CVE-2025 records published in April 2025
This page lists the 3,694 CVE-2025 records published in April 2025, newest first, 1,000 to a page. The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog lists 15 of them. Each CVE opens on cve-security.com with its sources, detection content and vendor fixes, and the search on the CVE-2025 list filters these records by severity or signal.
- Critical
- 49513.4% of these records
- Listed in CISA KEV
- 150.4% of these records
- Reported exploited
- 40.1% of these records
- Detection signal
- 762.1% of these records
- Exploit code
- 942.5% of these records
- Actionable vendor fix
- 2,24860.9% of these records
Figures as of 2026-10-24 13:18 UTC. Records published in April 2025 have had from about 18 months to about 19 months to collect KEV listings, exploitation reports, detection content and exploit code. Records published more recently have had less time, which can hold their shares down.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2025-46619 | Couchbase Server unauthorized access | 7.6CISA ADP v3.1 | 0.5% | 2025-04-30 | Fix |
| CVE-2025-46560 | vLLM phi4mm: Quadratic Time Complexity in Input Token Processing leads to denial of service | 6.5CNA v3.1 | 0.5% | 2025-04-30 | Fix |
| CVE-2025-46558 | XWiki Syntax Markdown Markdown to HTML rendering cross-site scripting | 9.1CNA v3.1 | 0.5% | 2025-04-30 | Fix |
| CVE-2025-46557 | Any user with view access to the XWiki space can change the authenticator | 8.4CNA v4.0 | 0.6% | 2025-04-30 | Fix |
| CVE-2025-46554 | XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API | 5.3CNA v3.1 | 1.0% | 2025-04-30 | NucleiFix |
| CVE-2025-46342 | Kyverno vulnerable to bypass of policy rules that use namespace selectors in match statements | 8.6CNA v3.1 | 0.8% | 2025-04-30 | Fix |
| CVE-2025-46331 | OpenFGA authorization bypass | 5.8CNA v4.0 | 0.4% | 2025-04-30 | Fix |
| CVE-2025-45021 | PHPGurukul Directory Management System SQL injection | 5.3CISA ADP v3.1 | 0.2% | 2025-04-30 | |
| CVE-2025-45020 | PHPGurukul Park Ticketing Management System SQL injection | 7.2CISA ADP v3.1 | 0.6% | 2025-04-30 | |
| CVE-2025-45019 | PHPGurukul Park Ticketing Management System SQL injection | 5.4NVD v3.1 | 0.5% | 2025-04-30 | |
| CVE-2025-45018 | PHPGurukul Park Ticketing Management System SQL injection | 9.8CISA ADP v3.1 | 0.6% | 2025-04-30 | |
| CVE-2025-45017 | PHPGurukul Park Ticketing Management System SQL injection | 9.8CISA ADP v3.1 | 0.8% | 2025-04-30 | |
| CVE-2025-45015 | PHPGurukul Park Ticketing Management System cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-04-30 | |
| CVE-2025-45011 | PHPGurukul Park Ticketing Management System command injection | 5.3CISA ADP v3.1 | 0.3% | 2025-04-30 | |
| CVE-2025-45010 | PHPGurukul Park Ticketing Management System command injection | 5.3CISA ADP v3.1 | 0.3% | 2025-04-30 | |
| CVE-2025-45009 | PHPGurukul Park Ticketing Management System command injection | 5.3CISA ADP v3.1 | 0.3% | 2025-04-30 | |
| CVE-2025-45007 | PHPGurukul Time Table Generator System cross-site scripting | 4.8CISA ADP v3.1 | 0.3% | 2025-04-30 | |
| CVE-2025-44194 | oretnom23 Simple Barangay Management System SQL injection | 7.3CISA ADP v3.1 | 0.4% | 2025-04-30 | |
| CVE-2025-44193 | oretnom23 Simple Barangay Management System SQL injection | 7.6CISA ADP v3.1 | 0.3% | 2025-04-30 | |
| CVE-2025-44192 | oretnom23 Simple Barangay Management System SQL injection | 9.8CISA ADP v3.1 | 0.5% | 2025-04-30 | |
| CVE-2025-39413 | Simple Sitemap Create a Responsive HTML Sitemap WordPress plugin broken access control | 8.8v3.1 | 0.4% | 2025-04-30 | Fix |
| CVE-2025-33074 | Microsoft Azure Functions remote code execution | 7.5CNA v3.1 | 0.6% | 2025-04-30 | Fix |
| CVE-2025-32974 | xwiki-platform required rights analysis improper privilege management | 9.1CNA v3.1 | 0.4% | 2025-04-30 | Fix |
| CVE-2025-32973 | xwiki-platform programming rights check missing authorization | 9.1CNA v3.1 | 0.4% | 2025-04-30 | Fix |
| CVE-2025-32972 | xwiki-platform the lesscss script service allows cache clearing without programming right | 2.7CNA v3.1 | 0.5% | 2025-04-30 | Fix |
| CVE-2025-32971 | XWiki Solr script service doesn't take dropped programming right into account | 3.8CNA v3.1 | 0.4% | 2025-04-30 | Fix |
| CVE-2025-32970 | xwiki-platform org.Xwiki.platform:xwiki-platform-wysiwyg-api open redirect | 6.1CNA v3.1 | 0.6% | 2025-04-30 | NucleiFix |
| CVE-2025-32777 | Volcano Scheduler denial of service via Unbounded Response from Elastic Service/extender plugin | 8.2CNA v4.0 | 0.5% | 2025-04-30 | Fix |
| CVE-2025-32444 | vLLM vulnerable to remote code execution via Mooncake Integration | 10.0CNA v3.1 | 1.8% | 2025-04-30 | Fix |
| CVE-2025-32376 | Discourse DM limits aren’t always properly enforced | 4.8CNA v4.0 | 0.3% | 2025-04-30 | Fix |
| CVE-2025-30422 | Apple AirPlay audio SDK buffer overflow | 6.5v3.1 | 0.7% | 2025-04-30 | Fix |
