,000 to a page. The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog lists 15 of them. Each CVE opens on cve-security.com with its sources, detection content and vendor fixes, and the search on the CVE-2025 list filters these records by severity or signal.

Critical
49513.4% of these records
Listed in CISA KEV
150.4% of these records
Reported exploited
40.1% of these records
Detection signal
762.1% of these records
Exploit code
942.5% of these records
Actionable vendor fix
2,24860.9% of these records

Figures as of 2026-10-24 13:18 UTC. Records published in April 2025 have had from about 18 months to about 19 months to collect KEV listings, exploitation reports, detection content and exploit code. Records published more recently have had less time, which can hold their shares down.

CVE-2025 records published in April 2025, newest first: records 1 to 1,000 of 3,694
CVE Summary CVSS EPSS Published Signals
CVE-2025-46619Couchbase Server unauthorized access7.6CISA ADP v3.10.5%2025-04-30Fix
CVE-2025-46560vLLM phi4mm: Quadratic Time Complexity in Input Token Processing leads to denial of service6.5CNA v3.10.5%2025-04-30Fix
CVE-2025-46558XWiki Syntax Markdown Markdown to HTML rendering cross-site scripting9.1CNA v3.10.5%2025-04-30Fix
CVE-2025-46557Any user with view access to the XWiki space can change the authenticator8.4CNA v4.00.6%2025-04-30Fix
CVE-2025-46554XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API5.3CNA v3.11.0%2025-04-30NucleiFix
CVE-2025-46342Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements8.6CNA v3.10.8%2025-04-30Fix
CVE-2025-46331OpenFGA authorization bypass5.8CNA v4.00.4%2025-04-30Fix
CVE-2025-45021PHPGurukul Directory Management System SQL injection5.3CISA ADP v3.10.2%2025-04-30
CVE-2025-45020PHPGurukul Park Ticketing Management System SQL injection7.2CISA ADP v3.10.6%2025-04-30
CVE-2025-45019PHPGurukul Park Ticketing Management System SQL injection5.4NVD v3.10.5%2025-04-30
CVE-2025-45018PHPGurukul Park Ticketing Management System SQL injection9.8CISA ADP v3.10.6%2025-04-30
CVE-2025-45017PHPGurukul Park Ticketing Management System SQL injection9.8CISA ADP v3.10.8%2025-04-30
CVE-2025-45015PHPGurukul Park Ticketing Management System cross-site scripting6.1CISA ADP v3.10.3%2025-04-30
CVE-2025-45011PHPGurukul Park Ticketing Management System command injection5.3CISA ADP v3.10.3%2025-04-30
CVE-2025-45010PHPGurukul Park Ticketing Management System command injection5.3CISA ADP v3.10.3%2025-04-30
CVE-2025-45009PHPGurukul Park Ticketing Management System command injection5.3CISA ADP v3.10.3%2025-04-30
CVE-2025-45007PHPGurukul Time Table Generator System cross-site scripting4.8CISA ADP v3.10.3%2025-04-30
CVE-2025-44194oretnom23 Simple Barangay Management System SQL injection7.3CISA ADP v3.10.4%2025-04-30
CVE-2025-44193oretnom23 Simple Barangay Management System SQL injection7.6CISA ADP v3.10.3%2025-04-30
CVE-2025-44192oretnom23 Simple Barangay Management System SQL injection9.8CISA ADP v3.10.5%2025-04-30
CVE-2025-39413Simple Sitemap Create a Responsive HTML Sitemap WordPress plugin broken access control8.8v3.10.4%2025-04-30Fix
CVE-2025-33074Microsoft Azure Functions remote code execution7.5CNA v3.10.6%2025-04-30Fix
CVE-2025-32974xwiki-platform required rights analysis improper privilege management9.1CNA v3.10.4%2025-04-30Fix
CVE-2025-32973xwiki-platform programming rights check missing authorization9.1CNA v3.10.4%2025-04-30Fix
CVE-2025-32972xwiki-platform the lesscss script service allows cache clearing without programming right2.7CNA v3.10.5%2025-04-30Fix
CVE-2025-32971XWiki Solr script service doesn't take dropped programming right into account3.8CNA v3.10.4%2025-04-30Fix
CVE-2025-32970xwiki-platform org.Xwiki.platform:xwiki-platform-wysiwyg-api open redirect6.1CNA v3.10.6%2025-04-30NucleiFix
CVE-2025-32777Volcano Scheduler denial of service via Unbounded Response from Elastic Service/extender plugin8.2CNA v4.00.5%2025-04-30Fix
CVE-2025-32444vLLM vulnerable to remote code execution via Mooncake Integration10.0CNA v3.11.8%2025-04-30Fix
CVE-2025-32376Discourse DM limits aren’t always properly enforced4.8CNA v4.00.3%2025-04-30Fix
CVE-2025-30422Apple AirPlay audio SDK buffer overflow6.5v3.10.7%2025-04-30Fix
CVE-2025-30392Microsoft Azure AI Bot elevation of privilege9.8CNA v3.11.1%2025-04-30Fix
CVE-2025-30391Microsoft Dynamics information disclosure8.1CNA v3.11.4%2025-04-30Fix
CVE-2025-30390Microsoft Azure ML Compute elevation of privilege9.9CNA v3.11.0%2025-04-30Fix
CVE-2025-30389Microsoft Azure Bot Framework SDK elevation of privilege8.7CNA v3.10.9%2025-04-30Fix
CVE-2025-30202Data exposure via ZeroMQ on multi-node vLLM deployment7.5CNA v3.10.6%2025-04-30Fix
CVE-2025-27611base-x homograph attack allows Unicode lookalike characters to bypass validation8.7CNA v4.00.4%2025-04-30Fix
CVE-2025-27532Bosch Rexroth ctrlX OS cleartext storage of sensitive information6.5CNA v3.13.5%2025-04-30Fix
CVE-2025-27409Joplin Server vulnerable to path traversal7.5CNA v3.10.6%2025-04-30Fix
CVE-2025-27134Privilege escalation in Joplin server via user patch endpoint8.8CNA v3.12.2%2025-04-30NucleiFix
CVE-2025-24887OpenCTI bypass of protected attribute update6.3CNA v3.10.3%2025-04-30Fix
CVE-2025-24351Bosch Rexroth ctrlX OS OS command injection8.8CNA v3.10.9%2025-04-30Fix
CVE-2025-24350Bosch Rexroth ctrlX OS relative path traversal7.1CNA v3.10.4%2025-04-30Fix
CVE-2025-24349Bosch Rexroth ctrlX OS permissive allowlist7.1CNA v3.10.6%2025-04-30Fix
CVE-2025-24348Bosch Rexroth ctrlX OS improper syntax validation5.4CNA v3.10.5%2025-04-30Fix
CVE-2025-24347Bosch Rexroth ctrlX OS improper syntax validation6.5CNA v3.10.5%2025-04-30Fix
CVE-2025-24346Bosch Rexroth ctrlX OS improper syntax validation7.5CNA v3.10.5%2025-04-30Fix
CVE-2025-24345Bosch Rexroth ctrlX OS improper syntax validation6.3CNA v3.10.4%2025-04-30Fix
CVE-2025-24344Bosch Rexroth ctrlX OS cross-site scripting6.3CNA v3.10.4%2025-04-30Fix
CVE-2025-24343Bosch Rexroth ctrlX OS relative path traversal5.4CNA v3.10.6%2025-04-30Fix
CVE-2025-24342Bosch Rexroth ctrlX OS response discrepancy5.3CNA v3.10.4%2025-04-30Fix
CVE-2025-24341Bosch Rexroth ctrlX OS resource exhaustion6.5CNA v3.10.5%2025-04-30Fix
CVE-2025-24340Bosch Rexroth ctrlX OS weak password hash6.5CNA v3.10.3%2025-04-30Fix
CVE-2025-24339Bosch Rexroth ctrlX OS HTTP header injection5.0CNA v3.10.3%2025-04-30Fix
CVE-2025-24338Bosch Rexroth ctrlX OS improper output encoding7.1CNA v3.10.4%2025-04-30Fix
CVE-2025-24132Apple AirPlay audio SDK memory corruption6.5NVD v3.13.2%2025-04-30Exploit codeFix
CVE-2025-24091Apple iPadOS authentication bypass by spoofing5.5CISA ADP v3.10.3%2025-04-30Exploit codeFix
CVE-2025-22884ISPSoft File Parsing stack-based buffer overflow remote code execution7.8CNA v3.10.4%2025-04-30Fix
CVE-2025-22883ISPSoft File Parsing out-of-bounds write remote code execution7.8CNA v3.10.4%2025-04-30Fix
CVE-2025-22882ISPSoft File Parsing stack-based buffer overflow remote code execution7.8CNA v3.10.4%2025-04-30Fix
CVE-2025-21416Microsoft Azure Virtual Desktop elevation of privilege8.5CNA v3.10.8%2025-04-30Fix
CVE-2025-4142Netgear EX6200 sub_3C8EC buffer overflow9.8v3.11.2%2025-04-30
CVE-2025-4141Netgear EX6200 sub_3C03C buffer overflow9.8v3.11.2%2025-04-30
CVE-2025-4140Netgear EX6120 sub_30394 buffer overflow9.8v3.11.2%2025-04-30
CVE-2025-4139Netgear EX6120 fwAcosCgiInbound buffer overflow8.7CNA v4.01.1%2025-04-30
CVE-2025-4136Weitong Mall Sale endpoint improper authorization5.3CNA v4.00.4%2025-04-30
CVE-2025-4135Netgear WG302v2 ui_get_input_value command injection5.3CNA v4.02.0%2025-04-30
CVE-2025-4125ISPSoft File Parsing out-of-bounds write remote code execution7.8CNA v3.10.4%2025-04-30Fix
CVE-2025-4124ISPSoft File Parsing out-of-bounds write remote code execution7.8CNA v3.10.4%2025-04-30Fix
CVE-2025-4122Netgear JWNR2000v2 sub_435E04 command injection8.8v3.12.7%2025-04-30
CVE-2025-4121Netgear JWNR2000v2 cmd_wireless command injection9.8v3.12.9%2025-04-30
CVE-2025-4120Netgear JWNR2000v2 sub_4238E8 buffer overflow9.8v3.11.0%2025-04-30
CVE-2025-4119Weitong Mall Product Statistics queryTotal access control7.5v3.10.7%2025-04-30
CVE-2025-4118Weitong Mall Product History historyList access control9.1v3.10.7%2025-04-30
CVE-2025-4117Netgear JWNR2000v2 sub_41A914 buffer overflow9.8v3.10.6%2025-04-30
CVE-2025-4116Netgear JWNR2000v2 get_cur_lang_ver buffer overflow9.8v3.11.0%2025-04-30
CVE-2025-4115Netgear JWNR2000v2 default_version_is_new buffer overflow9.8v3.11.0%2025-04-30
CVE-2025-4114Netgear JWNR2000v2 check_language_file buffer overflow9.8v3.11.1%2025-04-30
CVE-2025-4113PHPGurukul Curfew e-Pass Management System edit-pass-detail.php SQL injection8.8v3.10.5%2025-04-30
CVE-2025-4112PHPGurukul Student Record System add-course.php SQL injection9.8v3.10.6%2025-04-30
CVE-2025-4111PHPGurukul Pre-School Enrollment System visitor-details.php SQL injection8.8v3.10.5%2025-04-30
CVE-2025-4110PHPGurukul Pre-School Enrollment System edit-teacher.php SQL injection8.8v3.10.5%2025-04-30
CVE-2025-4109PHPGurukul Pre-School Enrollment System edit-subadmin.php SQL injection8.8v3.10.5%2025-04-30
CVE-2025-4108PHPGurukul Student Record System add-subject.php SQL injection9.8v3.10.6%2025-04-30
CVE-2025-3953WP Statistics WordPress plugin unauthorized access5.4CNA v3.10.3%2025-04-30Fix
CVE-2025-3859Mozilla Firefox Focus elide URL allows address bar spoofing6.1v3.10.2%2025-04-30Fix
CVE-2025-3599Symantec Endpoint Protection elevation of privilege6.5CNA v3.10.3%2025-04-30Fix
CVE-2025-3471SureForms WordPress plugin Contributor+ settings update4.9CISA ADP v3.10.4%2025-04-30Fix
CVE-2025-3395ABB Automation Builder cleartext storage of sensitive information8.4CNA v4.00.1%2025-04-30Fix
CVE-2025-3394ABB Automation Builder incorrect permission assignment8.5CNA v4.00.2%2025-04-30Fix
CVE-2025-2890tagDiv Opt-In Builder WordPress plugin SQL injection6.5CNA v3.10.4%2025-04-30Fix
CVE-2025-2170SonicWall SMA1000 server-side request forgery7.2CISA ADP v3.10.3%2025-04-30Fix
CVE-2025-2082Tesla Model 3 VCSEC integer overflow remote code execution7.5CNA v3.00.4%2025-04-30Exploit code
CVE-2025-46552KHC-INVITATION-AUTOMATION sensitive user information leakage in Invitation Automation6.3CNA v4.00.4%2025-04-29Fix
CVE-2025-46550YesWiki vulnerable to unauthenticated reflected cross-site scripting4.3CNA v3.10.5%2025-04-29NucleiFix
CVE-2025-46549YesWiki vulnerable to unauthenticated reflected cross-site scripting4.3CNA v3.10.5%2025-04-29NucleiFix
CVE-2025-46350YesWiki vulnerable to authenticated reflected cross-site scripting3.5CNA v3.10.3%2025-04-29Fix
CVE-2025-46349YesWiki vulnerable to unauthenticated reflected cross-site scripting7.6CNA v3.10.6%2025-04-29NucleiFix
CVE-2025-46348YesWiki vulnerable to Unauthenticated Site Backup Creation and Download10.0CNA v3.10.7%2025-04-29Fix
CVE-2025-46347YesWiki remote code execution via arbitrary PHP File Write and Execution5.8CNA v4.01.0%2025-04-29Fix
CVE-2025-46346YesWiki vulnerable to stored XSS in Comments6.3CNA v4.00.4%2025-04-29Fix
CVE-2025-46344Auth0 NextJS SDK v4 Missing Session Invalidation4.9CNA v4.00.4%2025-04-29Fix
CVE-2025-46343n8n vulnerable to stored XSS through Attachments view endpoint5.0CNA v3.10.3%2025-04-29Fix
CVE-2025-46338Audiobookshelf vulnerable to cross-site-scripting Reflected via POST request in /API/upload6.9CNA v4.00.4%2025-04-29Fix
CVE-2025-46330Snowflake Connector For C/c++ retries malformed requests3.3CNA v3.10.2%2025-04-29Fix
CVE-2025-46329Snowflake Connector For C/c++ inserts client-side encryption key in DEBUG logs3.3CNA v3.10.1%2025-04-29Fix
CVE-2025-45956oretnom23 Computer Laboratory Management System manage_damage.php in Sourcecodester SQL injection8.8CISA ADP v3.10.5%2025-04-29
CVE-2025-40619Improper access control vulnerability in Bookgy7.5NVD v3.10.4%2025-04-29Fix
CVE-2025-40618SQL injection vulnerability in Bookgy9.8v3.10.4%2025-04-29Fix
CVE-2025-40617SQL injection vulnerability in Bookgy9.8v3.10.4%2025-04-29Fix
CVE-2025-40616Reflected cross-site scripting (XSS) vulnerability in Bookgy6.1v3.10.2%2025-04-29Fix
CVE-2025-40615Reflected cross-site scripting (XSS) vulnerability in Bookgy6.1v3.10.2%2025-04-29Fix
CVE-2025-32354Synacor Zimbra Collaboration Suite cross-site request forgery8.8CISA ADP v3.10.3%2025-04-29Fix
CVE-2025-31203Apple iPadOS integer overflow6.5CISA ADP v3.10.4%2025-04-29Fix
CVE-2025-31202Apple macOS null pointer dereference5.5CISA ADP v3.10.2%2025-04-29Fix
CVE-2025-31197Apple iPadOS use-after-free5.7CISA ADP v3.10.3%2025-04-29Fix
CVE-2025-30445Apple iPadOS type confusion6.5CISA ADP v3.10.4%2025-04-29Fix
CVE-2025-30194PowerDNS DNSdist denial of service via crafted DoH exchange7.5CNA v3.12.3%2025-04-29Fix
CVE-2025-29906Finit bundled getty can bypass /bin/login8.6CNA v3.10.2%2025-04-29Fix
CVE-2025-25962Coresmartcontracts Uniswap _modifyPosition function privilege escalation9.8CISA ADP v3.10.5%2025-04-29
CVE-2025-25403Slims (Senayan Library Management Systems) 9 Bulian V9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/coll_type.php.9.8CISA ADP v3.10.4%2025-04-29