| CVE-2025-30392 | Microsoft Azure AI Bot elevation of privilege | 9.8CNA v3.1 | 1.1% | 2025-04-30 | Fix |
| CVE-2025-30391 | Microsoft Dynamics information disclosure | 8.1CNA v3.1 | 1.4% | 2025-04-30 | Fix |
| CVE-2025-30390 | Microsoft Azure ML Compute elevation of privilege | 9.9CNA v3.1 | 1.0% | 2025-04-30 | Fix |
| CVE-2025-30389 | Microsoft Azure Bot Framework SDK elevation of privilege | 8.7CNA v3.1 | 0.9% | 2025-04-30 | Fix |
| CVE-2025-30202 | Data exposure via ZeroMQ on multi-node vLLM deployment | 7.5CNA v3.1 | 0.6% | 2025-04-30 | Fix |
| CVE-2025-27611 | base-x homograph attack allows Unicode lookalike characters to bypass validation | 8.7CNA v4.0 | 0.4% | 2025-04-30 | Fix |
| CVE-2025-27532 | Bosch Rexroth ctrlX OS cleartext storage of sensitive information | 6.5CNA v3.1 | 3.5% | 2025-04-30 | Fix |
| CVE-2025-27409 | Joplin Server vulnerable to path traversal | 7.5CNA v3.1 | 0.6% | 2025-04-30 | Fix |
| CVE-2025-27134 | Privilege escalation in Joplin server via user patch endpoint | 8.8CNA v3.1 | 2.2% | 2025-04-30 | NucleiFix |
| CVE-2025-24887 | OpenCTI bypass of protected attribute update | 6.3CNA v3.1 | 0.3% | 2025-04-30 | Fix |
| CVE-2025-24351 | Bosch Rexroth ctrlX OS OS command injection | 8.8CNA v3.1 | 0.9% | 2025-04-30 | Fix |
| CVE-2025-24350 | Bosch Rexroth ctrlX OS relative path traversal | 7.1CNA v3.1 | 0.4% | 2025-04-30 | Fix |
| CVE-2025-24349 | Bosch Rexroth ctrlX OS permissive allowlist | 7.1CNA v3.1 | 0.6% | 2025-04-30 | Fix |
| CVE-2025-24348 | Bosch Rexroth ctrlX OS improper syntax validation | 5.4CNA v3.1 | 0.5% | 2025-04-30 | Fix |
| CVE-2025-24347 | Bosch Rexroth ctrlX OS improper syntax validation | 6.5CNA v3.1 | 0.5% | 2025-04-30 | Fix |
| CVE-2025-24346 | Bosch Rexroth ctrlX OS improper syntax validation | 7.5CNA v3.1 | 0.5% | 2025-04-30 | Fix |
| CVE-2025-24345 | Bosch Rexroth ctrlX OS improper syntax validation | 6.3CNA v3.1 | 0.4% | 2025-04-30 | Fix |
| CVE-2025-24344 | Bosch Rexroth ctrlX OS cross-site scripting | 6.3CNA v3.1 | 0.4% | 2025-04-30 | Fix |
| CVE-2025-24343 | Bosch Rexroth ctrlX OS relative path traversal | 5.4CNA v3.1 | 0.6% | 2025-04-30 | Fix |
| CVE-2025-24342 | Bosch Rexroth ctrlX OS response discrepancy | 5.3CNA v3.1 | 0.4% | 2025-04-30 | Fix |
| CVE-2025-24341 | Bosch Rexroth ctrlX OS resource exhaustion | 6.5CNA v3.1 | 0.5% | 2025-04-30 | Fix |
| CVE-2025-24340 | Bosch Rexroth ctrlX OS weak password hash | 6.5CNA v3.1 | 0.3% | 2025-04-30 | Fix |
| CVE-2025-24339 | Bosch Rexroth ctrlX OS HTTP header injection | 5.0CNA v3.1 | 0.3% | 2025-04-30 | Fix |
| CVE-2025-24338 | Bosch Rexroth ctrlX OS improper output encoding | 7.1CNA v3.1 | 0.4% | 2025-04-30 | Fix |
| CVE-2025-24132 | Apple AirPlay audio SDK memory corruption | 6.5NVD v3.1 | 3.2% | 2025-04-30 | Exploit codeFix |
| CVE-2025-24091 | Apple iPadOS authentication bypass by spoofing | 5.5CISA ADP v3.1 | 0.3% | 2025-04-30 | Exploit codeFix |
| CVE-2025-22884 | ISPSoft File Parsing stack-based buffer overflow remote code execution | 7.8CNA v3.1 | 0.4% | 2025-04-30 | Fix |
| CVE-2025-22883 | ISPSoft File Parsing out-of-bounds write remote code execution | 7.8CNA v3.1 | 0.4% | 2025-04-30 | Fix |
| CVE-2025-22882 | ISPSoft File Parsing stack-based buffer overflow remote code execution | 7.8CNA v3.1 | 0.4% | 2025-04-30 | Fix |
| CVE-2025-21416 | Microsoft Azure Virtual Desktop elevation of privilege | 8.5CNA v3.1 | 0.8% | 2025-04-30 | Fix |
| CVE-2025-4142 | Netgear EX6200 sub_3C8EC buffer overflow | 9.8v3.1 | 1.2% | 2025-04-30 | |
| CVE-2025-4141 | Netgear EX6200 sub_3C03C buffer overflow | 9.8v3.1 | 1.2% | 2025-04-30 | |
| CVE-2025-4140 | Netgear EX6120 sub_30394 buffer overflow | 9.8v3.1 | 1.2% | 2025-04-30 | |
| CVE-2025-4139 | Netgear EX6120 fwAcosCgiInbound buffer overflow | 8.7CNA v4.0 | 1.1% | 2025-04-30 | |
| CVE-2025-4136 | Weitong Mall Sale endpoint improper authorization | 5.3CNA v4.0 | 0.4% | 2025-04-30 | |
| CVE-2025-4135 | Netgear WG302v2 ui_get_input_value command injection | 5.3CNA v4.0 | 2.0% | 2025-04-30 | |
| CVE-2025-4125 | ISPSoft File Parsing out-of-bounds write remote code execution | 7.8CNA v3.1 | 0.4% | 2025-04-30 | Fix |
| CVE-2025-4124 | ISPSoft File Parsing out-of-bounds write remote code execution | 7.8CNA v3.1 | 0.4% | 2025-04-30 | Fix |
| CVE-2025-4122 | Netgear JWNR2000v2 sub_435E04 command injection | 8.8v3.1 | 2.7% | 2025-04-30 | |
| CVE-2025-4121 | Netgear JWNR2000v2 cmd_wireless command injection | 9.8v3.1 | 2.9% | 2025-04-30 | |
| CVE-2025-4120 | Netgear JWNR2000v2 sub_4238E8 buffer overflow | 9.8v3.1 | 1.0% | 2025-04-30 | |
| CVE-2025-4119 | Weitong Mall Product Statistics queryTotal access control | 7.5v3.1 | 0.7% | 2025-04-30 | |
| CVE-2025-4118 | Weitong Mall Product History historyList access control | 9.1v3.1 | 0.7% | 2025-04-30 | |