CVE-2025-24271Apple iPadOS missing authentication5.4CISA ADP v3.10.5%2025-04-29Exploit codeFix
CVE-2025-24270Apple iPadOS information disclosure5.7CISA ADP v3.10.3%2025-04-29Fix
CVE-2025-24252Apple iPadOS use-after-free8.8CISA ADP v3.11.3%2025-04-29Exploit codeKCVFix
CVE-2025-24251Apple iPadOS null pointer dereference6.5CISA ADP v3.10.4%2025-04-29Fix
CVE-2025-24206Apple iPadOS authentication bypass7.7CISA ADP v3.10.4%2025-04-29KCVFix
CVE-2025-24179Apple iPadOS null pointer dereference5.7CISA ADP v3.10.3%2025-04-29Fix
CVE-2025-23181Ribbon Communications execution with unnecessary privileges8.0CNA v3.10.3%2025-04-29
CVE-2025-23180Ribbon Communications execution with unnecessary privileges8.0CNA v3.10.3%2025-04-29
CVE-2025-23179Ribbon Communications use of hard-coded credentials5.5CNA v3.10.2%2025-04-29
CVE-2025-23178Ribbon Communications improper restriction of communication channel to intended endpoints7.6CNA v3.10.3%2025-04-29
CVE-2025-23177Ribbon Communications uncontrolled search path element7.6CNA v3.10.3%2025-04-29
CVE-2025-4095Docker Desktop Registry Access Management enforcement missing authorization4.3CNA v4.00.2%2025-04-29Fix
CVE-2025-4093Mozilla memory safety bug fixed in Firefox ESR and Thunderbird8.1CISA ADP v3.10.5%2025-04-29Fix
CVE-2025-4092Mozilla memory safety bugs fixed in Firefox 138 and Thunderbird 1386.5CISA ADP v3.10.3%2025-04-29Fix
CVE-2025-4091Mozilla memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR, and Thunderbird8.1CISA ADP v3.10.5%2025-04-29Fix
CVE-2025-4090Leaked library paths in Thunderbird for Android5.3CISA ADP v3.10.3%2025-04-29Fix
CVE-2025-4089Mozilla Firefox potential local code execution in copy as cURL command5.1CISA ADP v3.10.2%2025-04-29Fix
CVE-2025-4088Mozilla Firefox cross-site request forgery via storage access API redirects6.5CISA ADP v3.10.2%2025-04-29Fix
CVE-2025-4087Mozilla Firefox unsafe attribute access during XPath parsing4.8CISA ADP v3.10.3%2025-04-29Fix
CVE-2025-4086Mozilla Firefox specially crafted filename could be used to obscure download type6.5CISA ADP v3.10.3%2025-04-29Fix
CVE-2025-4085Mozilla Firefox potential information leakage and privilege escalation in UITour actor7.1CISA ADP v3.10.3%2025-04-29Fix
CVE-2025-4084Mozilla Firefox potential local code execution in copy as cURL command5.7CISA ADP v3.10.4%2025-04-29Fix
CVE-2025-4083Mozilla Firefox process isolation bypass using javascript: URI links in cross-origin frames9.1CISA ADP v3.10.5%2025-04-29Fix
CVE-2025-4082WebGL shader attribute memory corruption in Thunderbird for macOS5.9CISA ADP v3.10.5%2025-04-29Fix
CVE-2025-4080PHPGurukul Online Nurse Hiring System view-request.php SQL injection8.8v3.10.5%2025-04-29
CVE-2025-4079PCMan FTP Server RENAME command buffer overflow9.8v3.10.8%2025-04-29
CVE-2025-4078Wangshen SecGate 3600 g=log_export_file path traversal5.3CNA v4.01.1%2025-04-29Reported exploitedNuclei
CVE-2025-4077code-projects School Billing System searchrec stack-based overflow7.8v3.10.4%2025-04-29
CVE-2025-4076LB-LINK BL-AC3600 Password lighttpd.cgi easy_uci_set_option_string_0 command injection5.3CNA v4.019.8%2025-04-29
CVE-2025-4075VMSMan login.php cross-site scripting5.3CNA v4.00.4%2025-04-29
CVE-2025-4074PHPGurukul Curfew e-Pass Management System pass-bwdates-report.php SQL injection9.8v3.10.6%2025-04-29
CVE-2025-4073PHPGurukul Student Record System change-password.php SQL injection9.8v3.10.6%2025-04-29
CVE-2025-4072PHPGurukul Online Nurse Hiring System edit-nurse.php SQL injection8.8v3.10.5%2025-04-29
CVE-2025-4071PHPGurukul COVID19 Testing Management System test-details.php SQL injection9.8v3.10.6%2025-04-29
CVE-2025-4070PHPGurukul Rail Pass Management System changeimage.php SQL injection9.8v3.10.6%2025-04-29
CVE-2025-4069code-projects Product Management System add_item stack-based overflow7.8v3.10.4%2025-04-29
CVE-2025-4068code-projects Simple Movie Ticket Booking System changeprize stack-based overflow7.8v3.10.4%2025-04-29
CVE-2025-4067ScriptAndTools Online-Travling-System viewpackage.php access control6.9CNA v4.00.6%2025-04-29
CVE-2025-4066ScriptAndTools Online-Travling-System addpackage.php access control9.8v3.10.6%2025-04-29
CVE-2025-4065ScriptAndTools Online-Travling-System addadvertisement.php access control7.5v3.10.5%2025-04-29
CVE-2025-4064ScriptAndTools Online-Travling-System viewenquiry.php access control6.9CNA v4.00.6%2025-04-29
CVE-2025-4063code-projects Student Information Management System cancel stack-based overflow7.8v3.10.3%2025-04-29
CVE-2025-4062code-projects Theater Seat Booking System cancel stack-based overflow7.8v3.10.3%2025-04-29
CVE-2025-4061code-projects Clothing Store Management System add_item stack-based overflow7.8v3.10.3%2025-04-29
CVE-2025-4060PHPGurukul Notice Board System category.php SQL injection9.8v3.10.5%2025-04-29
CVE-2025-4059code-projects Prison Management System Prison_Mgmt_Sys addrecord stack-based overflow7.8v3.10.4%2025-04-29
CVE-2025-4058Projectworlds Online Examination System Bloodgroop_process.php SQL injection9.8v3.10.6%2025-04-29
CVE-2025-4035libsoup cookie domain handling case sensitivity bypass4.3CNA v3.10.4%2025-04-29Fix
CVE-2025-3929Stored XSS vulnerability in MDaemon Email Server6.1NVD v3.10.6%2025-04-29Fix
CVE-2025-3911Exposure in Docker Desktop logs of environment variables configured for running containers5.2CNA v4.00.2%2025-04-29Fix
CVE-2025-3910Red Hat Build of Keycloak org.keycloak.authentication: Two factor authentication bypass5.4CNA v3.10.4%2025-04-29Fix
CVE-2025-3891Red Hat Enterprise Linux 8 mod_auth_openidc: Dos7.5NVD v3.11.6%2025-04-29Fix
CVE-2025-3501Org.keycloak.protocol.services: Keycloak hostname verification8.2CNA v3.10.5%2025-04-29Fix
CVE-2025-3452SecuPress Free WordPress plugin missing authorization authenticated arbitrary plugin installation4.3CNA v3.10.3%2025-04-29Fix
CVE-2025-3301Series 2 SoCs and modules ECDH and EdDSA operations vulnerability1.0CNA v4.00.2%2025-04-29Fix
CVE-2025-2893Gutenverse WordPress plugin stored cross-site scripting5.4v3.10.3%2025-04-29Fix
CVE-2025-2817Privilege escalation in Thunderbird Updater8.8CISA ADP v3.10.7%2025-04-29Fix
CVE-2025-1551IBM Operational Decision Manager cross-site scripting6.1CNA v3.10.3%2025-04-29Fix
CVE-2025-1194Regular expression denial of service (ReDoS) in huggingface/Transformers6.5v3.10.4%2025-04-29Fix
CVE-2025-0716Google AngularJS improperly sanitizes SVG elements4.8CNA v3.10.4%2025-04-29Fix
CVE-2025-0520ShowDoc unauthenticated file upload remote code execution9.4CNA v4.02.6%2025-04-29NucleiFix
CVE-2025-46661IPW Metazo server-side template injection9.8v3.10.8%2025-04-28
CVE-2025-46614Snowflake ODBC sensitive information in log files3.3CNA v3.10.2%2025-04-28Fix
CVE-2025-46328snowflakedb snowflake-connector-nodejs time-of-check time-of-use race condition3.3CNA v3.10.2%2025-04-28Fix
CVE-2025-46327Go Snowflake driver has race condition when checking access to Easy Logging configuration file3.3CNA v3.10.1%2025-04-28Fix
CVE-2025-46326Snowflake Connector for .NET Easy Logging configuration file check race condition3.3CNA v3.10.2%2025-04-28Fix
CVE-2025-45953PHPGurukul Hostel Management System session fixation9.1CISA ADP v3.10.4%2025-04-28
CVE-2025-45949PHPGurukul User Registration and Login and User Management System session fixation9.8CISA ADP v3.10.5%2025-04-28
CVE-2025-45947PHPGurukul Online Banquet Booking System code injection9.8CISA ADP v3.10.8%2025-04-28
CVE-2025-43857net-imap rubygem vulnerable to possible DoS by memory exhaustion6.0CNA v4.00.5%2025-04-28Fix
CVE-2025-43854DIFY vulnerable to clickjacking Attack2.3CNA v4.00.2%2025-04-28Fix
CVE-2025-42598SEIKO EPSON printer drivers incorrect default permissions8.4CNA v4.00.2%2025-04-28
CVE-2025-39367Kleo WordPress theme broken access control5.3CNA v3.10.3%2025-04-28Fix
CVE-2025-34491GFI MailEssentials MultiNode insecure deserialization8.8v3.10.9%2025-04-28Fix
CVE-2025-34490GFI MailEssentials XXE arbitrary file read6.5v3.10.7%2025-04-28Fix
CVE-2025-34489GFI MailEssentials local privilege escalation7.8v3.10.3%2025-04-28Fix
CVE-2025-32472SICK multiScan1XX DoS attack by conducting a slowloris-type attack5.3CNA v3.10.6%2025-04-28
CVE-2025-32471SICK FLX3-CPUC200 and TDC-X401GL password storage weak credentials3.7CNA v3.10.4%2025-04-28
CVE-2025-32470SICK FLX0-GPNT100 unauthenticated change of IP adress7.5CNA v3.10.6%2025-04-28
CVE-2025-31651Apache Tomcat: Bypass of rules in Rewrite Valve9.8NVD v3.14.2%2025-04-28Fix
CVE-2025-31650Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame7.5NVD v3.161.3%2025-04-28Exploit codeFix
CVE-2025-31144SIOS Technology Quick Agent V3 improper channel restriction6.9CNA v4.00.5%2025-04-28
CVE-2025-27937SIOS Technology Quick Agent V3 path traversal7.1CNA v4.00.7%2025-04-28
CVE-2025-26692SIOS Technology Quick Agent V3 path traversal9.2CNA v4.00.9%2025-04-28
CVE-2025-25776CodeAstro Bus Ticket Booking System User Registration and User Profile features cross-site scripting5.0CISA ADP v3.10.3%2025-04-28
CVE-2025-23377Dell PowerProtect Data Manager improper output encoding4.2CNA v3.10.2%2025-04-28Fix
CVE-2025-23376Dell PowerProtect Data Manager Reporting server-side template injection2.3CNA v3.10.2%2025-04-28Fix
CVE-2025-23375Dell PowerProtect Data Manager incorrect use of privileged APIs7.8CNA v3.10.1%2025-04-28Fix
CVE-2025-22235Spring Boot EndpointRequest.to creates wrong matcher if actuator endpoint is not exposed7.3CNA v3.10.4%2025-04-28Fix
CVE-2025-4039PHPGurukul Rail Pass Management System search-pass.php SQL injection9.8v3.10.6%2025-04-28
CVE-2025-4038code-projects Train Ticket Reservation System reservation stack-based overflow5.5v3.10.3%2025-04-28
CVE-2025-4037code-projects ATM Banking moneyWithdraw logic error5.5v3.10.3%2025-04-28
CVE-2025-4036201206030 Novel Chapter AuthorController.java updateBookChapter access control9.8v3.10.5%2025-04-28
CVE-2025-4034Projectworlds Online Examination System inser_doc_process.php SQL injection9.8v3.10.6%2025-04-28
CVE-2025-4033PHPGurukul Nipah Virus Testing Management System patient-search-report.php SQL injection9.8v3.10.5%2025-04-28
CVE-2025-4032inclusionAI AWorld shell_tool.py subprocess.Popen os command injection8.1v3.13.3%2025-04-28
CVE-2025-4031PHPGurukul Pre-School Enrollment System aboutus.php SQL injection9.8v3.10.5%2025-04-28
CVE-2025-4030PHPGurukul COVID19 Testing Management System search-report-result.php SQL injection9.8v3.10.5%2025-04-28
CVE-2025-4029code-projects Personal Diary Management System New Record addrecord stack-based overflow7.8v3.10.4%2025-04-28
CVE-2025-4028PHPGurukul COVID19 Testing Management System profile.php SQL injection9.8NVD v3.10.5%2025-04-28
CVE-2025-4027PHPGurukul Old Age Home Management System rules.php SQL injection9.8v3.10.6%2025-04-28
CVE-2025-4026PHPGurukul Nipah Virus Testing Management System profile.php SQL injection9.8v3.10.6%2025-04-28
CVE-2025-4025itsourcecode Placement Management System registration.php SQL injection9.8v3.10.6%2025-04-28
CVE-2025-4024itsourcecode Placement Management System add_drive.php SQL injection9.8v3.10.6%2025-04-28
CVE-2025-4023itsourcecode Placement Management System add_company.php SQL injection9.8v3.10.6%2025-04-28
CVE-2025-4022web-arena-x Webarena evaluators.py HTMLContentEvaluator code injection8.8v3.10.6%2025-04-28
CVE-2025-4021code-projects Patient Record Management System edit_spatient.php SQL injection7.5v3.10.5%2025-04-28
CVE-2025-4020PHPGurukul Old Age Home Management System contact.php SQL injection9.8v3.10.6%2025-04-28
CVE-2025-401920120630 Novel-Plus GeneratorController.java genCode missing authentication9.8v3.10.7%2025-04-28
CVE-2025-401820120630 Novel-Plus CrawlController.java addCrawlSource missing authentication7.5v3.10.8%2025-04-28
CVE-2025-401720120630 Novel-Plus LogController.java list improper authorization6.5v3.10.6%2025-04-28
CVE-2025-401620120630 Novel-Plus LogController.java deleteIndex improper authorization9.1v3.10.5%2025-04-28
CVE-2025-401520120630 Novel-Plus SessionController.java list missing authentication7.5v3.10.8%2025-04-28
CVE-2025-4014PHPGurukul Art Gallery Management System manage-art-medium.php SQL injection9.8v3.10.5%2025-04-28
CVE-2025-4013PHPGurukul Art Gallery Management System aboutus.php SQL injection9.8v3.10.5%2025-04-28
CVE-2025-4012playeduxyz PlayEdu 开源培训系统 User Avatar create server-side request forgery7.5v3.10.5%2025-04-28
CVE-2025-4011Redmine Custom Query cross-site scripting5.1CNA v4.00.3%2025-04-28Fix
CVE-2025-4007Tenda W12/i24 httpd modules cgidhcpsCfgSet stack-based overflow8.7CNA v4.01.0%2025-04-28Emerging Threats
CVE-2025-4006youyiio BeyongCms Document Management Page Upload.html unrestricted upload5.1CNA v4.00.3%2025-04-28
CVE-2025-4005PHPGurukul COVID19 Testing Management System patient-report.php SQL injection9.8v3.10.5%2025-04-28
CVE-2025-4004PHPGurukul COVID19 Testing Management System password-recovery.php SQL injection9.8v3.10.5%2025-04-28
CVE-2025-4003RefindPlusRepo RefindPlus RP_ApfsIo.c InternalApfsTranslateBlock null pointer dereference6.8CNA v4.00.2%2025-04-28
CVE-2025-4002RefindPlusRepo RefindPlus BootLog.c GetDebugLogFile null pointer dereference6.8CNA v4.00.2%2025-04-28