| CVE-2025-4117 | Netgear JWNR2000v2 sub_41A914 buffer overflow | 9.8v3.1 | 0.6% | 2025-04-30 | |
| CVE-2025-4116 | Netgear JWNR2000v2 get_cur_lang_ver buffer overflow | 9.8v3.1 | 1.0% | 2025-04-30 | |
| CVE-2025-4115 | Netgear JWNR2000v2 default_version_is_new buffer overflow | 9.8v3.1 | 1.0% | 2025-04-30 | |
| CVE-2025-4114 | Netgear JWNR2000v2 check_language_file buffer overflow | 9.8v3.1 | 1.1% | 2025-04-30 | |
| CVE-2025-4113 | PHPGurukul Curfew e-Pass Management System edit-pass-detail.php SQL injection | 8.8v3.1 | 0.5% | 2025-04-30 | |
| CVE-2025-4112 | PHPGurukul Student Record System add-course.php SQL injection | 9.8v3.1 | 0.6% | 2025-04-30 | |
| CVE-2025-4111 | PHPGurukul Pre-School Enrollment System visitor-details.php SQL injection | 8.8v3.1 | 0.5% | 2025-04-30 | |
| CVE-2025-4110 | PHPGurukul Pre-School Enrollment System edit-teacher.php SQL injection | 8.8v3.1 | 0.5% | 2025-04-30 | |
| CVE-2025-4109 | PHPGurukul Pre-School Enrollment System edit-subadmin.php SQL injection | 8.8v3.1 | 0.5% | 2025-04-30 | |
| CVE-2025-4108 | PHPGurukul Student Record System add-subject.php SQL injection | 9.8v3.1 | 0.6% | 2025-04-30 | |
| CVE-2025-3953 | WP Statistics WordPress plugin unauthorized access | 5.4CNA v3.1 | 0.3% | 2025-04-30 | Fix |
| CVE-2025-3859 | Mozilla Firefox Focus elide URL allows address bar spoofing | 6.1v3.1 | 0.2% | 2025-04-30 | Fix |
| CVE-2025-3599 | Symantec Endpoint Protection elevation of privilege | 6.5CNA v3.1 | 0.3% | 2025-04-30 | Fix |
| CVE-2025-3471 | SureForms WordPress plugin Contributor+ settings update | 4.9CISA ADP v3.1 | 0.4% | 2025-04-30 | Fix |
| CVE-2025-3395 | ABB Automation Builder cleartext storage of sensitive information | 8.4CNA v4.0 | 0.1% | 2025-04-30 | Fix |
| CVE-2025-3394 | ABB Automation Builder incorrect permission assignment | 8.5CNA v4.0 | 0.2% | 2025-04-30 | Fix |
| CVE-2025-2890 | tagDiv Opt-In Builder WordPress plugin SQL injection | 6.5CNA v3.1 | 0.4% | 2025-04-30 | Fix |
| CVE-2025-2170 | SonicWall SMA1000 server-side request forgery | 7.2CISA ADP v3.1 | 0.3% | 2025-04-30 | Fix |
| CVE-2025-2082 | Tesla Model 3 VCSEC integer overflow remote code execution | 7.5CNA v3.0 | 0.4% | 2025-04-30 | Exploit code |
| CVE-2025-46552 | KHC-INVITATION-AUTOMATION sensitive user information leakage in Invitation Automation | 6.3CNA v4.0 | 0.4% | 2025-04-29 | Fix |
| CVE-2025-46550 | YesWiki vulnerable to unauthenticated reflected cross-site scripting | 4.3CNA v3.1 | 0.5% | 2025-04-29 | NucleiFix |
| CVE-2025-46549 | YesWiki vulnerable to unauthenticated reflected cross-site scripting | 4.3CNA v3.1 | 0.5% | 2025-04-29 | NucleiFix |
| CVE-2025-46350 | YesWiki vulnerable to authenticated reflected cross-site scripting | 3.5CNA v3.1 | 0.3% | 2025-04-29 | Fix |
| CVE-2025-46349 | YesWiki vulnerable to unauthenticated reflected cross-site scripting | 7.6CNA v3.1 | 0.6% | 2025-04-29 | NucleiFix |
| CVE-2025-46348 | YesWiki vulnerable to Unauthenticated Site Backup Creation and Download | 10.0CNA v3.1 | 0.7% | 2025-04-29 | Fix |
| CVE-2025-46347 | YesWiki remote code execution via arbitrary PHP File Write and Execution | 5.8CNA v4.0 | 1.0% | 2025-04-29 | Fix |
| CVE-2025-46346 | YesWiki vulnerable to stored XSS in Comments | 6.3CNA v4.0 | 0.4% | 2025-04-29 | Fix |
| CVE-2025-46344 | Auth0 NextJS SDK v4 Missing Session Invalidation | 4.9CNA v4.0 | 0.4% | 2025-04-29 | Fix |
| CVE-2025-46343 | n8n vulnerable to stored XSS through Attachments view endpoint | 5.0CNA v3.1 | 0.3% | 2025-04-29 | Fix |
| CVE-2025-46338 | Audiobookshelf vulnerable to cross-site-scripting Reflected via POST request in /API/upload | 6.9CNA v4.0 | 0.4% | 2025-04-29 | Fix |
| CVE-2025-46330 | Snowflake Connector For C/c++ retries malformed requests | 3.3CNA v3.1 | 0.2% | 2025-04-29 | Fix |
| CVE-2025-46329 | Snowflake Connector For C/c++ inserts client-side encryption key in DEBUG logs | 3.3CNA v3.1 | 0.1% | 2025-04-29 | Fix |
| CVE-2025-45956 | oretnom23 Computer Laboratory Management System manage_damage.php in Sourcecodester SQL injection | 8.8CISA ADP v3.1 | 0.5% | 2025-04-29 | |
| CVE-2025-40619 | Improper access control vulnerability in Bookgy | 7.5NVD v3.1 | 0.4% | 2025-04-29 | Fix |
| CVE-2025-40618 | SQL injection vulnerability in Bookgy | 9.8v3.1 | 0.4% | 2025-04-29 | Fix |
| CVE-2025-40617 | SQL injection vulnerability in Bookgy | 9.8v3.1 | 0.4% | 2025-04-29 | Fix |
| CVE-2025-40616 | Reflected cross-site scripting (XSS) vulnerability in Bookgy | 6.1v3.1 | 0.2% | 2025-04-29 | Fix |
| CVE-2025-40615 | Reflected cross-site scripting (XSS) vulnerability in Bookgy | 6.1v3.1 | 0.2% | 2025-04-29 | Fix |
| CVE-2025-32354 | Synacor Zimbra Collaboration Suite cross-site request forgery | 8.8CISA ADP v3.1 | 0.3% | 2025-04-29 | Fix |
| CVE-2025-31203 | Apple iPadOS integer overflow | 6.5CISA ADP v3.1 | 0.4% | 2025-04-29 | Fix |
| CVE-2025-31202 | Apple macOS null pointer dereference | 5.5CISA ADP v3.1 | 0.2% | 2025-04-29 | Fix |
| CVE-2025-31197 | Apple iPadOS use-after-free | 5.7CISA ADP v3.1 | 0.3% | 2025-04-29 | Fix |
| CVE-2025-30445 | Apple iPadOS type confusion | 6.5CISA ADP v3.1 | 0.4% | 2025-04-29 | Fix |
| CVE-2025-30194 | PowerDNS DNSdist denial of service via crafted DoH exchange | 7.5CNA v3.1 | 2.3% | 2025-04-29 | Fix |
| CVE-2025-29906 | Finit bundled getty can bypass /bin/login | 8.6CNA v3.1 | 0.2% | 2025-04-29 | Fix |
| CVE-2025-25962 | Coresmartcontracts Uniswap _modifyPosition function privilege escalation | 9.8CISA ADP v3.1 | 0.5% | 2025-04-29 | |
| CVE-2025-25403 | Slims (Senayan Library Management Systems) 9 Bulian V9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/coll_type.php. | 9.8CISA ADP v3.1 | 0.4% | 2025-04-29 | |
| CVE-2025-24271 | Apple iPadOS missing authentication | 5.4CISA ADP v3.1 | 0.5% | 2025-04-29 | Exploit codeFix |
| CVE-2025-24270 | Apple iPadOS information disclosure | 5.7CISA ADP v3.1 | 0.3% | 2025-04-29 | Fix |
| CVE-2025-24252 | Apple iPadOS use-after-free | 8.8CISA ADP v3.1 | 1.3% | 2025-04-29 | Exploit codeKCVFix |
| CVE-2025-24251 | Apple iPadOS null pointer dereference | 6.5CISA ADP v3.1 | 0.4% | 2025-04-29 | Fix |
| CVE-2025-24206 | Apple iPadOS authentication bypass | 7.7CISA ADP v3.1 | 0.4% | 2025-04-29 | KCVFix |
| CVE-2025-24179 | Apple iPadOS null pointer dereference | 5.7CISA ADP v3.1 | 0.3% | 2025-04-29 | Fix |
| CVE-2025-23181 | Ribbon Communications execution with unnecessary privileges | 8.0CNA v3.1 | 0.3% | 2025-04-29 | |
| CVE-2025-23180 | Ribbon Communications execution with unnecessary privileges | 8.0CNA v3.1 | 0.3% | 2025-04-29 | |
| CVE-2025-23179 | Ribbon Communications use of hard-coded credentials | 5.5CNA v3.1 | 0.2% | 2025-04-29 | |
| CVE-2025-23178 | Ribbon Communications improper restriction of communication channel to intended endpoints | 7.6CNA v3.1 | 0.3% | 2025-04-29 | |
| CVE-2025-23177 | Ribbon Communications uncontrolled search path element | 7.6CNA v3.1 | 0.3% | 2025-04-29 | |
| CVE-2025-4095 | Docker Desktop Registry Access Management enforcement missing authorization | 4.3CNA v4.0 | 0.2% | 2025-04-29 | Fix |
| CVE-2025-4093 | Mozilla memory safety bug fixed in Firefox ESR and Thunderbird | 8.1CISA ADP v3.1 | 0.5% | 2025-04-29 | Fix |
| CVE-2025-4092 | Mozilla memory safety bugs fixed in Firefox 138 and Thunderbird 138 | 6.5CISA ADP v3.1 | 0.3% | 2025-04-29 | Fix |
| CVE-2025-4091 | Mozilla memory safety bugs fixed in Firefox 138, Thunderbird 138, Firefox ESR, and Thunderbird | 8.1CISA ADP v3.1 | 0.5% | 2025-04-29 | Fix |
| CVE-2025-4090 | Leaked library paths in Thunderbird for Android | 5.3CISA ADP v3.1 | 0.3% | 2025-04-29 | Fix |
| CVE-2025-4089 | Mozilla Firefox potential local code execution in copy as cURL command | 5.1CISA ADP v3.1 | 0.2% | 2025-04-29 | Fix |
| CVE-2025-4088 | Mozilla Firefox cross-site request forgery via storage access API redirects | 6.5CISA ADP v3.1 | 0.2% | 2025-04-29 | Fix |
| CVE-2025-4087 | Mozilla Firefox unsafe attribute access during XPath parsing | 4.8CISA ADP v3.1 | 0.3% | 2025-04-29 | Fix |
| CVE-2025-4086 | Mozilla Firefox specially crafted filename could be used to obscure download type | 6.5CISA ADP v3.1 | 0.3% | 2025-04-29 | Fix |
| CVE-2025-4085 | Mozilla Firefox potential information leakage and privilege escalation in UITour actor | 7.1CISA ADP v3.1 | 0.3% | 2025-04-29 | Fix |
| CVE-2025-4084 | Mozilla Firefox potential local code execution in copy as cURL command | 5.7CISA ADP v3.1 | 0.4% | 2025-04-29 | Fix |
| CVE-2025-4083 | Mozilla Firefox process isolation bypass using javascript: URI links in cross-origin frames | 9.1CISA ADP v3.1 | 0.5% | 2025-04-29 | Fix |
| CVE-2025-4082 | WebGL shader attribute memory corruption in Thunderbird for macOS | 5.9CISA ADP v3.1 | 0.5% | 2025-04-29 | Fix |
| CVE-2025-4080 | PHPGurukul Online Nurse Hiring System view-request.php SQL injection | 8.8v3.1 | 0.5% | 2025-04-29 | |
| CVE-2025-4079 | PCMan FTP Server RENAME command buffer overflow | 9.8v3.1 | 0.8% | 2025-04-29 | |
| CVE-2025-4078 | Wangshen SecGate 3600 g=log_export_file path traversal | 5.3CNA v4.0 | 1.1% | 2025-04-29 | Reported exploitedNuclei |
| CVE-2025-4077 | code-projects School Billing System searchrec stack-based overflow | 7.8v3.1 | 0.4% | 2025-04-29 | |
| CVE-2025-4076 | LB-LINK BL-AC3600 Password lighttpd.cgi easy_uci_set_option_string_0 command injection | 5.3CNA v4.0 | 19.8% | 2025-04-29 | |
| CVE-2025-4075 | VMSMan login.php cross-site scripting | 5.3CNA v4.0 | 0.4% | 2025-04-29 | |
| CVE-2025-4074 | PHPGurukul Curfew e-Pass Management System pass-bwdates-report.php SQL injection | 9.8v3.1 | 0.6% | 2025-04-29 | |
| CVE-2025-4073 | PHPGurukul Student Record System change-password.php SQL injection | 9.8v3.1 | 0.6% | 2025-04-29 | |
| CVE-2025-4072 | PHPGurukul Online Nurse Hiring System edit-nurse.php SQL injection | 8.8v3.1 | 0.5% | 2025-04-29 | |