CVE-2025-4001scipopt scip File Descriptor genRandomLOPInstance.c main file descriptor consumption4.8CNA v4.00.2%2025-04-28Fix
CVE-2025-4000Seeyon Zhiyuan OA Web Application System ssoproxy.jsp cross-site scripting5.4v3.10.3%2025-04-28
CVE-2025-3999Seeyon Zhiyuan OA Web Application System URL parameter date.jsp cross-site scripting5.4v3.10.3%2025-04-28
CVE-2025-3998CodeAstro Membership Management System renew.php SQL injection9.8v3.10.6%2025-04-28
CVE-2025-3997dazhouda lecms Personal Information page index.php cross-site request forgery5.3CNA v4.00.2%2025-04-28
CVE-2025-3996TOTOLINK N150RT MAC Filtering page home.htm cross-site scripting4.8v3.10.4%2025-04-28
CVE-2025-3995TOTOLINK N150RT LAN settings page fromStaticDHCP cross-site scripting3.4NVD v3.10.4%2025-04-28
CVE-2025-3994TOTOLINK N150RT IP Port Filtering home.htm cross-site scripting3.4NVD v3.15.0%2025-04-28Emerging Threats
CVE-2025-3993TOTOLINK N150RT formWsc buffer overflow8.7CNA v4.01.0%2025-04-28Emerging Threats
CVE-2025-3992TOTOLINK N150RT formWlwds buffer overflow8.7CNA v4.01.0%2025-04-28Emerging Threats
CVE-2025-3991TOTOLINK N150RT formWdsEncrypt buffer overflow8.7CNA v4.01.0%2025-04-28Emerging Threats
CVE-2025-3706104 Corporation eHRMS reflected cross-site scripting6.1CNA v3.10.3%2025-04-28Fix
CVE-2025-3224Docker Desktop update process directory deletion privilege escalation7.3CNA v4.00.2%2025-04-28Fix
CVE-2025-3200Com-Server Exposed via Weak TLS9.1CNA v3.10.4%2025-04-28Fix
CVE-2025-0627TaxoPress AI Autotagger widget settings stored cross-site scripting3.5CISA ADP v3.10.3%2025-04-28Fix
CVE-2025-0049Disclosure of sensitive information in an error message in GoAnywhere prior to3.5CNA v3.10.3%2025-04-28Fix
CVE-2025-46690Ververica Platform forced browsing8.8v3.10.4%2025-04-27
CVE-2025-46689Ververica Platform cross-site scripting6.1v3.10.3%2025-04-27
CVE-2025-46688QuickJS incorrect buffer size calculation8.4v3.10.3%2025-04-27Fix
CVE-2025-46687QuickJS resource exhaustion7.8v3.10.3%2025-04-27Fix
CVE-2025-46675nasa CryptoLib improper control of dynamic code4.2v3.10.3%2025-04-27Fix
CVE-2025-46674nasa CryptoLib active debug code9.9v3.10.6%2025-04-27Fix
CVE-2025-46673nasa CryptoLib improper control of dynamic code9.9v3.10.5%2025-04-27Fix
CVE-2025-46672nasa CryptoLib unchecked return value8.8v3.10.5%2025-04-27Fix
CVE-2025-46657Karazal cross-site scripting6.1NVD v3.10.3%2025-04-27Exploit code
CVE-2025-46580ZTE GoldenDB Database product has a code-related vulnerability7.7CNA v3.10.4%2025-04-27Fix
CVE-2025-46579ZTE GoldenDB Database product has a DDE injection8.4CNA v3.10.3%2025-04-27Fix
CVE-2025-46578ZTE GoldenDB Database product has SQL injection vulnerabilities in multiple interfaces6.5CNA v3.10.4%2025-04-27Fix
CVE-2025-46577ZTE GoldenDB Database product has an SQL injection6.5CNA v3.10.4%2025-04-27Fix
CVE-2025-46576ZTE GoldenDB Database product has a privilege escalation5.4CNA v3.10.3%2025-04-27Fix
CVE-2025-46575ZTE GoldenDB Database product has an information disclosure4.9CNA v3.10.4%2025-04-27Fix
CVE-2025-46574ZTE GoldenDB Database product has an input validation vulnerability4.1CNA v3.10.2%2025-04-27Fix
CVE-2025-3990TOTOLINK N150RT formVlan buffer overflow8.8v3.11.0%2025-04-27Emerging Threats
CVE-2025-3989TOTOLINK N150RT formStaticDHCP buffer overflow8.7CNA v4.01.0%2025-04-27Emerging Threats
CVE-2025-3988TOTOLINK N150RT formPortFw buffer overflow8.7CNA v4.01.4%2025-04-27Emerging Threats
CVE-2025-3987TOTOLINK N150RT formWsc command injection8.8v3.111.3%2025-04-27Emerging Threats
CVE-2025-3986Apereo CAS CasConfigurationMetadataServerController.java redos7.5v3.10.6%2025-04-27
CVE-2025-3985Apereo CAS ResponseEntity redos4.9v3.10.6%2025-04-27
CVE-2025-3984Apereo CAS Groovy Code RegisteredServiceSimpleFormController.java saveService code injection7.5v3.10.5%2025-04-27
CVE-2025-3983AMTT Hotel Broadband Operation System nlog_down.php command injection7.2v3.114.8%2025-04-27
CVE-2025-3982nortikin Sverchok Set Property Mk2 Node getsetprop_mk2.py SvSetPropNodeMK2 prototype pollution8.8v3.10.6%2025-04-27
CVE-2025-3981wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System details improper authorization5.3v3.10.4%2025-04-27
CVE-2025-3980wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System list improper authorization5.3v3.15.5%2025-04-27
CVE-2025-3979dazhouda Lecms Password Change index.php cross-site request forgery6.5v3.10.3%2025-04-27
CVE-2025-3978dazhouda Lecms user_set.htm information disclosure7.5v3.10.5%2025-04-27
CVE-2025-3977iteachyou Dreamer CMS Attachment download improper authorization5.3CNA v4.00.4%2025-04-27
CVE-2025-3976PHPGurukul COVID19 Testing Management System new-user-testing.php SQL injection9.8v3.10.5%2025-04-27
CVE-2025-3975ScriptAndTools eCommerce-website-in-PHP subscriber-csv.php information disclosure6.9CNA v4.00.8%2025-04-27
CVE-2025-3974PHPGurukul COVID19 Testing Management System edit-phlebotomist.php SQL injection9.8v3.10.5%2025-04-27
CVE-2025-3973PHPGurukul COVID19 Testing Management System check_availability.php SQL injection9.8v3.10.5%2025-04-27
CVE-2025-3972PHPGurukul COVID19 Testing Management System bwdates-report-result.php SQL injection9.8v3.10.5%2025-04-27
CVE-2025-3971PHPGurukul COVID19 Testing Management System add-phlebotomist.php SQL injection9.8v3.10.5%2025-04-27
CVE-2025-3970baseweb JSite save cross-site scripting5.4v3.10.4%2025-04-27
CVE-2025-3969codeprojects News Publishing Site Dashboard Edit Category page edit-category.php unrestricted upload9.8v3.10.5%2025-04-27Exploit code
CVE-2025-3968codeprojects News Publishing Site Dashboard api.php SQL injection8.8v3.10.5%2025-04-27
CVE-2025-3967itwanger paicoding Article post improper authorization5.3CNA v4.00.5%2025-04-27
CVE-2025-3966itwanger paicoding Browsing History home information disclosure5.3v3.10.5%2025-04-27
CVE-2025-3965itwanger paicoding post cross-site scripting5.4v3.10.4%2025-04-27
CVE-2025-3964withstars Books-Management-System Article del cross-site request forgery5.3CNA v4.00.3%2025-04-27
CVE-2025-3963withstars Books-Management-System Background interface list authorization9.8v3.10.7%2025-04-27
CVE-2025-3962withstars Books-Management-System Comment add cross-site scripting4.1v3.10.4%2025-04-27
CVE-2025-3961withstars Books-Management-System do cross-site scripting4.1v3.10.4%2025-04-27
CVE-2025-3960withstars Books-Management-System Background interface allreaders.html authorization9.8v3.10.7%2025-04-27
CVE-2025-3959withstars Books-Management-System reader_delete.html cross-site request forgery5.3CNA v4.00.3%2025-04-27
CVE-2025-3958withstars Books-Management-System Book Edit page book_edit_do.html cross-site scripting4.1v3.10.4%2025-04-27
CVE-2025-3957opplus springboot-admin SysLogDao.xml SQL injection9.8v3.10.5%2025-04-27
CVE-2025-3956201206030 novel-cloud BookInfoMapper.xml RestResp SQL injection9.8v3.10.4%2025-04-27
CVE-2025-3955codeprojects Patient Record Management System edit_rpatient.php.php SQL injection7.5v3.10.5%2025-04-27
CVE-2025-3886Cato Networks SDP Client CatoNetworks CatoClient PrivilegedHelperTool race condition5.7CNA v4.00.2%2025-04-27Fix
CVE-2025-2866The Document Foundation LibreOffice PDF signature forgery with adbe.pkcs7.sha1 SubFilter2.4CNA v4.00.1%2025-04-27Fix
CVE-2025-46656python-markdownify improper quantity validation3.3v3.10.2%2025-04-26Fix
CVE-2025-46655HackMD CodiMD unprotected alternate path4.9CNA v3.10.2%2025-04-26
CVE-2025-46654HackMD CodiMD unprotected alternate path4.9CNA v3.10.3%2025-04-26Fix
CVE-2025-46653Formidable relies on hexoid to prevent guessing of filenames for untrusted executable content3.1v3.10.4%2025-04-26Fix
CVE-2025-46652IZArc Mark-of-the-Web handling vulnerability6.1CNA v3.10.3%2025-04-26
CVE-2025-46646Artifex Ghostscript path traversal4.5CNA v3.10.2%2025-04-26Fix
CVE-2025-3954ChurchCRM Referer server-side request forgery6.3CNA v4.00.6%2025-04-26
CVE-2025-3915Aeropage Sync for Airtable missing authorization4.3v3.10.3%2025-04-26Fix
CVE-2025-3914Aeropage Sync for Airtable WordPress plugin authenticated (Subscriber+) arbitrary file upload8.8v3.117.4%2025-04-26Exploit codeFix
CVE-2025-3906Integração entre Eduzz e Woocommerce - missing authorization to Authenticated privilege escalation8.8CNA v3.10.5%2025-04-26
CVE-2025-3491The Add custom page template plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'acpt_validate_setting' function. This is due to insufficient sanitization of the 'template_name' parameter. This makes it possib7.2CNA v3.10.8%2025-04-26
CVE-2025-2907Order Delivery Date Pro for WooCommerce WordPress plugin unauthenticated arbitrary option update9.8CISA ADP v3.11.4%2025-04-26NucleiExploit codeFix
CVE-2025-2851GL.iNet GL-A1300 Slate Plus RPC plugins.so buffer overflow8.6CNA v4.00.4%2025-04-26Fix
CVE-2025-2850GL.iNet GL-A1300 Slate Plus Download interface improper authorization5.1CNA v4.00.2%2025-04-26Fix
CVE-2025-2811GL.iNet GL-A1300 Slate Plus API redos6.9CNA v4.00.4%2025-04-26Fix
CVE-2025-2801dorinabc Smart Forms shortcode execution code injection7.3CNA v3.10.5%2025-04-26
CVE-2025-2105Jupiter X Core WordPress plugin unauthenticated PHP object injection via PHAR8.1CNA v3.10.8%2025-04-26Fix
CVE-2025-2101Edumall WordPress theme unauthenticated local file inclusion8.1CNA v3.10.9%2025-04-26Fix
CVE-2025-1458Element Pack Elementor Addons WordPress plugin stored cross-site scripting5.4v3.10.2%2025-04-26Fix
CVE-2025-46618JetBrains TeamCity cross-site scripting3.5CNA v3.163.0%2025-04-25Fix
CVE-2025-46617Quantum StorNext hard-coded credentials7.2CNA v3.10.3%2025-04-25Fix
CVE-2025-46616Quantum StorNext unrestricted file upload9.9CNA v3.10.7%2025-04-25Fix
CVE-2025-46613openplcproject OpenPLC race condition7.5CNA v3.10.2%2025-04-25
CVE-2025-46599CNCF K3s Kubernetes kubelet configuration exposes credentials6.8CNA v3.10.5%2025-04-25Fix
CVE-2025-46595backdropcms Flag An cross-site scripting6.4CNA v3.10.2%2025-04-25Fix
CVE-2025-46547Sherpa Orchestrator cross-site request forgery6.1v3.10.2%2025-04-25
CVE-2025-46546Sherpa Orchestrator SQL injection8.8v3.10.4%2025-04-25
CVE-2025-46545Sherpa Orchestrator cross-site scripting4.8v3.10.3%2025-04-25
CVE-2025-46544Sherpa Orchestrator incorrect authorization6.5v3.10.3%2025-04-25
CVE-2025-46535Custom Login and Registration WordPress plugin broken access control5.4CNA v3.10.3%2025-04-25
CVE-2025-46482WP Quiz WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-04-25
CVE-2025-46433JetBrains TeamCity relative path traversal4.9CNA v3.10.5%2025-04-25Fix
CVE-2025-46432JetBrains TeamCity sensitive information in log files4.3CNA v3.11.0%2025-04-25Fix
CVE-2025-46333z2d OOB composition could lead to invalid memory access and corruption7.3CNA v4.00.2%2025-04-25
CVE-2025-43865React Router allows pre-render data spoofing on React-Router framework mode8.2CNA v3.10.8%2025-04-25Fix
CVE-2025-43864remix-run react-router react Router allows a DoS via cache poisoning by forcing SPA mode7.5CNA v3.120.5%2025-04-25Exploit codeFix
CVE-2025-43862Dify allows unauthorized access and Modification of APP Orchestration7.6CNA v3.10.3%2025-04-25Fix
CVE-2025-43016JetBrains Rider relative path traversal5.4CNA v3.10.4%2025-04-25Fix
CVE-2025-32986Netscout Ngeniusone information disclosure7.5CISA ADP v3.10.4%2025-04-25Fix
CVE-2025-32985Netscout Ngeniusone hard-coded credentials9.8CISA ADP v3.10.4%2025-04-25Fix
CVE-2025-32984Netscout Ngeniusone cross-site scripting6.1CISA ADP v3.10.3%2025-04-25Fix
CVE-2025-32983Netscout Ngeniusone information disclosure7.5CISA ADP v3.10.4%2025-04-25Fix
CVE-2025-32982Netscout Ngeniusone improper authorization7.5CISA ADP v3.10.4%2025-04-25Fix
CVE-2025-32981Netscout Ngeniusone incorrect default permissions7.1CISA ADP v3.10.2%2025-04-25
CVE-2025-32980NETSCOUT nGeniusONE sudo configuration incorrect privilege assignment9.8CISA ADP v3.10.4%2025-04-25
CVE-2025-32979Netscout Ngeniusone insecure temporary file6.5CISA ADP v3.10.3%2025-04-25Fix
CVE-2025-32432Craft CMS code injection10.0CNA v3.199.8%2025-04-25KEVNucleiMetasploitEmerging ThreatsExploit codeKCVFix
CVE-2025-32045Moodle: Hidden grades shown to users without permission on some grade reports5.3CNA v3.10.3%2025-04-25Fix
CVE-2025-32044Moodle: Unauthenticated rest API user data exposure7.5CNA v3.10.5%2025-04-25Exploit codeFix
CVE-2025-28354Entrust Printer Manager path traversal6.5CISA ADP v3.10.5%2025-04-25
CVE-2025-28128Mytel Telecom Online Account System authentication bypass by spoofing7.0CISA ADP v3.10.4%2025-04-25
CVE-2025-28076EasyVirt DCScope management API SQL injection6.5CISA ADP v3.10.3%2025-04-25
CVE-2025-25775CodeAstro Bus Ticket Booking System SQL injection9.8CISA ADP v3.10.5%2025-04-25
CVE-2025-3935ConnectWise ScreenConnect improper authentication8.1CNA v3.13.5%2025-04-25KEVFix
CVE-2025-3928Commvault Web Server unspecified vulnerability8.8NVD v3.12.5%2025-04-25KEVFix
CVE-2025-3923buildwps Prevent Direct Access unique file name generator information disclosure5.3CNA v3.10.4%2025-04-25Fix
CVE-2025-3912WS Form LITE WordPress plugin unauthorized access5.3CNA v3.10.4%2025-04-25Fix