| CVE-2025-4071 | PHPGurukul COVID19 Testing Management System test-details.php SQL injection | 9.8v3.1 | 0.6% | 2025-04-29 | |
| CVE-2025-4070 | PHPGurukul Rail Pass Management System changeimage.php SQL injection | 9.8v3.1 | 0.6% | 2025-04-29 | |
| CVE-2025-4069 | code-projects Product Management System add_item stack-based overflow | 7.8v3.1 | 0.4% | 2025-04-29 | |
| CVE-2025-4068 | code-projects Simple Movie Ticket Booking System changeprize stack-based overflow | 7.8v3.1 | 0.4% | 2025-04-29 | |
| CVE-2025-4067 | ScriptAndTools Online-Travling-System viewpackage.php access control | 6.9CNA v4.0 | 0.6% | 2025-04-29 | |
| CVE-2025-4066 | ScriptAndTools Online-Travling-System addpackage.php access control | 9.8v3.1 | 0.6% | 2025-04-29 | |
| CVE-2025-4065 | ScriptAndTools Online-Travling-System addadvertisement.php access control | 7.5v3.1 | 0.5% | 2025-04-29 | |
| CVE-2025-4064 | ScriptAndTools Online-Travling-System viewenquiry.php access control | 6.9CNA v4.0 | 0.6% | 2025-04-29 | |
| CVE-2025-4063 | code-projects Student Information Management System cancel stack-based overflow | 7.8v3.1 | 0.3% | 2025-04-29 | |
| CVE-2025-4062 | code-projects Theater Seat Booking System cancel stack-based overflow | 7.8v3.1 | 0.3% | 2025-04-29 | |
| CVE-2025-4061 | code-projects Clothing Store Management System add_item stack-based overflow | 7.8v3.1 | 0.3% | 2025-04-29 | |
| CVE-2025-4060 | PHPGurukul Notice Board System category.php SQL injection | 9.8v3.1 | 0.5% | 2025-04-29 | |
| CVE-2025-4059 | code-projects Prison Management System Prison_Mgmt_Sys addrecord stack-based overflow | 7.8v3.1 | 0.4% | 2025-04-29 | |
| CVE-2025-4058 | Projectworlds Online Examination System Bloodgroop_process.php SQL injection | 9.8v3.1 | 0.6% | 2025-04-29 | |
| CVE-2025-4035 | libsoup cookie domain handling case sensitivity bypass | 4.3CNA v3.1 | 0.4% | 2025-04-29 | Fix |
| CVE-2025-3929 | Stored XSS vulnerability in MDaemon Email Server | 6.1NVD v3.1 | 0.6% | 2025-04-29 | Fix |
| CVE-2025-3911 | Exposure in Docker Desktop logs of environment variables configured for running containers | 5.2CNA v4.0 | 0.2% | 2025-04-29 | Fix |
| CVE-2025-3910 | Red Hat Build of Keycloak org.keycloak.authentication: Two factor authentication bypass | 5.4CNA v3.1 | 0.4% | 2025-04-29 | Fix |
| CVE-2025-3891 | Red Hat Enterprise Linux 8 mod_auth_openidc: Dos | 7.5NVD v3.1 | 1.6% | 2025-04-29 | Fix |
| CVE-2025-3501 | Org.keycloak.protocol.services: Keycloak hostname verification | 8.2CNA v3.1 | 0.5% | 2025-04-29 | Fix |
| CVE-2025-3452 | SecuPress Free WordPress plugin missing authorization authenticated arbitrary plugin installation | 4.3CNA v3.1 | 0.3% | 2025-04-29 | Fix |
| CVE-2025-3301 | Series 2 SoCs and modules ECDH and EdDSA operations vulnerability | 1.0CNA v4.0 | 0.2% | 2025-04-29 | Fix |
| CVE-2025-2893 | Gutenverse WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-04-29 | Fix |
| CVE-2025-2817 | Privilege escalation in Thunderbird Updater | 8.8CISA ADP v3.1 | 0.7% | 2025-04-29 | Fix |
| CVE-2025-1551 | IBM Operational Decision Manager cross-site scripting | 6.1CNA v3.1 | 0.3% | 2025-04-29 | Fix |
| CVE-2025-1194 | Regular expression denial of service (ReDoS) in huggingface/Transformers | 6.5v3.1 | 0.4% | 2025-04-29 | Fix |
| CVE-2025-0716 | Google AngularJS improperly sanitizes SVG elements | 4.8CNA v3.1 | 0.4% | 2025-04-29 | Fix |
| CVE-2025-0520 | ShowDoc unauthenticated file upload remote code execution | 9.4CNA v4.0 | 2.6% | 2025-04-29 | NucleiFix |
| CVE-2025-46661 | IPW Metazo server-side template injection | 9.8v3.1 | 0.8% | 2025-04-28 | |
| CVE-2025-46614 | Snowflake ODBC sensitive information in log files | 3.3CNA v3.1 | 0.2% | 2025-04-28 | Fix |
| CVE-2025-46328 | snowflakedb snowflake-connector-nodejs time-of-check time-of-use race condition | 3.3CNA v3.1 | 0.2% | 2025-04-28 | Fix |
| CVE-2025-46327 | Go Snowflake driver has race condition when checking access to Easy Logging configuration file | 3.3CNA v3.1 | 0.1% | 2025-04-28 | Fix |
| CVE-2025-46326 | Snowflake Connector for .NET Easy Logging configuration file check race condition | 3.3CNA v3.1 | 0.2% | 2025-04-28 | Fix |
| CVE-2025-45953 | PHPGurukul Hostel Management System session fixation | 9.1CISA ADP v3.1 | 0.4% | 2025-04-28 | |
| CVE-2025-45949 | PHPGurukul User Registration and Login and User Management System session fixation | 9.8CISA ADP v3.1 | 0.5% | 2025-04-28 | |
| CVE-2025-45947 | PHPGurukul Online Banquet Booking System code injection | 9.8CISA ADP v3.1 | 0.8% | 2025-04-28 | |
| CVE-2025-43857 | net-imap rubygem vulnerable to possible DoS by memory exhaustion | 6.0CNA v4.0 | 0.5% | 2025-04-28 | Fix |
| CVE-2025-43854 | DIFY vulnerable to clickjacking Attack | 2.3CNA v4.0 | 0.2% | 2025-04-28 | Fix |
| CVE-2025-42598 | SEIKO EPSON printer drivers incorrect default permissions | 8.4CNA v4.0 | 0.2% | 2025-04-28 | |
| CVE-2025-39367 | Kleo WordPress theme broken access control | 5.3CNA v3.1 | 0.3% | 2025-04-28 | Fix |
| CVE-2025-34491 | GFI MailEssentials MultiNode insecure deserialization | 8.8v3.1 | 0.9% | 2025-04-28 | Fix |
| CVE-2025-34490 | GFI MailEssentials XXE arbitrary file read | 6.5v3.1 | 0.7% | 2025-04-28 | Fix |
| CVE-2025-34489 | GFI MailEssentials local privilege escalation | 7.8v3.1 | 0.3% | 2025-04-28 | Fix |
| CVE-2025-32472 | SICK multiScan1XX DoS attack by conducting a slowloris-type attack | 5.3CNA v3.1 | 0.6% | 2025-04-28 | |
| CVE-2025-32471 | SICK FLX3-CPUC200 and TDC-X401GL password storage weak credentials | 3.7CNA v3.1 | 0.4% | 2025-04-28 | |
| CVE-2025-32470 | SICK FLX0-GPNT100 unauthenticated change of IP adress | 7.5CNA v3.1 | 0.6% | 2025-04-28 | |
| CVE-2025-31651 | Apache Tomcat: Bypass of rules in Rewrite Valve | 9.8NVD v3.1 | 4.2% | 2025-04-28 | Fix |
| CVE-2025-31650 | Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame | 7.5NVD v3.1 | 61.3% | 2025-04-28 | Exploit codeFix |
| CVE-2025-31144 | SIOS Technology Quick Agent V3 improper channel restriction | 6.9CNA v4.0 | 0.5% | 2025-04-28 | |
| CVE-2025-27937 | SIOS Technology Quick Agent V3 path traversal | 7.1CNA v4.0 | 0.7% | 2025-04-28 | |
| CVE-2025-26692 | SIOS Technology Quick Agent V3 path traversal | 9.2CNA v4.0 | 0.9% | 2025-04-28 | |
| CVE-2025-25776 | CodeAstro Bus Ticket Booking System User Registration and User Profile features cross-site scripting | 5.0CISA ADP v3.1 | 0.3% | 2025-04-28 | |
| CVE-2025-23377 | Dell PowerProtect Data Manager improper output encoding | 4.2CNA v3.1 | 0.2% | 2025-04-28 | Fix |
| CVE-2025-23376 | Dell PowerProtect Data Manager Reporting server-side template injection | 2.3CNA v3.1 | 0.2% | 2025-04-28 | Fix |
| CVE-2025-23375 | Dell PowerProtect Data Manager incorrect use of privileged APIs | 7.8CNA v3.1 | 0.1% | 2025-04-28 | Fix |
| CVE-2025-22235 | Spring Boot EndpointRequest.to creates wrong matcher if actuator endpoint is not exposed | 7.3CNA v3.1 | 0.4% | 2025-04-28 | Fix |
| CVE-2025-4039 | PHPGurukul Rail Pass Management System search-pass.php SQL injection | 9.8v3.1 | 0.6% | 2025-04-28 | |
| CVE-2025-4038 | code-projects Train Ticket Reservation System reservation stack-based overflow | 5.5v3.1 | 0.3% | 2025-04-28 | |
| CVE-2025-4037 | code-projects ATM Banking moneyWithdraw logic error | 5.5v3.1 | 0.3% | 2025-04-28 | |
| CVE-2025-4036 | 201206030 Novel Chapter AuthorController.java updateBookChapter access control | 9.8v3.1 | 0.5% | 2025-04-28 | |
| CVE-2025-4034 | Projectworlds Online Examination System inser_doc_process.php SQL injection | 9.8v3.1 | 0.6% | 2025-04-28 | |
| CVE-2025-4033 | PHPGurukul Nipah Virus Testing Management System patient-search-report.php SQL injection | 9.8v3.1 | 0.5% | 2025-04-28 | |
| CVE-2025-4032 | inclusionAI AWorld shell_tool.py subprocess.Popen os command injection | 8.1v3.1 | 3.3% | 2025-04-28 | |
| CVE-2025-4031 | PHPGurukul Pre-School Enrollment System aboutus.php SQL injection | 9.8v3.1 | 0.5% | 2025-04-28 | |
| CVE-2025-4030 | PHPGurukul COVID19 Testing Management System search-report-result.php SQL injection | 9.8v3.1 | 0.5% | 2025-04-28 | |
| CVE-2025-4029 | code-projects Personal Diary Management System New Record addrecord stack-based overflow | 7.8v3.1 | 0.4% | 2025-04-28 | |
| CVE-2025-4028 | PHPGurukul COVID19 Testing Management System profile.php SQL injection | 9.8NVD v3.1 | 0.5% | 2025-04-28 | |
| CVE-2025-4027 | PHPGurukul Old Age Home Management System rules.php SQL injection | 9.8v3.1 | 0.6% | 2025-04-28 | |
| CVE-2025-4026 | PHPGurukul Nipah Virus Testing Management System profile.php SQL injection | 9.8v3.1 | 0.6% | 2025-04-28 | |
| CVE-2025-4025 | itsourcecode Placement Management System registration.php SQL injection | 9.8v3.1 | 0.6% | 2025-04-28 | |
| CVE-2025-4024 | itsourcecode Placement Management System add_drive.php SQL injection | 9.8v3.1 | 0.6% | 2025-04-28 | |
| CVE-2025-4023 | itsourcecode Placement Management System add_company.php SQL injection | 9.8v3.1 | 0.6% | 2025-04-28 | |
| CVE-2025-4022 | web-arena-x Webarena evaluators.py HTMLContentEvaluator code injection | 8.8v3.1 | 0.6% | 2025-04-28 | |
| CVE-2025-4021 | code-projects Patient Record Management System edit_spatient.php SQL injection | 7.5v3.1 | 0.5% | 2025-04-28 | |
| CVE-2025-4020 | PHPGurukul Old Age Home Management System contact.php SQL injection | 9.8v3.1 | 0.6% | 2025-04-28 | |
| CVE-2025-4019 | 20120630 Novel-Plus GeneratorController.java genCode missing authentication | 9.8v3.1 | 0.7% | 2025-04-28 | |
| CVE-2025-4018 | 20120630 Novel-Plus CrawlController.java addCrawlSource missing authentication | 7.5v3.1 | 0.8% | 2025-04-28 | |
| CVE-2025-4017 | 20120630 Novel-Plus LogController.java list improper authorization | 6.5v3.1 | 0.6% | 2025-04-28 | |