CVE-2025-38701 Decembrie 1918 WordPress plugin cross-site request forgery to stored cross-site scripting6.1CNA v3.10.3%2025-04-25
CVE-2025-3868Custom Admin-Bar Favorites WordPress plugin reflected cross-site scripting6.1CNA v3.10.3%2025-04-25
CVE-2025-3867Ajax Comment Form CST WordPress plugin cross-site request forgery to stored cross-site scripting6.1CNA v3.10.3%2025-04-25
CVE-2025-3866The Add Google +1 (Plus one) social share Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the google-plus-one-share-button page. This makes it possible for unauthenticated att6.1CNA v3.10.3%2025-04-25
CVE-2025-3861The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access and modification of data| due to a misconfigured capability check on the 'pda_lite_custom_permission_check' function in versions 2.8.6 to 2.8.8.2. This makes it possible for authenticated at5.4CNA v3.10.3%2025-04-25Fix
CVE-2025-3775ShopLentor WordPress plugin server-side request forgery6.5CNA v3.10.3%2025-04-25Fix
CVE-2025-3752Able Player, accessible HTML5 media player WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2025-04-25Fix
CVE-2025-3743Upsell Funnel Builder for WooCommerce WordPress plugin unauthenticated order manipulation5.3CNA v3.10.4%2025-04-25Fix
CVE-2025-3647Moodle: Idor when accessing the cohorts report4.3CNA v3.10.3%2025-04-25Fix
CVE-2025-3645Moodle: Idor in messaging web service allows access to some user details4.3CNA v3.10.4%2025-04-25Fix
CVE-2025-3644Moodle: Ajax section delete does not respect course_can_delete_section4.3CNA v3.10.3%2025-04-25Fix
CVE-2025-3643Moodle: Reflected XSS risk in policy tool5.4CNA v3.10.3%2025-04-25Fix
CVE-2025-3642Moodle: Authenticated remote code execution risk in the Moodle lms equella repository8.8CNA v3.11.0%2025-04-25Fix
CVE-2025-3641Moodle: Authenticated remote code execution risk in the Moodle lms dropbox repository8.8CNA v3.11.0%2025-04-25Fix
CVE-2025-3640Moodle: Idor in web service allows users enrolled in a course to access some details of other users4.3CNA v3.10.4%2025-04-25Fix
CVE-2025-3638Moodle: Csrf risk in brickfield tool's analysis request action8.8CISA ADP v3.10.3%2025-04-25Fix
CVE-2025-3637Moodle: Csrf token exposure via URL in Moodle mod_data module3.1CNA v3.10.4%2025-04-25Fix
CVE-2025-3636Moodle: Idor in Moodle rss block allows unauthorized access to rss feeds4.3CNA v3.10.3%2025-04-25Fix
CVE-2025-3635Moodle: Csrf risk in Moodle user tours manager allows tour duplication3.5CNA v3.10.2%2025-04-25Fix
CVE-2025-3634Moodle: Moodle allows course self-enrolment before completing mfa4.3CNA v3.10.3%2025-04-25Fix
CVE-2025-3628Moodle: Moodle assignment submission search leaks anonymous student identities4.3CNA v3.10.3%2025-04-25Fix
CVE-2025-3627Moodle: Partial data exposure in Moodle before completing multi-factor authentication4.3CNA v3.10.3%2025-04-25Fix
CVE-2025-3625Moodle: User DoS and name disclosure via IDOR in Moodle mfa email factor revoke action7.1CNA v3.10.4%2025-04-25Fix
CVE-2025-3606Vestel AC Charger exposure of sensitive system information to an unauthorized control sphere8.7CNA v4.00.4%2025-04-25Fix
CVE-2025-3511Mitsubishi Electric CC-Link IE TSN Remote I/O module NZ2GN2S1-32D improper input validation7.5CNA v3.10.9%2025-04-25Fix
CVE-2025-2986IBM Maximo Asset Management cross-site scripting5.5CNA v3.10.2%2025-04-25Fix
CVE-2025-2580Contact Form by Bit Form WordPress plugin stored cross-site scripting4.9CNA v3.10.3%2025-04-25Fix
CVE-2025-2470Service Finder Bookings WordPress plugin unauthenticated privilege escalation9.8CNA v3.10.5%2025-04-25Fix
CVE-2025-2238Vikinger WordPress theme privilege escalation8.8CNA v3.10.4%2025-04-25Fix
CVE-2025-2185ALBEDO Telecom Net.Time PTP/NTP Clock insufficient session expiration8.5CNA v4.00.3%2025-04-25Fix
CVE-2025-2070FileZ Client XML external entity injection5.1CNA v4.00.1%2025-04-25Fix
CVE-2025-2069FileZ Client cross-site scripting5.1CNA v4.00.2%2025-04-25Fix
CVE-2025-2068FileZ Client open redirect5.1CNA v4.00.1%2025-04-25Fix
CVE-2025-1565Mayosis Core WordPress plugin unauthenticated arbitrary file read7.5CNA v3.10.6%2025-04-25Fix
CVE-2025-1279BM Content Builder WordPress plugin missing authorization authenticated arbitrary options update8.8CNA v3.10.4%2025-04-25Fix
CVE-2025-0671Icegram Express template settings stored cross-site scripting6.1CISA ADP v3.10.3%2025-04-25Fix
CVE-2025-46542Xpert Tab WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-04-24
CVE-2025-46541WP-reCAPTCHA-bp WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2025-04-24
CVE-2025-46540GNA Search Shortcode WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-04-24
CVE-2025-46538Inline Text Popup WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-04-24
CVE-2025-46536Carousel-of-post-images WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-04-24
CVE-2025-46534Image Style Hover WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-04-24
CVE-2025-46533Landing pages and Domain aliases for WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2025-04-24
CVE-2025-46532Tooltip WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.2%2025-04-24
CVE-2025-46531WP AVCL Automation Helper (formerly WPFlyLeads) WordPress plugin server side request forgery (SSRF)4.9CNA v3.10.2%2025-04-24
CVE-2025-46530Hacklog Remote Attachment WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.1%2025-04-24
CVE-2025-46529Business Contact Widget WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2025-04-24
CVE-2025-46528Availability Calendar WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.1%2025-04-24
CVE-2025-46525WP Cookie Consent WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2025-04-24
CVE-2025-46524WP Filter Post Category WordPress plugin cross-site request forgery (CSRF) to stored XSS7.1CNA v3.10.1%2025-04-24
CVE-2025-46523COVID-19 (Coronavirus) Update Your Customers WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2025-04-24
CVE-2025-46522Tabs WordPress plugin cross-site request forgery (CSRF) to stored XSS7.1CNA v3.10.1%2025-04-24
CVE-2025-46521WS Force Login Page WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2025-04-24Fix
CVE-2025-46520Related Posts via Taxonomies WordPress plugin cross-site request forgery (CSRF) to stored XSS7.1CNA v3.10.1%2025-04-24
CVE-2025-46519Media Library Downloader WordPress plugin broken access control4.3CNA v3.10.3%2025-04-24Fix
CVE-2025-46517Blog Manager WP WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2025-04-24
CVE-2025-46516Twitter Card Generator WordPress plugin cross-site request forgery (CSRF) to stored XSS7.1CNA v3.10.1%2025-04-24
CVE-2025-46514Milat jQuery Automatic Popup WordPress plugin CSRF to stored XSS7.1CNA v3.10.1%2025-04-24
CVE-2025-46513All in One Time Clock Lite WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.2%2025-04-24Fix
CVE-2025-46512Custom Functions WordPress plugin CSRF to stored XSS7.1CNA v3.10.1%2025-04-24
CVE-2025-46511BeerXML Shortcode WordPress plugin server side request forgery (SSRF)6.4CNA v3.10.2%2025-04-24Fix
CVE-2025-46510Contact Form 7 Calendar WordPress plugin CSRF to stored XSS7.1CNA v3.10.2%2025-04-24
CVE-2025-46509360 View WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-04-24
CVE-2025-46508Advanced lazy load WordPress plugin CSRF to stored XSS7.1CNA v3.10.2%2025-04-24
CVE-2025-46507Unsafe Mimetypes WordPress plugin cross-site request forgery (CSRF) to stored XSS7.1CNA v3.10.2%2025-04-24
CVE-2025-46506WpZon Amazon Affiliate WordPress plugin CSRF to XSS7.1CNA v3.10.2%2025-04-24
CVE-2025-46505Peekaboo WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-04-24
CVE-2025-46504Vasaio QR Code WordPress plugin CSRF to XSS7.1CNA v3.10.2%2025-04-24
CVE-2025-46503Simple Google Photos Grid WordPress plugin server side request forgery (SSRF)4.9CNA v3.10.2%2025-04-24Fix
CVE-2025-46502LSD Custom taxonomy and category meta WordPress plugin CSRF to XSS7.1CNA v3.10.3%2025-04-24
CVE-2025-46501Mixcloud Embed WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-04-24
CVE-2025-46499PayPal Express Checkout WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.3%2025-04-24
CVE-2025-46498Zalo Official Live Chat WordPress plugin cross-site request forgery (CSRF)5.4CNA v3.10.2%2025-04-24
CVE-2025-46497Navegg Analytics WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.2%2025-04-24
CVE-2025-46496Mini twitter feed WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-04-24
CVE-2025-46495tomontoast Drop Caps cross-site request forgery6.5CNA v3.10.1%2025-04-24
CVE-2025-46492Pham Thanh Call Now PHT Blog cross-site request forgery7.1CNA v3.10.2%2025-04-24
CVE-2025-46491Multi-Column Taxonomy List WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-04-24
CVE-2025-46489Bulk Assign Linked Products For WooCommerce WordPress plugin broken access control5.3CNA v3.10.3%2025-04-24
CVE-2025-46485WP Customize Login Page WordPress plugin broken access control5.3CNA v3.10.3%2025-04-24
CVE-2025-46484Image Hover Effects For WPBakery Page Builder WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-04-24
CVE-2025-46483Peadig’s Google +1 Button WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-04-24
CVE-2025-46481Flickr Shortcode Importer WordPress plugin PHP object injection7.2CNA v3.10.6%2025-04-24
CVE-2025-46480Nepali Post Date WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-04-24
CVE-2025-46479BBCode Deluxe WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-04-24
CVE-2025-46478Dropdown Content WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2025-04-24
CVE-2025-46477WP Customize Login Page WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.3%2025-04-24
CVE-2025-46476Awesome Wp Image Gallery WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-04-24
CVE-2025-46475Able Player WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-04-24Fix
CVE-2025-46473Social Counter WordPress plugin PHP object injection7.2CNA v3.10.6%2025-04-24Fix
CVE-2025-46472The Pack Elementor addons WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-04-24
CVE-2025-46471WP Custom Post Popup WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-04-24
CVE-2025-46470Smart Hashtags [#hashtagger] WordPress plugin broken access control4.3CNA v3.10.3%2025-04-24
CVE-2025-46469Send From WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.3%2025-04-24Fix
CVE-2025-46467RAphicon WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-04-24
CVE-2025-46466Modern Polls WordPress plugin CSRF to stored XSS7.1CNA v3.10.2%2025-04-24
CVE-2025-46465Print Science Designer WordPress plugin CSRF to stored XSS7.1CNA v3.10.2%2025-04-24
CVE-2025-46462WPVN WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.2%2025-04-24
CVE-2025-46461RRSSB WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-04-24
CVE-2025-46459Confirm User Registration WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.3%2025-04-24
CVE-2025-46457Wp Custom CMS Block WordPress plugin CSRF to stored XSS7.1CNA v3.10.2%2025-04-24
CVE-2025-46453WordPress Zoho Creator Forms plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-04-24
CVE-2025-46452Google News WordPress plugin CSRF to stored XSS7.1CNA v3.10.2%2025-04-24
CVE-2025-46451Floating Social Bar WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.3%2025-04-24
CVE-2025-46450occupancyplan WordPress plugin cross-site request forgery (CSRF) to stored XSS7.1CNA v3.10.2%2025-04-24
CVE-2025-46449WoWHead Tooltips WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2025-04-24
CVE-2025-46447Fable Extra WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-04-24Fix
CVE-2025-46445External Markdown WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-04-24
CVE-2025-46443Animate WordPress plugin server side request forgery (SSRF)4.9CNA v3.10.2%2025-04-24
CVE-2025-46442Loan Calculator WordPress plugin CSRF to stored XSS7.1CNA v3.10.2%2025-04-24
CVE-2025-46439Plugin Central WordPress plugin CSRF to arbitrary file deletion7.4CNA v3.10.2%2025-04-24
CVE-2025-46438GTDB Guitar Tuners WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-04-24
CVE-2025-46436SCSS-Library WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.2%2025-04-24
CVE-2025-46435Time Based Greeting WordPress plugin CSRF to stored XSS7.1CNA v3.10.2%2025-04-24
CVE-2025-46421libsoup redirect Authorization header handling information disclosure6.8CNA v3.10.6%2025-04-24Fix
CVE-2025-46420Red Hat Enterprise Linux 8 libsoup: Memory leak on soup_header_parse_quality_list via soup-headers.c6.5CNA v3.10.6%2025-04-24Fix
CVE-2025-46419Westermo WeOS improper syntax validation5.9CNA v3.10.4%2025-04-24Fix
CVE-2025-46417Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate7.5v3.10.2%2025-04-24Fix
CVE-2025-46275PLANET Technology Network Products missing authentication for critical function9.3CNA v4.00.6%2025-04-24Fix
CVE-2025-46274PLANET Technology Network Products use of hard-coded credentials9.3CNA v4.00.5%2025-04-24Fix
CVE-2025-46273PLANET Technology Network Products use of hard-coded credentials9.3CNA v4.00.6%2025-04-24Fix