| CVE-2025-4016 | 20120630 Novel-Plus LogController.java deleteIndex improper authorization | 9.1v3.1 | 0.5% | 2025-04-28 | |
| CVE-2025-4015 | 20120630 Novel-Plus SessionController.java list missing authentication | 7.5v3.1 | 0.8% | 2025-04-28 | |
| CVE-2025-4014 | PHPGurukul Art Gallery Management System manage-art-medium.php SQL injection | 9.8v3.1 | 0.5% | 2025-04-28 | |
| CVE-2025-4013 | PHPGurukul Art Gallery Management System aboutus.php SQL injection | 9.8v3.1 | 0.5% | 2025-04-28 | |
| CVE-2025-4012 | playeduxyz PlayEdu 开源培训系统 User Avatar create server-side request forgery | 7.5v3.1 | 0.5% | 2025-04-28 | |
| CVE-2025-4011 | Redmine Custom Query cross-site scripting | 5.1CNA v4.0 | 0.3% | 2025-04-28 | Fix |
| CVE-2025-4007 | Tenda W12/i24 httpd modules cgidhcpsCfgSet stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-04-28 | Emerging Threats |
| CVE-2025-4006 | youyiio BeyongCms Document Management Page Upload.html unrestricted upload | 5.1CNA v4.0 | 0.3% | 2025-04-28 | |
| CVE-2025-4005 | PHPGurukul COVID19 Testing Management System patient-report.php SQL injection | 9.8v3.1 | 0.5% | 2025-04-28 | |
| CVE-2025-4004 | PHPGurukul COVID19 Testing Management System password-recovery.php SQL injection | 9.8v3.1 | 0.5% | 2025-04-28 | |
| CVE-2025-4003 | RefindPlusRepo RefindPlus RP_ApfsIo.c InternalApfsTranslateBlock null pointer dereference | 6.8CNA v4.0 | 0.2% | 2025-04-28 | |
| CVE-2025-4002 | RefindPlusRepo RefindPlus BootLog.c GetDebugLogFile null pointer dereference | 6.8CNA v4.0 | 0.2% | 2025-04-28 | |
| CVE-2025-4001 | scipopt scip File Descriptor genRandomLOPInstance.c main file descriptor consumption | 4.8CNA v4.0 | 0.2% | 2025-04-28 | Fix |
| CVE-2025-4000 | Seeyon Zhiyuan OA Web Application System ssoproxy.jsp cross-site scripting | 5.4v3.1 | 0.3% | 2025-04-28 | |
| CVE-2025-3999 | Seeyon Zhiyuan OA Web Application System URL parameter date.jsp cross-site scripting | 5.4v3.1 | 0.3% | 2025-04-28 | |
| CVE-2025-3998 | CodeAstro Membership Management System renew.php SQL injection | 9.8v3.1 | 0.6% | 2025-04-28 | |
| CVE-2025-3997 | dazhouda lecms Personal Information page index.php cross-site request forgery | 5.3CNA v4.0 | 0.2% | 2025-04-28 | |
| CVE-2025-3996 | TOTOLINK N150RT MAC Filtering page home.htm cross-site scripting | 4.8v3.1 | 0.4% | 2025-04-28 | |
| CVE-2025-3995 | TOTOLINK N150RT LAN settings page fromStaticDHCP cross-site scripting | 3.4NVD v3.1 | 0.4% | 2025-04-28 | |
| CVE-2025-3994 | TOTOLINK N150RT IP Port Filtering home.htm cross-site scripting | 3.4NVD v3.1 | 5.0% | 2025-04-28 | Emerging Threats |
| CVE-2025-3993 | TOTOLINK N150RT formWsc buffer overflow | 8.7CNA v4.0 | 1.0% | 2025-04-28 | Emerging Threats |
| CVE-2025-3992 | TOTOLINK N150RT formWlwds buffer overflow | 8.7CNA v4.0 | 1.0% | 2025-04-28 | Emerging Threats |
| CVE-2025-3991 | TOTOLINK N150RT formWdsEncrypt buffer overflow | 8.7CNA v4.0 | 1.0% | 2025-04-28 | Emerging Threats |
| CVE-2025-3706 | 104 Corporation eHRMS reflected cross-site scripting | 6.1CNA v3.1 | 0.3% | 2025-04-28 | Fix |
| CVE-2025-3224 | Docker Desktop update process directory deletion privilege escalation | 7.3CNA v4.0 | 0.2% | 2025-04-28 | Fix |
| CVE-2025-3200 | Com-Server Exposed via Weak TLS | 9.1CNA v3.1 | 0.4% | 2025-04-28 | Fix |
| CVE-2025-0627 | TaxoPress AI Autotagger widget settings stored cross-site scripting | 3.5CISA ADP v3.1 | 0.3% | 2025-04-28 | Fix |
| CVE-2025-0049 | Disclosure of sensitive information in an error message in GoAnywhere prior to | 3.5CNA v3.1 | 0.3% | 2025-04-28 | Fix |
| CVE-2025-46690 | Ververica Platform forced browsing | 8.8v3.1 | 0.4% | 2025-04-27 | |
| CVE-2025-46689 | Ververica Platform cross-site scripting | 6.1v3.1 | 0.3% | 2025-04-27 | |
| CVE-2025-46688 | QuickJS incorrect buffer size calculation | 8.4v3.1 | 0.3% | 2025-04-27 | Fix |
| CVE-2025-46687 | QuickJS resource exhaustion | 7.8v3.1 | 0.3% | 2025-04-27 | Fix |
| CVE-2025-46675 | nasa CryptoLib improper control of dynamic code | 4.2v3.1 | 0.3% | 2025-04-27 | Fix |
| CVE-2025-46674 | nasa CryptoLib active debug code | 9.9v3.1 | 0.6% | 2025-04-27 | Fix |
| CVE-2025-46673 | nasa CryptoLib improper control of dynamic code | 9.9v3.1 | 0.5% | 2025-04-27 | Fix |
| CVE-2025-46672 | nasa CryptoLib unchecked return value | 8.8v3.1 | 0.5% | 2025-04-27 | Fix |
| CVE-2025-46657 | Karazal cross-site scripting | 6.1NVD v3.1 | 0.3% | 2025-04-27 | Exploit code |
| CVE-2025-46580 | ZTE GoldenDB Database product has a code-related vulnerability | 7.7CNA v3.1 | 0.4% | 2025-04-27 | Fix |
| CVE-2025-46579 | ZTE GoldenDB Database product has a DDE injection | 8.4CNA v3.1 | 0.3% | 2025-04-27 | Fix |
| CVE-2025-46578 | ZTE GoldenDB Database product has SQL injection vulnerabilities in multiple interfaces | 6.5CNA v3.1 | 0.4% | 2025-04-27 | Fix |
| CVE-2025-46577 | ZTE GoldenDB Database product has an SQL injection | 6.5CNA v3.1 | 0.4% | 2025-04-27 | Fix |