CVE-2025-46272PLANET Technology Network Products OS command injection9.3CNA v4.01.2%2025-04-24Fix
CVE-2025-46271PLANET Technology Network Products OS command injection9.3CNA v4.02.0%2025-04-24Exploit codeFix
CVE-2025-46264WordPress PowerPress Podcasting plugin arbitrary file upload9.9CNA v3.10.4%2025-04-24Fix
CVE-2025-46261Seriously Simple Podcasting WordPress plugin cross-site scripting (XSS)4.8v3.10.3%2025-04-24Fix
CVE-2025-46260Sky Addons for Elementor WordPress plugin cross-site scripting (XSS)6.5CNA v3.10.3%2025-04-24Fix
CVE-2025-46248Frontend Dashboard WordPress plugin SQL injection9.3CNA v3.10.4%2025-04-24Fix
CVE-2025-46234Control Listings WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2025-04-24Fix
CVE-2025-46230Popup Builder WordPress plugin local file inclusion7.5CNA v3.10.8%2025-04-24Fix
CVE-2025-44135code-projects Online Class and Exam Scheduling System SQL injection6.5CISA ADP v3.10.3%2025-04-24
CVE-2025-44134code-projects Online Class and Exam Scheduling System SQL injection6.5CISA ADP v3.10.3%2025-04-24
CVE-2025-43861ManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflection4.4CNA v3.10.3%2025-04-24Fix
CVE-2025-43859h11 accepts some malformed Chunked-Encoding bodies9.1CNA v3.10.6%2025-04-24Fix
CVE-2025-43858YoutubeDLSharp allows command injection on windows system due to non sanitized arguments9.2CNA v3.10.3%2025-04-24Fix
CVE-2025-43855tRPC 11 WebSocket DoS8.7CNA v4.00.4%2025-04-24Fix
CVE-2025-41423Unauthorized Playbooks Post Deletion in Mattermost Playbooks plugin3.1CNA v3.10.3%2025-04-24Fix
CVE-2025-41395Mattermost webapp DoS via malicious retrospective post in Playbooks6.5CNA v3.10.5%2025-04-24Fix
CVE-2025-39408BruteGuard Brute Force Login Protection WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2025-04-24
CVE-2025-39404Sassy Social Share WordPress plugin open redirection4.7CNA v3.10.3%2025-04-24Fix
CVE-2025-39400User Registration WordPress plugin reflected cross-site scripting (XSS)6.1NVD v3.10.3%2025-04-24Fix
CVE-2025-39399License For Envato WordPress plugin local file inclusion7.5CNA v3.10.7%2025-04-24Fix
CVE-2025-39397Anything Popup WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2025-04-24
CVE-2025-39391Checkout Field Visibility for WooCommerce WordPress plugin local file inclusion7.5CNA v3.10.7%2025-04-24Fix
CVE-2025-39390Booking and Rental Manager WordPress plugin broken access control5.3CNA v3.10.3%2025-04-24Fix
CVE-2025-39387Opstore WordPress theme local file inclusion7.5CNA v3.10.7%2025-04-24
CVE-2025-39385Sirat WordPress theme broken access control4.3CNA v3.10.3%2025-04-24
CVE-2025-39384Product Lister for eBay WordPress plugin local file inclusion7.5CNA v3.10.7%2025-04-24
CVE-2025-39383Xews Lite WordPress theme local file inclusion7.5CNA v3.10.7%2025-04-24
CVE-2025-39382ACF: Google Font Selector WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.3%2025-04-24
CVE-2025-39381KiotViet Sync WordPress plugin CSRF to stored XSS7.1CNA v3.10.2%2025-04-24
CVE-2025-39379Capturly WordPress plugin local file inclusion7.5CNA v3.10.7%2025-04-24Fix
CVE-2025-39378Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce local file inclusion7.5CNA v3.10.7%2025-04-24
CVE-2025-39377Appsero Helper WordPress plugin SQL injection8.5CNA v3.10.3%2025-04-24Fix
CVE-2025-39360Grace Mag WordPress theme local file inclusion7.5CNA v3.10.7%2025-04-24
CVE-2025-39359CWW Portfolio WordPress theme local file inclusion7.5CNA v3.10.7%2025-04-24
CVE-2025-35965DoS in Mattermost Playbooks via Excessive Task Actions6.5CNA v3.10.4%2025-04-24Fix
CVE-2025-32921Arrival WordPress theme local file inclusion7.5CNA v3.10.7%2025-04-24
CVE-2025-32730i-PRO Configuration Tool hard-coded cryptographic key6.8CNA v4.00.2%2025-04-24
CVE-2025-31324SAP NetWeaver unrestricted file upload10.0CNA v3.199.5%2025-04-24KEVNucleiEmerging ThreatsExploit codeKCVFix
CVE-2025-30409Acronis Cyber Protect Cloud Agent resource exhaustion5.5CNA v3.00.2%2025-04-24Fix
CVE-2025-30408Acronis Cyber Protect Cloud Agent incorrect permission assignment6.7CNA v3.00.2%2025-04-24Fix
CVE-2025-29568code-projects Online Class and Exam Scheduling System cross-site scripting4.8CISA ADP v3.10.2%2025-04-24
CVE-2025-29529ITC Systems Multiplan/Matrix OneCard platform Forgotpassword.aspx SQL injection6.5CISA ADP v3.10.3%2025-04-24Exploit code
CVE-2025-27820Apache HttpComponents: PSL (Public Suffix List) validation bypass7.5CISA ADP v3.11.0%2025-04-24Fix
CVE-2025-27581NIH BRICS forced browsing4.3CNA v3.10.4%2025-04-24Exploit code
CVE-2025-27580NIH BRICS improper seeding7.5CNA v3.10.7%2025-04-24Exploit code
CVE-2025-26382Johnson Controls Software House iSTAR Configuration Utility (ICU) tool9.3CNA v4.00.6%2025-04-24Fix
CVE-2025-25777CodeAstro Bus Ticket Booking System insecure direct object reference8.0CISA ADP v3.10.3%2025-04-24
CVE-2025-3872Centreon privilege escalation by altering payload in contact form7.2CNA v3.10.4%2025-04-24Fix
CVE-2025-3832FuseDesk WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2025-04-24Fix
CVE-2025-3793Buddypress Force Password Change WordPress plugin account takeover4.2CNA v3.10.2%2025-04-24
CVE-2025-3776Verification SMS with TargetSMS WordPress plugin unauthenticated limited remote code execution8.3CNA v3.10.9%2025-04-24Exploit code
CVE-2025-3761My Tickets Accessible Event Ticketing WordPress plugin privilege escalation8.8CNA v3.10.4%2025-04-24Fix
CVE-2025-3749Breeze Display WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2025-04-24Fix
CVE-2025-3607Frontend Login and Registration Blocks WordPress plugin privilege escalation8.8CNA v3.10.4%2025-04-24Fix
CVE-2025-3604Flynax Bridge WordPress plugin unauthenticated privilege escalation via account takeover9.8CNA v3.10.7%2025-04-24Exploit codeFix
CVE-2025-3603Flynax Bridge WordPress plugin unauthenticated privilege escalation via password update9.8CNA v3.10.6%2025-04-24Fix
CVE-2025-3435MangBoard WP WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2025-04-24Fix
CVE-2025-3300WPMasterToolKit (WPMTK) All in one WordPress plugin to arbitrary file read and write7.2CNA v3.10.9%2025-04-24Fix
CVE-2025-3280ELEX WooCommerce Advanced Bulk Edit Products, Prices and Attributes WordPress plugin SQL injection6.5CNA v3.10.4%2025-04-24Fix
CVE-2025-3101Configurator Theme Core WordPress plugin authenticated (Subscriber+) privilege escalation8.8CNA v3.10.4%2025-04-24
CVE-2025-3065Database Toolset WordPress plugin unauthenticated arbitrary file deletion9.1CNA v3.11.1%2025-04-24
CVE-2025-3058Xelion Webchat WordPress plugin authenticated (Subscriber+) arbitrary options update8.8CNA v3.10.5%2025-04-24Fix
CVE-2025-2579Lottie Player WordPress plugin authenticated (Author+) stored cross-site scripting via file upload6.4CNA v3.10.3%2025-04-24Fix
CVE-2025-2558The Wound WordPress theme unauthenticated LFI8.6CISA ADP v3.12.4%2025-04-24Nuclei
CVE-2025-2543Advanced Accordion Gutenberg Block WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2025-04-24Fix
CVE-2025-1976Broadcom Brocade Fabric OS code injection8.6CNA v4.00.7%2025-04-24KEVFix
CVE-2025-1908Business Logic Errors in GitLab7.7CNA v3.10.4%2025-04-24Fix
CVE-2025-1453Category Posts Widget WordPress plugin Admin+ stored XSS4.8CISA ADP v3.10.3%2025-04-24Fix
CVE-2025-1294eForm WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.4%2025-04-24Fix
CVE-2025-1284Woocommerce Automatic Order Printing WordPress plugin insecure direct object reference4.3CNA v3.10.3%2025-04-24
CVE-2025-0639Allocation of resources without limits or throttling in GitLab6.5CNA v3.10.5%2025-04-24Fix
CVE-2025-46400Xfig: Fig2dev segmentation fault in read_arcobject5.5NVD v3.10.2%2025-04-23Fix
CVE-2025-46399Xfig: Transfig: Fig2dev segmentation fault vulnerability5.5NVD v3.10.2%2025-04-23Fix
CVE-2025-46398Xfig: Fig2dev stack-overflow via read_objects5.5NVD v3.10.3%2025-04-23Fix
CVE-2025-46397Red Hat Enterprise Linux 8 xfig: Xfig: Stack-overflow allows possible code execution7.8NVD v3.10.3%2025-04-23Fix
CVE-2025-46394BusyBox UI misrepresentation3.3v3.10.2%2025-04-23Fix
CVE-2025-46393ImageMagick incorrect buffer size calculation5.3v3.10.4%2025-04-23Fix
CVE-2025-45429Tenda AC9 stack-based buffer overflow9.8CISA ADP v3.11.1%2025-04-23Emerging Threats
CVE-2025-45428Tenda AC9 stack-based buffer overflow9.8CISA ADP v3.10.9%2025-04-23
CVE-2025-45427Tenda AC9 stack-based buffer overflow9.8CISA ADP v3.10.9%2025-04-23
CVE-2025-43965ImageMagick incorrect buffer size calculation7.5v3.10.6%2025-04-23Fix
CVE-2025-43716Ivanti LANDesk Management Suite path traversal5.8CNA v3.11.2%2025-04-23
CVE-2025-42605Improper access control vulnerability in Meon Bidding Solutions9.3CNA v4.00.5%2025-04-23Fix
CVE-2025-42604Detailed Error Response vulnerability in Meon KYC solutions6.9CNA v4.00.5%2025-04-23Fix
CVE-2025-42603Information disclosure vulnerability in Meon KYC solutions8.7CNA v4.00.3%2025-04-23Fix
CVE-2025-42602Improper authentication vulnerability in Meon KYC solutions8.2CNA v4.00.4%2025-04-23Fix
CVE-2025-42601Captcha Bypass vulnerability in Meon KYC solutions8.2CNA v4.00.4%2025-04-23Fix
CVE-2025-42600Brute force Attack vulnerability in Meon KYC solutions8.2CNA v4.00.5%2025-04-23Fix
CVE-2025-32969XWiki Platform REST API query endpoint SQL injection9.3CNA v4.079.4%2025-04-23NucleiFix
CVE-2025-32968xwiki-platform script query API SQL injection8.6CNA v4.00.6%2025-04-23Fix
CVE-2025-32966Dataease H2 JDBC Connection remote code execution8.2CNA v4.04.5%2025-04-23NucleiKCVFix
CVE-2025-32818SonicWall SonicOS null pointer dereference7.5CISA ADP v3.10.8%2025-04-23Fix
CVE-2025-29526Q4 Inc Investor Relations Platform search function cross-site scripting6.1CISA ADP v3.10.2%2025-04-23
CVE-2025-28169BYD QIN PLUS DM-i Dilink OS cloud broadcast communication improper certificate validation8.1CISA ADP v3.10.3%2025-04-23
CVE-2025-28028TOTOLINK A3000RU buffer overflow7.3CISA ADP v3.10.4%2025-04-23
CVE-2025-28025TOTOLINK A3000RU buffer overflow7.3CISA ADP v3.10.4%2025-04-23
CVE-2025-28022TOTOLINK A810R buffer overflow7.3CISA ADP v3.10.4%2025-04-23
CVE-2025-28021TOTOLINK A810R buffer overflow7.3CISA ADP v3.10.4%2025-04-23
CVE-2025-28020TOTOLINK A800R buffer overflow7.3CISA ADP v3.10.4%2025-04-23
CVE-2025-28019TOTOLINK A800R buffer overflow7.3CISA ADP v3.10.5%2025-04-23
CVE-2025-28018TOTOLINK A800R buffer overflow7.3CISA ADP v3.10.4%2025-04-23
CVE-2025-28017TOTOLINK A800R command injection6.5CISA ADP v3.11.2%2025-04-23
CVE-2025-25046IBM InfoSphere Information Server information disclosure3.7CNA v3.10.2%2025-04-23Fix
CVE-2025-25045IBM InfoSphere Information Server information disclosure4.3CNA v3.10.3%2025-04-23Fix
CVE-2025-21605Redis DoS vulnerability due to unlimited growth of output buffers abused by unauthenticated client7.5CNA v3.10.9%2025-04-23Fix
CVE-2025-3907Search API Solr Moderately critical cross-site request forgery SA-CONTRIB-2025-0464.3CISA ADP v3.10.2%2025-04-23Fix
CVE-2025-3904Sportsleague Critical Unsupported SA-CONTRIB-2025-0457.3CISA ADP v3.10.3%2025-04-23
CVE-2025-3903UEditor 百度编辑器 Critical Unsupported SA-CONTRIB-2025-0447.3CISA ADP v3.10.4%2025-04-23
CVE-2025-3902Block Class Moderately critical cross-site scripting SA-CONTRIB-2025-0436.1CISA ADP v3.10.2%2025-04-23Fix
CVE-2025-3901Bootstrap Site Alert Moderately critical cross-site scripting SA-CONTRIB-2025-0426.1CISA ADP v3.10.2%2025-04-23Fix
CVE-2025-3900Colorbox Moderately critical cross-site scripting SA-CONTRIB-2025-0416.1CISA ADP v3.10.3%2025-04-23Fix
CVE-2025-3530WordPress Simple PayPal Shopping Cart plugin unauthenticated Product Price manipulation7.5CNA v3.10.5%2025-04-23Fix
CVE-2025-3529WordPress Simple PayPal Shopping Cart plugin unauthenticated information exposure8.2CNA v3.10.4%2025-04-23Fix
CVE-2025-2773BEC Technologies Multiple Routers sys ping command injection remote code execution7.2CNA v3.02.1%2025-04-23
CVE-2025-2772BEC Technologies Multiple Routers insufficiently protected credentials information disclosure6.5v3.10.4%2025-04-23
CVE-2025-2771BEC Technologies Multiple Routers authentication bypass5.3CNA v3.00.9%2025-04-23
CVE-2025-2770BEC Technologies Multiple Routers Cleartext Password Storage information disclosure6.5v3.10.5%2025-04-23
CVE-2025-2769Bdrive NetDrive uncontrolled search path element local privilege escalation7.8CNA v3.00.2%2025-04-23
CVE-2025-2768Bdrive NetDrive uncontrolled search path element local privilege escalation7.8CNA v3.00.2%2025-04-23
CVE-2025-2767Arista NG Firewall User-Agent cross-site scripting remote code execution9.6v3.10.6%2025-04-23
CVE-2025-2765CarlinKit CPC200-CCPA Wireless Hotspot hard-coded credentials authentication bypass8.8v3.10.4%2025-04-23
CVE-2025-2764CarlinKit CPC200-CCPA update.cgi improper verification of cryptographic signature code execution8.0CNA v3.00.3%2025-04-23
CVE-2025-2763CarlinKit CPC200-CCPA improper verification of cryptographic signature code execution6.8CNA v3.00.2%2025-04-23
CVE-2025-2762CarlinKit CPC200-CCPA Missing Root of Trust local privilege escalation7.8CNA v3.00.2%2025-04-23
CVE-2025-2761GIMP FLI File Parsing out-of-bounds write remote code execution7.8v3.11.9%2025-04-23Fix
CVE-2025-2760GIMP XWD File Parsing integer overflow remote code execution7.8v3.118.8%2025-04-23Fix
CVE-2025-2703Grafana cross-site scripting6.8CNA v3.116.0%2025-04-23Fix
CVE-2025-2595Forced browsing vulnerability in CODESYS Visualization5.3CNA v3.10.5%2025-04-23Fix
CVE-2025-1522PostHog database_schema server-side request forgery information disclosure6.5NVD v3.10.6%2025-04-23
CVE-2025-1521PostHog slack_incoming_webhook server-side request forgery information disclosure6.5NVD v3.10.7%2025-04-23
CVE-2025-1520PostHog ClickHouse Table Functions SQL injection remote code execution8.0v3.10.5%2025-04-23
CVE-2025-1056Axis Communications AXIS Camera Station Pro external control of a file path6.1CNA v3.10.2%2025-04-23Fix
CVE-2025-1054UiCore Elements Free Elementor widgets and templates WordPress plugin stored cross-site scripting6.4CNA v3.10.2%2025-04-23Fix
CVE-2025-1050Sonos Era 300 out-of-bounds write remote code execution8.8CNA v3.00.4%2025-04-23
CVE-2025-1049Sonos Era 300 heap-based buffer overflow remote code execution8.8CNA v3.00.4%2025-04-23
CVE-2025-1048Sonos Era 300 Speaker libsmb2 use-after-free remote code execution8.8CNA v3.00.5%2025-04-23
CVE-2025-1047Luxion KeyShot PVS File Parsing access of uninitialized pointer remote code execution7.8CNA v3.00.3%2025-04-23Fix
CVE-2025-1046Luxion KeyShot SKP File Parsing use-after-free remote code execution7.8CNA v3.00.3%2025-04-23Fix
CVE-2025-1045Luxion KeyShot Viewer KSP File Parsing heap-based buffer overflow remote code execution7.8CNA v3.00.4%2025-04-23Fix
CVE-2025-1021Synology DiskStation Manager (DSM) synocopy missing authorization7.5CNA v3.10.5%2025-04-23Fix
CVE-2025-0926Axis Communications AXIS Camera Station Pro incorrect permission assignment5.9CNA v3.10.2%2025-04-23Fix
CVE-2025-0618Trellix FireEye EDR HX code injection6.5CNA v3.10.7%2025-04-23
CVE-2025-46254Visual Composer Website Builder WordPress plugin cross-site scripting (XSS)5.4v3.10.2%2025-04-22Fix
CVE-2025-46253GutenKit WordPress plugin cross-site scripting (XSS)5.4v3.10.2%2025-04-22Fix
CVE-2025-46252Message Filter for Contact Form 7 WordPress plugin SQL injection7.2v3.10.4%2025-04-22Fix
CVE-2025-46251VikRestaurants Table Reservations and Take-Away WordPress plugin CSRF to stored XSS8.8v3.10.1%2025-04-22Fix
CVE-2025-46250Vikas Ratudi VPSUForm stored cross-site scripting4.8v3.10.2%2025-04-22Fix
CVE-2025-46249Simple calendar for Elementor WordPress plugin cross-site request forgery (CSRF)8.8v3.10.2%2025-04-22Fix
CVE-2025-46247Appointment Booking Calendar WordPress plugin broken access control9.8v3.10.4%2025-04-22Fix
CVE-2025-46246CM Answers WordPress plugin cross-site request forgery (CSRF)8.8v3.10.2%2025-04-22Fix
CVE-2025-46245CM Ad Changer WordPress plugin cross-site request forgery (CSRF)8.8v3.10.2%2025-04-22Fix
CVE-2025-46244Advanced Linked Variations for Woocommerce WordPress plugin broken access control9.8v3.10.3%2025-04-22Fix
CVE-2025-46243Recover abandoned cart for WooCommerce WordPress plugin cross-site request forgery (CSRF)8.8v3.10.2%2025-04-22Fix
CVE-2025-46242Watu Quiz WordPress plugin SQL injection4.9NVD v3.10.4%2025-04-22Fix
CVE-2025-46241Appointment Booking Calendar WordPress plugin CSRF to SQL injection8.8v3.10.2%2025-04-22Fix
CVE-2025-46240Simple Download Counter WordPress plugin cross-site scripting (XSS)5.4v3.10.2%2025-04-22Fix
CVE-2025-46239Theme Switcha WordPress plugin cross-site scripting (XSS)5.4v3.10.2%2025-04-22Fix
CVE-2025-46238List Last Changes WordPress plugin cross-site scripting (XSS)5.4v3.10.2%2025-04-22Fix
CVE-2025-46237Link Library WordPress plugin cross-site scripting (XSS)5.4v3.10.2%2025-04-22Fix
CVE-2025-46236HTML Forms WordPress plugin cross-site scripting (XSS)5.4v3.10.2%2025-04-22Fix
CVE-2025-46235SKT Blocks Gutenberg based Page Builder WordPress plugin cross-site scripting (XSS)5.4v3.10.2%2025-04-22Fix
CVE-2025-46233Sirv WordPress plugin cross-site scripting (XSS)5.4v3.10.2%2025-04-22Fix
CVE-2025-46232Download Alt Text AI WordPress plugin broken access control8.8v3.10.3%2025-04-22Fix
CVE-2025-46231affiliate-toolkit WordPress plugin cross-site request forgery (CSRF)8.8v3.10.2%2025-04-22Fix
CVE-2025-46229Textmetrics WordPress plugin cross-site scripting (XSS)4.8v3.10.2%2025-04-22Fix
CVE-2025-46228Event post WordPress plugin cross-site scripting (XSS)5.4v3.10.2%2025-04-22Fix
CVE-2025-46227Custom Related Posts WordPress plugin cross-site scripting (XSS)5.4v3.10.2%2025-04-22Fix
CVE-2025-46226MPL-Publisher WordPress plugin cross-site scripting (XSS)5.4v3.10.3%2025-04-22Fix
CVE-2025-46225Post in page for Elementor WordPress plugin cross-site scripting (XSS)5.4v3.10.3%2025-04-22Fix
CVE-2025-43952Mettler Toledo FreeWeight.Net Web Reports Viewer reflected cross-site scripting6.1CISA ADP v3.10.2%2025-04-22
CVE-2025-43951LabVantage objectname parameter local file inclusion9.8CISA ADP v3.10.5%2025-04-22
CVE-2025-43950DPMAdirektPro DLL hijacking7.8CISA ADP v3.10.2%2025-04-22
CVE-2025-43949MuM MapEdit SQL injection9.8CISA ADP v3.10.4%2025-04-22
CVE-2025-43948Codemers KLIMS sorting parameter code injection7.3CISA ADP v3.10.3%2025-04-22
CVE-2025-43947Codemers Klims improper access control7.3CISA ADP v3.10.3%2025-04-22
CVE-2025-43946Tcpwave Ddi unrestricted file upload9.8CISA ADP v3.11.0%2025-04-22
CVE-2025-37088HPE Cray Data Virtualization Service (DVS) race condition6.8CISA ADP v3.10.2%2025-04-22Fix
CVE-2025-37087HPE Performance Cluster Manager (HPCM) missing authorization9.8CISA ADP v3.10.4%2025-04-22
CVE-2025-34028Commvault Command Center path traversal10.0NVD v3.197.6%2025-04-22KEVNucleiEmerging ThreatsExploit codeFix
CVE-2025-32965XRPLF xrpl.js embedded malicious code9.3CNA v4.00.9%2025-04-22Exploit codeFix
CVE-2025-32964Miraheze ManageWiki extension management improper authorization4.6CNA v3.10.2%2025-04-22Fix
CVE-2025-32963Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS6.9CNA v4.00.6%2025-04-22Fix
CVE-2025-32961cuba-platform jpawebapi XSS in the /download endpoint of the JPA Web API6.4CNA v3.10.3%2025-04-22Fix
CVE-2025-32960cuba-platform restapi XSS in the /files endpoint of the Generic REST API6.4CNA v3.10.3%2025-04-22Fix
CVE-2025-32959CUBA vulnerable to denial of service (DoS) in the File Storage6.5CNA v3.10.5%2025-04-22Fix
CVE-2025-32952jmix-framework jmix io.jmix.localfs:jmix-localfs affected by DoS in the Local File Storage6.5CNA v3.10.7%2025-04-22Fix
CVE-2025-32951Io.jmix.rest:jmix-rest allows XSS in the /files endpoint of the Generic REST API6.4CNA v3.10.4%2025-04-22Fix
CVE-2025-32950jmix-framework jmix io.jmix.localfs:jmix-localfs has a path traversal in Local File Storage6.5CNA v3.10.7%2025-04-22Fix
CVE-2025-32788OctoPrint Authenticated Reverse Proxy page authentication bypass4.3CNA v3.10.2%2025-04-22Fix
CVE-2025-31328Cross-site request forgery (CSRF) vulnerability in SAP S/4 HANA (Learning Solution)4.6CNA v3.10.1%2025-04-22Fix
CVE-2025-31327OData meta-data property entity tampering in SAP Field Logistics4.3CNA v3.10.3%2025-04-22Fix
CVE-2025-29743D-Link DIR-816 command injection6.5CISA ADP v3.11.0%2025-04-22
CVE-2025-29621Francois Jacquet RosarioSIS Theme configuration content spoofing7.3CISA ADP v3.10.3%2025-04-22
CVE-2025-29547Horizondatasys Rollback Rx Pro null pointer dereference7.0CISA ADP v3.10.4%2025-04-22
CVE-2025-29339Open5GS reachable assertion7.5CISA ADP v3.10.8%2025-04-22
CVE-2025-28039TOTOLINK EX1200T OS command injection9.8CISA ADP v3.11.2%2025-04-22
CVE-2025-28038TOTOLINK EX1200T OS command injection9.8CISA ADP v3.11.2%2025-04-22
CVE-2025-28037TOTOLINK A950RG OS command injection9.8CISA ADP v3.11.2%2025-04-22
CVE-2025-28036TOTOLINK A950RG OS command injection9.8CISA ADP v3.11.3%2025-04-22
CVE-2025-28035TOTOLINK A830R OS command injection9.8CISA ADP v3.11.3%2025-04-22
CVE-2025-28034TOTOLINK A3000RU OS command injection9.8CISA ADP v3.11.3%2025-04-22
CVE-2025-28033TOTOLINK A3000RU stack-based buffer overflow7.3CISA ADP v3.10.4%2025-04-22
CVE-2025-28032TOTOLINK A3000RU stack-based buffer overflow7.3CISA ADP v3.10.3%2025-04-22
CVE-2025-28031TOTOLINK A810R Firmware hard-coded password6.5CISA ADP v3.10.3%2025-04-22
CVE-2025-28030TOTOLINK A810R stack-based buffer overflow8.8CISA ADP v3.10.5%2025-04-22
CVE-2025-28029TOTOLINK A3000RU stack-based buffer overflow7.3CISA ADP v3.10.4%2025-04-22
CVE-2025-28027TOTOLINK A3000RU stack-based buffer overflow7.3CISA ADP v3.10.4%2025-04-22
CVE-2025-28026TOTOLINK A3000RU stack-based buffer overflow7.3CISA ADP v3.10.4%2025-04-22
CVE-2025-28024TOTOLINK A810R buffer overflow9.8CISA ADP v3.10.6%2025-04-22
CVE-2025-27907IBM WebSphere Application Server server-side request forgery4.1CNA v3.10.3%2025-04-22Fix
CVE-2025-27087HPE Cray Operating System (COS) denial of service5.5CISA ADP v3.10.2%2025-04-22Fix
CVE-2025-26413Apache Kvrocks: The server was crashed by the negative offset7.5CISA ADP v3.10.8%2025-04-22Fix
CVE-2025-26159Laravel Starter cross-site scripting (XSS)6.1CISA ADP v3.10.3%2025-04-22Exploit codeFix
CVE-2025-23253NVIDIA App hard-coded security constants2.5CNA v3.10.2%2025-04-22Fix
CVE-2025-23251NVIDIA NeMo Framework code injection7.6CNA v3.10.7%2025-04-22Fix
CVE-2025-23250NVIDIA NeMo Framework path traversal7.6CNA v3.10.6%2025-04-22Fix
CVE-2025-23249NVIDIA NeMo Framework deserialization of untrusted data7.6CNA v3.10.7%2025-04-22Fix
CVE-2025-23176Tecnick improper neutralization of special elements used in an SQL command (SQL injection)8.8CNA v3.10.5%2025-04-22
CVE-2025-23175Tecnick Multiple XSS6.1CNA v3.10.2%2025-04-22
CVE-2025-3856xxyopen Novel-Plus searchByPage SQL injection9.8v3.10.6%2025-04-22
CVE-2025-3855CodeCanyon RISE Ultimate Project Manager Profile Picture save_profile_image resource injection5.3CNA v4.00.5%2025-04-22Exploit code
CVE-2025-3854H3C GR-3000AX HTTP POST request aspForm Edit_List_SSID buffer overflow8.6CNA v4.00.5%2025-04-22Fix
CVE-2025-3850YXJ2018 SpringBoot-Vue-OnlineExam API improper authentication2.7NVD v3.10.6%2025-04-22
CVE-2025-3849YXJ2018 SpringBoot-Vue-OnlineExam studentPWD unverified password change6.5v3.10.4%2025-04-22
CVE-2025-3814Tax Switch for WooCommerce WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2025-04-22Fix
CVE-2025-3767SQL injection in Centreon BAM boolean KPI listing7.2CNA v3.10.4%2025-04-22Fix
CVE-2025-3616Greenshift - Authenticated (Subscriber+) arbitrary file upload8.8CNA v3.12.5%2025-04-22Fix
CVE-2025-3577Zyxel AMG1302-T10B firmware path traversal4.9CNA v3.112.6%2025-04-22Emerging Threats
CVE-2025-3519Unblu Spark replace uploaded files knowing the file upload ID7.0CNA v4.00.3%2025-04-22
CVE-2025-3518Unblu Spark file upload functionality possible even when disabled4.3v3.10.2%2025-04-22
CVE-2025-3472Ocean Extra WordPress plugin unauthenticated arbitrary shortcode execution9.8v3.11.9%2025-04-22NucleiFix
CVE-2025-3458Ocean Extra WordPress plugin stored cross-site scripting5.4v3.10.3%2025-04-22Fix
CVE-2025-3457Ocean Extra WordPress plugin authenticated (Contributor+) stored cross-site scripting via shortcode5.4v3.10.3%2025-04-22Fix
CVE-2025-2987IBM Maximo Asset Management server-side request forgery3.8CNA v3.10.2%2025-04-22Fix
CVE-2025-2839WP Import Export Lite WordPress plugin DOM-based stored cross-site scripting5.4v3.10.3%2025-04-22Fix
CVE-2025-2594User Registration and Membership WordPress plugin authentication bypass8.1CISA ADP v3.19.5%2025-04-22Exploit codeFix
CVE-2025-2300Hitachi Ops Center Common Services sensitive information in log files5.5CNA v3.10.2%2025-04-22Fix
CVE-2025-2092Checkmk remote site authentication secrets written to web log7.1CNA v4.00.3%2025-04-22Fix
CVE-2025-1951IBM Hardware Management Console Power Systems command execution8.4CNA v3.10.2%2025-04-22Fix
CVE-2025-1950IBM Hardware Management Console Power Systems command execution9.3CNA v3.10.2%2025-04-22Fix
CVE-2025-1732Zyxel USG FLEX H series uOS firmware recovery function of the Zyxel improper privilege management6.7CNA v3.10.2%2025-04-22Fix
CVE-2025-1731Zyxel USG FLEX H series uOS firmware incorrect permission assignment7.8CNA v3.10.9%2025-04-22Exploit codeFix
CVE-2025-43973GoBGP does not verify that the input length9.8v3.10.5%2025-04-21Fix
CVE-2025-43972GoBGP crashes in the flowspec parser7.5v3.10.5%2025-04-21Fix
CVE-2025-43971GoBGP panics due to a zero value for softwareVersionLen7.5v3.10.5%2025-04-21Fix
CVE-2025-43970GoBGP does not properly check the input length5.3v3.10.4%2025-04-21Fix
CVE-2025-43967struktur libheif null pointer dereference7.5v3.10.4%2025-04-21Fix
CVE-2025-43966struktur libheif null pointer dereference7.5v3.10.3%2025-04-21Fix
CVE-2025-43964LibRaw improper quantity validation9.8v3.10.4%2025-04-21Fix
CVE-2025-43963LibRaw out-of-bounds read9.1v3.10.4%2025-04-21Fix
CVE-2025-43962LibRaw out-of-bounds read9.1v3.10.4%2025-04-21Fix
CVE-2025-43961LibRaw out-of-bounds read9.1v3.10.4%2025-04-21Fix
CVE-2025-43922FileWave incorrect authorization8.1CNA v3.10.1%2025-04-21Fix
CVE-2025-43916Sonos api.sonos.com hard-coded credentials3.4CNA v3.10.2%2025-04-21Fix
CVE-2025-32958Adept exposed the GITHUB_TOKEN in workflow run artifact9.8CNA v3.10.6%2025-04-21Exploit code
CVE-2025-32956ManageWiki has SQL injection vulnerability in NamespaceMigrationJob8.0CNA v3.10.7%2025-04-21Fix
CVE-2025-32955Harden-Runner Evasion of disable-sudo policy6.0CNA v3.10.2%2025-04-21Fix
CVE-2025-32793Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters4.0CNA v3.10.1%2025-04-21Fix
CVE-2025-32431Traefik path matcher middleware bypass path traversal8.8CNA v4.00.9%2025-04-21Fix
CVE-2025-32408Soffid IAM incorrect authorization2.5CNA v3.10.1%2025-04-21Fix
CVE-2025-29660Yiiot Xy-3820 path traversal9.8CISA ADP v3.11.2%2025-04-21Emerging ThreatsKCV
CVE-2025-29659Yiiot Xy-3820 improper authorization9.8CISA ADP v3.11.5%2025-04-21Emerging ThreatsKCV
CVE-2025-29287MCMS allows arbitrary file uploads in the ueditor component9.8CISA ADP v3.10.8%2025-04-21Fix
CVE-2025-28367Mojoportal path traversal6.5CISA ADP v3.11.9%2025-04-21Nuclei
CVE-2025-28121code-projects Online Exam Mastering System cross-site scripting6.1CISA ADP v3.10.9%2025-04-21Exploit code
CVE-2025-28104DogukanUrker FlaskBlog improper access control9.1CISA ADP v3.10.4%2025-04-21
CVE-2025-28103DogukanUrker FlaskBlog missing authorization6.4CISA ADP v3.10.2%2025-04-21
CVE-2025-28102DogukanUrker FlaskBlog cross-site scripting6.1CISA ADP v3.10.2%2025-04-21
CVE-2025-28099fumiao opencms path traversal4.3CISA ADP v3.10.4%2025-04-21
CVE-2025-27086HPE Performance Cluster Manager (HPCM) improper authentication8.1CISA ADP v3.10.4%2025-04-21Fix
CVE-2025-25228Extension VirtueMart.net SQL injection in VirtueMart component for Joomla3.8CISA ADP v3.10.2%2025-04-21
CVE-2025-23174Yoel Geva exposure of sensitive information to an unauthorized actor7.5CNA v3.10.4%2025-04-21
CVE-2025-3857Infinite loop condition in Amazon.IonDotnet8.7CNA v4.00.6%2025-04-21Fix
CVE-2025-3847markparticle WebServer Login httprequest.cpp SQL injection9.8v3.10.5%2025-04-21
CVE-2025-3846markparticle WebServer Registration httprequest.cpp SQL injection9.8v3.10.5%2025-04-21
CVE-2025-3845markparticle WebServer buffer.cpp HasWritten buffer overflow9.8v3.10.7%2025-04-21
CVE-2025-3843panhainan DS-Java cross-site request forgery6.5v3.10.3%2025-04-21
CVE-2025-3842panhainan DS-Java FileUpload.java uploadUserPic.action code injection9.8v3.10.7%2025-04-21
CVE-2025-3841wix-incubator jam Jinja2 template jam.py special elements used in a template engine9.8v3.10.4%2025-04-21
CVE-2025-3840Saviynt OVA based Connect improper neutralization of input during web page generation2.1CNA v4.00.3%2025-04-21
CVE-2025-3838Improper authorization in the installer for the EOL OVA based connect component6.1CNA v4.00.1%2025-04-21
CVE-2025-3837Improper input validation vulnerability in the End of Life (EOL) OVA based connect component6.1CNA v4.00.3%2025-04-21
CVE-2025-2517Reference to Expired Domain vulnerability in OpenText™ ArcSight Enterprise Security Manager2.3CNA v4.00.4%2025-04-21Fix
CVE-2025-2298Authenticated API endpoint allows arbitrary file deletion in Dremio Software8.4CNA v4.00.3%2025-04-21Fix
CVE-2025-0632Formulatrix Rock Maker Web local file inclusion (LFI) leading to sensitive data exposure9.2CNA v4.00.9%2025-04-21
CVE-2025-43955Convertigo exposed dangerous method6.8v3.10.3%2025-04-20Fix
CVE-2025-43954QMarkdown cross-site scripting (XSS)6.1v3.10.2%2025-04-20Fix
CVE-2025-43929kitty origin validation error7.8v3.10.2%2025-04-20Exploit codeFix
CVE-2025-43928Infodraw Media Relay Service path traversal9.8v3.10.9%2025-04-20
CVE-2025-43921GNU Mailman incorrect authorization5.3v3.10.4%2025-04-20Exploit code
CVE-2025-43920GNU Mailman OS command injection8.1v3.10.6%2025-04-20Exploit code
CVE-2025-43919GNU Mailman path traversal7.5v3.11.3%2025-04-20Exploit code
CVE-2025-3830kuangstudy KuangSimpleBBS QuestionController.java fileUpload unrestricted upload9.8v3.10.5%2025-04-20
CVE-2025-3829PHPGurukul Men Salon Management System sales-reports-detail.php SQL injection9.8v3.10.6%2025-04-20
CVE-2025-3828PHPGurukul Men Salon Management System view-appointment.php SQL injection9.8v3.10.6%2025-04-20
CVE-2025-3827PHPGurukul Men Salon Management System forgot-password.php SQL injection9.8v3.10.6%2025-04-20
CVE-2025-3826SourceCodester Web-based Pharmacy Product Management System add-supplier.php cross-site scripting4.1v3.10.4%2025-04-20
CVE-2025-3825SourceCodester Web-based Pharmacy Product Management System add-category.php cross-site scripting4.1v3.10.4%2025-04-20
CVE-2025-3824SourceCodester Web-based Pharmacy Product Management System add-product.php cross-site scripting4.1v3.10.4%2025-04-20
CVE-2025-3823SourceCodester Web-based Pharmacy Product Management System add-stock.php cross-site scripting4.1v3.10.4%2025-04-20
CVE-2025-3822SourceCodester Web-based Pharmacy Product Management System changepassword.php cross-site scripting5.4v3.10.5%2025-04-20
CVE-2025-3821SourceCodester Web-based Pharmacy Product Management System add-admin.php cross-site scripting5.4v3.10.4%2025-04-20
CVE-2025-43918SSL.com use of a less trusted source6.4CNA v3.10.1%2025-04-19Fix
CVE-2025-43917Pritunl-Client incorrect authorization8.2CNA v3.10.2%2025-04-19Fix
CVE-2025-3820Tenda W12/i24 httpd cgiSysUplinkCheckSet stack-based overflow8.7CNA v4.012.7%2025-04-19Emerging Threats
CVE-2025-3819PHPGurukul Men Salon Management System search-appointment.php SQL injection9.8v3.10.6%2025-04-19
CVE-2025-3818webpy web.py db.py PostgresDB._process_insert_query SQL injection5.3CNA v4.00.3%2025-04-19Fix
CVE-2025-3817SourceCodester Online Eyewear Shop Master.php SQL injection8.8v3.10.5%2025-04-19
CVE-2025-3816westboy CicadasCMS Scheduled Task save os command injection7.2v3.16.2%2025-04-19
CVE-2025-3809Debug Log Manager WordPress plugin unauthenticated stored cross-site scripting7.2CNA v3.10.3%2025-04-19Fix
CVE-2025-3808zhenfeng13 My-BBS cross-site request forgery6.5v3.10.3%2025-04-19
CVE-2025-3807zhenfeng13 My-BBS Endpoint UploadController.java upload unrestricted upload9.8v3.10.5%2025-04-19
CVE-2025-3806dazhouda lecms Edit Profile admin cross-site scripting4.8CNA v4.00.3%2025-04-19
CVE-2025-3805sarrionandia tournatrack Jinja2 template check_id.py injection4.8CNA v4.00.2%2025-04-19
CVE-2025-3804thautwarm vscode-diana Jinja2 Template Gen.py injection4.8CNA v4.00.2%2025-04-19
CVE-2025-3803Tenda W12/i24 httpd cgiSysScheduleRebootSet stack-based overflow8.7CNA v4.01.0%2025-04-19Emerging Threats
CVE-2025-3802Tenda W12/i24 httpd cgiPingSet stack-based overflow8.7CNA v4.01.1%2025-04-19
CVE-2025-3801songquanpeng one-api System setting cross-site scripting4.8CNA v4.00.3%2025-04-19
CVE-2025-3800Wcms AnonymousController.php SQL injection9.8v3.10.6%2025-04-19
CVE-2025-3799Wcms AnonymousController.php SQL injection9.8v3.10.5%2025-04-19
CVE-2025-3798Wcms Advertisement Image AdvadminController.php sub unrestricted upload7.2v3.10.5%2025-04-19
CVE-2025-3797SeaCMS admin_topic.php SQL injection7.2v3.10.5%2025-04-19
CVE-2025-3661SB Chart block WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2025-04-19Fix
CVE-2025-3404Download Manager WordPress plugin authenticated (Author+) arbitrary file deletion8.8CNA v3.11.1%2025-04-19Fix
CVE-2025-3284User Registration and Membership WordPress plugin cross-site request forgery4.3CNA v3.10.2%2025-04-19Fix
CVE-2025-3278UrbanGo Membership WordPress plugin unauthenticated privilege escalation9.8CNA v3.10.6%2025-04-19Fix
CVE-2025-3275Themesflat Addons For Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.3%2025-04-19Fix
CVE-2025-3103CLEVER WordPress plugin arbitrary file read7.5CNA v3.10.4%2025-04-19Fix
CVE-2025-2111WP Headers And Footers WordPress plugin cross-site request forgery to arbitrary options update7.5CNA v3.10.2%2025-04-19Fix
CVE-2025-2010JobWP WordPress plugin SQL injection7.5CNA v3.11.8%2025-04-19NucleiFix
CVE-2025-1457Element Pack Elementor Addons WordPress plugin DOM-based stored cross-site scripting6.4CNA v3.10.3%2025-04-19Fix
CVE-2025-1093LiquidThemes AI Hub generate_image function arbitrary file upload9.8CNA v3.11.0%2025-04-19Fix
CVE-2025-43903Freedesktop Poppler improper signature verification3.3NVD v3.10.1%2025-04-18Fix
CVE-2025-42599Qualitia Active! Mail stack-based buffer overflow9.8v3.13.3%2025-04-18KEVFix
CVE-2025-40364Linux kernel io_uring provided buffers vulnerability7.8CNA v3.10.3%2025-04-18Fix
CVE-2025-40325Linux kernel RAID10 discard handling vulnerability5.5NVD v3.10.2%2025-04-18Fix
CVE-2025-40114Linux kernel veml6075 light sensor driver out-of-bounds read7.8v3.10.2%2025-04-18Fix
CVE-2025-40014Linux kernel AMD SPI driver vulnerability7.8v3.10.2%2025-04-18Fix
CVE-2025-39989Linux kernel x86/mce memory leak5.5v3.10.2%2025-04-18Fix
CVE-2025-39930Linux kernel ASoC simple-card-utils driver vulnerability8.4CNA v3.10.3%2025-04-18Fix
CVE-2025-39778Linux kernel out-of-bounds read7.1v3.10.2%2025-04-18Fix
CVE-2025-39755Linux kernel cb7210 PCMCIA GPIB driver null pointer dereference5.5v3.10.2%2025-04-18Fix
CVE-2025-39735Linux kernel JFS extended attribute handling out-of-bounds read7.1CNA v3.10.3%2025-04-18Fix
CVE-2025-39728Linux kernel Samsung clock driver vulnerability5.5v3.10.3%2025-04-18Fix
CVE-2025-39688Linux kernel NFS server stateid lookup vulnerability7.5CNA v3.10.6%2025-04-18Fix
CVE-2025-39471Modal Survey WordPress plugin SQL injection9.3CNA v3.10.4%2025-04-18
CVE-2025-39470Ivy School WordPress theme local file inclusion8.1CNA v3.10.7%2025-04-18Fix
CVE-2025-39469Modal Survey WordPress plugin cross-site scripting (XSS)7.1CNA v3.10.2%2025-04-18
CVE-2025-38637Linux kernel SKBPRIO queuing discipline reachable assertion5.5v3.10.3%2025-04-18Fix
CVE-2025-38575In the Linux kernel, the following vulnerability has been resolved: ksmbd: use aead_request_free to match aead_request_alloc Use aead_request_free() instead of kfree() to properly free memory allocated by aead_request_alloc(). This ensures sensitive crypto data is zeroed before being freed.5.5v3.10.3%2025-04-18Fix
CVE-2025-38479In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: free irq correctly in remove path Add fsl_edma->txirq/errirq check to avoid below warning because no errirq at i.MX9 platform. Otherwise there will be kernel dump: WARNING: CPU: 0 PID: 11 at kernel/irq/devres.7.8v3.10.3%2025-04-18Fix
CVE-2025-38240Linux kernel dp null pointer dereference5.5v3.10.3%2025-04-18Fix
CVE-2025-38152Linux kernel remoteproc resource table handling null pointer dereference5.5v3.10.3%2025-04-18Fix
CVE-2025-38104Linux kernel drm/amdgpu race condition4.7v3.10.2%2025-04-18Fix
CVE-2025-38049Linux kernel x86 resctrl CLOSID allocation null pointer dereference5.5v3.10.3%2025-04-18Fix
CVE-2025-37925Linux kernel JFS filesystem inode handling vulnerability5.5v3.10.3%2025-04-18Fix
CVE-2025-37893Linux kernel LoongArch BPF JIT compiler off-by-one error7.8CNA v3.10.3%2025-04-18Fix
CVE-2025-37860Linux kernel sfc null pointer dereference5.5NVD v3.10.3%2025-04-18Fix
CVE-2025-37838Linux kernel ssi_protocol driver use-after-free7.8CNA v3.10.2%2025-04-18Fix
CVE-2025-37785Linux kernel ext4 directory entry validation out-of-bounds read7.8CNA v3.10.3%2025-04-18Fix
CVE-2025-36625Tenable Nessus log injection4.3CNA v3.10.3%2025-04-18Fix
CVE-2025-32953z80pack vulnerable to Exposure of the GITHUB_TOKEN in Workflow Run Artifact8.7CNA v3.10.5%2025-04-18
CVE-2025-32796Dify allows Unauthorized APP Enable/Disable via API6.5CNA v3.10.4%2025-04-18Fix
CVE-2025-32795Dify allows Insecure User Role Access Control for APP Editing6.5CNA v3.10.3%2025-04-18Fix
CVE-2025-32792endojs endo ses's global contour bindings leak into Compartment lexical scope8.7CNA v4.00.6%2025-04-18Fix
CVE-2025-32790Dify allows Insecure User Role Access Control for APP DSL Exporting6.3CNA v3.10.3%2025-04-18Fix
CVE-2025-32442Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass7.5CNA v3.10.7%2025-04-18Fix
CVE-2025-32434PyTorch: `torch.load` with `weights_only=True` leads to remote code execution9.3CNA v4.02.4%2025-04-18Exploit codeFix
CVE-2025-32389NamelessMC vulnerable to SQL Injections in /user/messaging and /panel/users/reports pages8.6CNA v4.00.5%2025-04-18Fix
CVE-2025-32377RasaHQ rasa-pro-security-advisories Rasa Pro missing authentication for Voice Connector APIs6.5CNA v3.10.5%2025-04-18Fix
CVE-2025-31120NamelessMC vulnerable to Cookie-Based View Count Manipulation5.3CNA v3.10.5%2025-04-18Fix
CVE-2025-31118NamelessMC has Forum Reply Submission Time Limit Bypass7.1CNA v3.10.5%2025-04-18Fix
CVE-2025-30357NamelessMC Forum Topic Deletion Triggered by Unrelated User Deletion7.3CNA v3.10.5%2025-04-18Fix
CVE-2025-30158NamelessMC Forum iframe width/height abuse causing UI-based denial of service7.1CNA v3.10.5%2025-04-18Fix
CVE-2025-29953Apache ActiveMQ NMS OpenWire Client: Deserialization allowlist bypass9.8CISA ADP v3.12.1%2025-04-18Fix
CVE-2025-29784NamelessMC has lack of Length Validation for s parameter in GET requests7.5CNA v3.10.6%2025-04-18Fix
CVE-2025-29625Astrolog buffer overflow7.8CISA ADP v3.10.3%2025-04-18
CVE-2025-29513NodeBB cross-site scripting6.1CISA ADP v3.142.8%2025-04-18
CVE-2025-29512NodeBB cross-site scripting6.1CISA ADP v3.10.3%2025-04-18
CVE-2025-29209TOTOLINK X18 command injection9.8CISA ADP v3.11.2%2025-04-18
CVE-2025-29058Qimou Cms code injection9.8CISA ADP v3.10.8%2025-04-18
CVE-2025-28355personal-management-system cross-site request forgery4.7CISA ADP v3.10.2%2025-04-18Exploit code
CVE-2025-28242DAEnetIP4 METO /login_ok.htm endpoint session fixation9.8CISA ADP v3.11.8%2025-04-18Nuclei
CVE-2025-28238Elber REBLE310 session fixation9.8CISA ADP v3.10.4%2025-04-18
CVE-2025-28237WorldCast Systems ECRESO FM/DAB/TV Transmitter improper privilege management8.8CISA ADP v3.10.4%2025-04-18
CVE-2025-28236Nautel VX Series transmitters firmware update process remote code execution9.8CISA ADP v3.10.4%2025-04-18
CVE-2025-28235Soundcraft Ui Series /socket.io/1/websocket/ endpoint information disclosure7.5CISA ADP v3.10.4%2025-04-18
CVE-2025-28233Incorrect access control in BW Broadcast TX600 (14980), TX300 (32990) (31448), TX150, TX1000, TX30, and TX50 Hardware Version: 2, Software Version: 1.6.0, Control Version: 1.0, AIO Firmware Version: 1.7 allows attackers to access log files and extract session identifiers to execute a session hijacki9.1CISA ADP v3.10.4%2025-04-18
CVE-2025-28232Jmbroadcast JMB0150 Firmware improper access control9.1CISA ADP v3.10.6%2025-04-18
CVE-2025-28231Itel Electronics IP Stream improper access control9.1CISA ADP v3.10.4%2025-04-18
CVE-2025-28230Jmbroadcast JMB0150 Firmware hard-coded credentials9.1CISA ADP v3.10.5%2025-04-18
CVE-2025-28229Orban Optimod 5950 Firmware authentication bypass9.8CISA ADP v3.10.8%2025-04-18
CVE-2025-28228Electrolink Fm/dab/tv Transmitter Web Management System information disclosure7.5CISA ADP v3.11.8%2025-04-18Nuclei
CVE-2025-28197Kidocode crawl4ai server-side request forgery9.1CISA ADP v3.10.4%2025-04-18
CVE-2025-28059Nagios Network Analyzer insufficient session expiration7.5CISA ADP v3.10.8%2025-04-18Fix
CVE-2025-27599Element X Android intent handling improper input validation6.5CNA v3.10.4%2025-04-18Fix
CVE-2025-25985Macro-video V380E6 C1 plaintext password storage2.6CISA ADP v3.10.3%2025-04-18
CVE-2025-25984Macro-video V380E6 C1 hard-coded password6.8CISA ADP v3.10.4%2025-04-18
CVE-2025-25983Macro-video V380 Pro recoverable password storage3.4CISA ADP v3.10.3%2025-04-18
CVE-2025-25427XSS in TP-Link TL-WR841N v14/v14.6/v14.8 Upnp page8.6CNA v4.00.6%2025-04-18Fix
CVE-2025-24914Tenable Nessus Local Priviledge Escalation7.8CNA v3.10.2%2025-04-18Fix
CVE-2025-3796PHPGurukul Men Salon Management System contact-us.php SQL injection8.8v3.10.5%2025-04-18
CVE-2025-3795DaiCuo SEO Optimization Settings Section cross-site scripting3.4NVD v3.10.4%2025-04-18
CVE-2025-3792SeaCMS admin_link.php SQL injection7.2v3.10.7%2025-04-18
CVE-2025-3791symisc UnQLite UnQLite.c jx9MemObjStore heap-based overflow4.8CNA v4.00.2%2025-04-18
CVE-2025-3790baseweb JSite Apache Druid Monitoring console index.html access control6.9CNA v4.00.8%2025-04-18
CVE-2025-3789baseweb JSite save cross-site scripting5.4v3.10.4%2025-04-18
CVE-2025-3788baseweb JSite save cross-site scripting5.4v3.10.4%2025-04-18
CVE-2025-3787PbootCMS Image server-side request forgery6.5v3.10.5%2025-04-18
CVE-2025-3786Tenda AC15 WifiExtraSet fromSetWirelessRepeat buffer overflow8.8v3.11.1%2025-04-18
CVE-2025-3785D-Link DWR-M961 Authorization interface formStaticDHCP stack-based overflow8.7CNA v4.012.8%2025-04-18Emerging Threats
CVE-2025-3783SourceCodester Web-based Pharmacy Product Management System add-product.php unrestricted upload9.8v3.11.0%2025-04-18
CVE-2025-3598Coupon Affiliates Affiliate Plugin for WooCommerce WordPress plugin reflected cross-site scripting6.1CNA v3.10.4%2025-04-18Fix
CVE-2025-3520Avatar WordPress plugin authenticated (Subscriber+) arbitrary file deletion8.1CNA v3.11.0%2025-04-18
CVE-2025-3106LA-Studio Element Kit for Elementor WordPress plugin stored cross-site scripting6.4CNA v3.10.4%2025-04-18Fix
CVE-2025-3056Download Manager WordPress plugin stored cross-site scripting5.4CNA v3.10.4%2025-04-18Fix
CVE-2025-2950IBM i improper HTTP header neutralization5.4CNA v3.10.3%2025-04-18Fix
CVE-2025-2613Login Manager WordPress plugin stored cross-site scripting4.4CNA v3.10.2%2025-04-18
CVE-2025-2492ASUS Router AiCloud improper authentication9.2CNA v4.01.1%2025-04-18Reported exploitedExploit codeKCVFix
CVE-2025-2162MapPress Maps for WordPress plugin Admin+ stored XSS4.8CISA ADP v3.10.4%2025-04-18Fix
CVE-2025-1863Yokogawa Electric GX10 / GX20 / GP10 / GP20 Paperless Recorders insecure default configuration9.8CNA v3.10.7%2025-04-18
CVE-2025-1697HP Touchpoint Analytics Service potential escalation of privilege6.9CNA v4.00.2%2025-04-18Fix
CVE-2025-0467GPU Ddk rgxfw_hwperf_get_packet_buffer OOB write8.2CISA ADP v3.10.2%2025-04-18Fix
CVE-2025-43717PEAR HTTP_Request2 vulnerable to cross-site scripting5.4CNA v3.10.3%2025-04-17Fix
CVE-2025-43715Nullsoft Scriptable Install System improper check for exceptional conditions8.1CNA v3.10.2%2025-04-17Fix
CVE-2025-43708VisiCut uncontrolled recursion7.5v3.10.4%2025-04-17
CVE-2025-43015JetBrains RubyMine insecure default initialization8.3CNA v3.10.3%2025-04-17Fix
CVE-2025-43014JetBrains Toolbox App missing authentication step6.1CNA v3.10.2%2025-04-17Fix
CVE-2025-43013JetBrains Toolbox App cleartext transmission of sensitive information6.9CNA v3.10.2%2025-04-17Fix
CVE-2025-43012JetBrains Toolbox App command injection8.3CNA v3.10.6%2025-04-17Fix
CVE-2025-42921JetBrains Toolbox App improper certificate host validation4.2CNA v3.10.2%2025-04-17Fix
CVE-2025-39596Quentn WP WordPress plugin privilege escalation9.8CNA v3.10.6%2025-04-17Exploit codeFix
CVE-2025-39595Quentn WP WordPress plugin SQL injection9.3CNA v3.10.4%2025-04-17Fix
CVE-2025-39594Arigato Autoresponder and Newsletter WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2025-04-17Fix
CVE-2025-39588Ultimate Store Kit Elementor Addons WordPress plugin deserialization of untrusted data9.8CNA v3.10.5%2025-04-17Fix
CVE-2025-39587Cost Calculator Builder WordPress plugin SQL injection9.3CNA v3.10.4%2025-04-17Fix
CVE-2025-39586ProfileGrid WordPress plugin SQL injection8.5CNA v3.10.3%2025-04-17Fix
CVE-2025-39583BERTHA AI WordPress plugin arbitrary content deletion vulnerability7.1CNA v3.10.3%2025-04-17Fix
CVE-2025-39580Dashi WordPress plugin broken access control5.8CNA v3.10.3%2025-04-17Fix
CVE-2025-39569Taskbuilder WordPress plugin SQL injection8.5CNA v3.10.3%2025-04-17Fix
CVE-2025-39568StoreContrl Woocommerce WordPress plugin arbitrary file download7.5CNA v3.10.5%2025-04-17Fix
CVE-2025-39567Web Directory Free WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2025-04-17Fix
CVE-2025-39562Payment Form for PayPal Pro WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.2%2025-04-17Fix
CVE-2025-39559Bring Fraktguiden for WooCommerce WordPress plugin broken access control6.5CNA v3.10.3%2025-04-17Fix
CVE-2025-39558CRM Perks WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.2%2025-04-17Fix
CVE-2025-39554AI Text to Speech WordPress plugin broken access control6.5CNA v3.10.3%2025-04-17Fix
CVE-2025-39551FluentBoards WordPress plugin PHP object injection9.8CNA v3.10.5%2025-04-17Fix
CVE-2025-39550FluentCommunity WordPress plugin PHP object injection9.8CNA v3.10.5%2025-04-17Fix
CVE-2025-39542Xelion Webchat WordPress plugin privilege escalation8.8CNA v3.10.4%2025-04-17Fix
CVE-2025-39535Vitepos WordPress plugin broken authentication7.2CNA v3.10.5%2025-04-17Fix
CVE-2025-39533Starfish Review Generation and Marketing WordPress plugin privilege escalation8.8CNA v3.10.4%2025-04-17Fix
CVE-2025-39532Spice Blocks WordPress plugin broken access control7.5CNA v3.10.4%2025-04-17
CVE-2025-39527Rating by BestWebSoft WordPress plugin PHP object injection8.8CNA v3.10.5%2025-04-17
CVE-2025-39526Hotel Booking WordPress plugin local file inclusion8.1CNA v3.10.7%2025-04-17Fix
CVE-2025-39521Contact Form vCard Generator WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2025-04-17
CVE-2025-39519Bulk Page Stub Creator WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2025-04-17Fix
CVE-2025-39464AdminQuickbar WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2025-04-17Fix
CVE-2025-39462Smart Agreements WordPress plugin local file inclusion7.5CNA v3.10.7%2025-04-17Fix
CVE-2025-39461Docket Cache WordPress plugin local file inclusion7.5CNA v3.10.7%2025-04-17Fix
CVE-2025-39457Booking and Rental Manager WordPress plugin broken access control5.3CNA v3.10.3%2025-04-17Fix
CVE-2025-39456WP Logger WordPress plugin broken access control5.4CNA v3.10.3%2025-04-17Fix
CVE-2025-39455IP2Location Variables WordPress plugin CSRF to cross-site scripting (XSS)7.1CNA v3.10.2%2025-04-17Fix
CVE-2025-39453Advanced Dynamic Pricing for WooCommerce WordPress plugin algol.plus cross-site request forgery4.3CNA v3.10.2%2025-04-17Fix
CVE-2025-39452WPCafe WordPress plugin local file inclusion7.5CNA v3.10.8%2025-04-17Fix
CVE-2025-39444MaxButtons WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.3%2025-04-17Fix
CVE-2025-39443Verge3D WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.2%2025-04-17Fix
CVE-2025-39442Review Wave Google Places Reviews WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.2%2025-04-17
CVE-2025-39441Dashboard Notepads WordPress plugin CSRF to stored XSS7.1CNA v3.10.2%2025-04-17
CVE-2025-39440Broken Links Remover WordPress plugin CSRF to stored XSS7.1CNA v3.10.2%2025-04-17
CVE-2025-39439wpLike2Get WordPress plugin sensitive data exposure5.3CNA v3.10.4%2025-04-17
CVE-2025-39438Theme Changer WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.2%2025-04-17Fix
CVE-2025-39437Anthologize WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.2%2025-04-17
CVE-2025-39436WordPress I Draw plugin arbitrary file upload9.1CNA v3.10.7%2025-04-17Exploit code
CVE-2025-39435My Marginalia WordPress plugin CSRF to stored XSS7.1CNA v3.10.2%2025-04-17
CVE-2025-39434Avatar WordPress plugin insecure direct object references (IDOR)4.3CNA v3.10.3%2025-04-17
CVE-2025-39433Bknewsticker WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.2%2025-04-17
CVE-2025-39432bbPress2 shortcode whitelist WordPress plugin CSRF to XSS7.1CNA v3.10.3%2025-04-17
CVE-2025-39431Amazon Showcase WordPress plugin CSRF to XSS7.1CNA v3.10.2%2025-04-17
CVE-2025-39430mLanguage WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.2%2025-04-17
CVE-2025-39429WordPress Széchenyi 2020 Logo plugin local file inclusion7.5CNA v3.10.7%2025-04-17Fix
CVE-2025-39428Gravity Forms CSS Themes with Fontawesome and Placeholders WordPress plugin cross-site scripting5.9CNA v3.10.3%2025-04-17
CVE-2025-39427WP Post to PDF Enhanced WordPress plugin cross-site scripting (XSS)5.9CNA v3.10.3%2025-04-17
CVE-2025-39426illow Cookies Consent WordPress plugin cross-site request forgery (CSRF)4.3CNA v3.10.2%2025-04-17
CVE-2025-39425Style Manager WordPress plugin cross-site request forgery (CSRF) to settings Change4.3CNA v3.10.2%2025-04-17Fix
CVE-2025-39424Simple Maps WordPress plugin CSRF to XSS7.1CNA v3.10.2%2025-04-17Fix
CVE-2025-39423Jenst Add to Header cross-site request forgery7.1CNA v3.10.2%2025-04-17
CVE-2025-39422WP Social Bookmarking WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.2%2025-04-17
CVE-2025-39421WP Sticky Side Buttons WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.2%2025-04-17
CVE-2025-39420WP Twitter Button WordPress plugin cross-site request forgery (CSRF)7.1CNA v3.10.3%2025-04-17
CVE-2025-39419Revision Diet WordPress plugin CSRF to stored XSS7.1CNA v3.10.2%2025-04-17
CVE-2025-39418RSS Manager WordPress plugin CSRF to stored XSS7.1CNA v3.10.2%2025-04-17
CVE-2025-39417Redirect wordpress to welcome or landing page plugin CSRF to stored XSS7.1CNA v3.10.2%2025-04-17
CVE-2025-39416translit it! WordPress plugin CSRF to stored XSS7.1CNA v3.10.2%2025-04-17
CVE-2025-39415Social Media Links WordPress plugin CSRF to stored XSS7.1CNA v3.10.2%2025-04-17
CVE-2025-39414spam-stopper WordPress plugin CSRF to stored XSS7.1CNA v3.10.2%2025-04-17
CVE-2025-32686Team Members WordPress plugin PHP object injection8.8CNA v3.10.6%2025-04-17Fix
CVE-2025-32682MapSVG Lite WordPress plugin arbitrary file upload9.9CNA v3.10.6%2025-04-17Exploit codeFix
CVE-2025-32674Product Excel Import Export and Bulk Edit for WooCommerce WordPress plugin cross-site scripting7.1CNA v3.10.3%2025-04-17
CVE-2025-32670Spark GF Failed Submissions WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2025-04-17Fix
CVE-2025-32666Hive Support WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2025-04-17Fix
CVE-2025-32665Office Locator WordPress plugin SQL injection9.3CNA v3.10.4%2025-04-17
CVE-2025-32662uListing WordPress plugin deserialization of untrusted data8.8CNA v3.10.5%2025-04-17
CVE-2025-32660JS Job Manager WordPress plugin arbitrary file upload9.8v3.10.4%2025-04-17
CVE-2025-32658HelpGent WordPress plugin PHP object injection9.8CNA v3.10.5%2025-04-17
CVE-2025-32655DevriX Restrict User Registration cross-site request forgery7.1CNA v3.10.2%2025-04-17
CVE-2025-32653Cart66 Cloud WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2025-04-17
CVE-2025-32652Solace Extra WordPress plugin arbitrary file upload9.9CNA v3.10.4%2025-04-17Fix
CVE-2025-32651SERPed.net WordPress plugin reflected cross-site scripting (XSS)7.1CNA v3.10.3%2025-04-17Fix