| CVE-2025-46576 | ZTE GoldenDB Database product has a privilege escalation | 5.4CNA v3.1 | 0.3% | 2025-04-27 | Fix |
| CVE-2025-46575 | ZTE GoldenDB Database product has an information disclosure | 4.9CNA v3.1 | 0.4% | 2025-04-27 | Fix |
| CVE-2025-46574 | ZTE GoldenDB Database product has an input validation vulnerability | 4.1CNA v3.1 | 0.2% | 2025-04-27 | Fix |
| CVE-2025-3990 | TOTOLINK N150RT formVlan buffer overflow | 8.8v3.1 | 1.0% | 2025-04-27 | Emerging Threats |
| CVE-2025-3989 | TOTOLINK N150RT formStaticDHCP buffer overflow | 8.7CNA v4.0 | 1.0% | 2025-04-27 | Emerging Threats |
| CVE-2025-3988 | TOTOLINK N150RT formPortFw buffer overflow | 8.7CNA v4.0 | 1.4% | 2025-04-27 | Emerging Threats |
| CVE-2025-3987 | TOTOLINK N150RT formWsc command injection | 8.8v3.1 | 11.3% | 2025-04-27 | Emerging Threats |
| CVE-2025-3986 | Apereo CAS CasConfigurationMetadataServerController.java redos | 7.5v3.1 | 0.6% | 2025-04-27 | |
| CVE-2025-3985 | Apereo CAS ResponseEntity redos | 4.9v3.1 | 0.6% | 2025-04-27 | |
| CVE-2025-3984 | Apereo CAS Groovy Code RegisteredServiceSimpleFormController.java saveService code injection | 7.5v3.1 | 0.5% | 2025-04-27 | |
| CVE-2025-3983 | AMTT Hotel Broadband Operation System nlog_down.php command injection | 7.2v3.1 | 14.8% | 2025-04-27 | |
| CVE-2025-3982 | nortikin Sverchok Set Property Mk2 Node getsetprop_mk2.py SvSetPropNodeMK2 prototype pollution | 8.8v3.1 | 0.6% | 2025-04-27 | |
| CVE-2025-3981 | wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System details improper authorization | 5.3v3.1 | 0.4% | 2025-04-27 | |
| CVE-2025-3980 | wowjoy 浙江湖州华卓信息科技有限公司 Internet Doctor Workstation System list improper authorization | 5.3v3.1 | 5.5% | 2025-04-27 | |
| CVE-2025-3979 | dazhouda Lecms Password Change index.php cross-site request forgery | 6.5v3.1 | 0.3% | 2025-04-27 | |
| CVE-2025-3978 | dazhouda Lecms user_set.htm information disclosure | 7.5v3.1 | 0.5% | 2025-04-27 | |
| CVE-2025-3977 | iteachyou Dreamer CMS Attachment download improper authorization | 5.3CNA v4.0 | 0.4% | 2025-04-27 | |
| CVE-2025-3976 | PHPGurukul COVID19 Testing Management System new-user-testing.php SQL injection | 9.8v3.1 | 0.5% | 2025-04-27 | |
| CVE-2025-3975 | ScriptAndTools eCommerce-website-in-PHP subscriber-csv.php information disclosure | 6.9CNA v4.0 | 0.8% | 2025-04-27 | |
| CVE-2025-3974 | PHPGurukul COVID19 Testing Management System edit-phlebotomist.php SQL injection | 9.8v3.1 | 0.5% | 2025-04-27 | |
| CVE-2025-3973 | PHPGurukul COVID19 Testing Management System check_availability.php SQL injection | 9.8v3.1 | 0.5% | 2025-04-27 | |
| CVE-2025-3972 | PHPGurukul COVID19 Testing Management System bwdates-report-result.php SQL injection | 9.8v3.1 | 0.5% | 2025-04-27 | |
| CVE-2025-3971 | PHPGurukul COVID19 Testing Management System add-phlebotomist.php SQL injection | 9.8v3.1 | 0.5% | 2025-04-27 | |
| CVE-2025-3970 | baseweb JSite save cross-site scripting | 5.4v3.1 | 0.4% | 2025-04-27 | |
| CVE-2025-3969 | codeprojects News Publishing Site Dashboard Edit Category page edit-category.php unrestricted upload | 9.8v3.1 | 0.5% | 2025-04-27 | Exploit code |
| CVE-2025-3968 | codeprojects News Publishing Site Dashboard api.php SQL injection | 8.8v3.1 | 0.5% | 2025-04-27 | |
| CVE-2025-3967 | itwanger paicoding Article post improper authorization | 5.3CNA v4.0 | 0.5% | 2025-04-27 | |
| CVE-2025-3966 | itwanger paicoding Browsing History home information disclosure | 5.3v3.1 | 0.5% | 2025-04-27 | |
| CVE-2025-3965 | itwanger paicoding post cross-site scripting | 5.4v3.1 | 0.4% | 2025-04-27 | |
| CVE-2025-3964 | withstars Books-Management-System Article del cross-site request forgery | 5.3CNA v4.0 | 0.3% | 2025-04-27 | |
| CVE-2025-3963 | withstars Books-Management-System Background interface list authorization | 9.8v3.1 | 0.7% | 2025-04-27 | |
| CVE-2025-3962 | withstars Books-Management-System Comment add cross-site scripting | 4.1v3.1 | 0.4% | 2025-04-27 | |
| CVE-2025-3961 | withstars Books-Management-System do cross-site scripting | 4.1v3.1 | 0.4% | 2025-04-27 | |
| CVE-2025-3960 | withstars Books-Management-System Background interface allreaders.html authorization | 9.8v3.1 | 0.7% | 2025-04-27 | |
| CVE-2025-3959 | withstars Books-Management-System reader_delete.html cross-site request forgery | 5.3CNA v4.0 | 0.3% | 2025-04-27 | |
| CVE-2025-3958 | withstars Books-Management-System Book Edit page book_edit_do.html cross-site scripting | 4.1v3.1 | 0.4% | 2025-04-27 | |
| CVE-2025-3957 | opplus springboot-admin SysLogDao.xml SQL injection | 9.8v3.1 | 0.5% | 2025-04-27 | |
| CVE-2025-3956 | 201206030 novel-cloud BookInfoMapper.xml RestResp SQL injection | 9.8v3.1 | 0.4% | 2025-04-27 | |
| CVE-2025-3955 | codeprojects Patient Record Management System edit_rpatient.php.php SQL injection | 7.5v3.1 | 0.5% | 2025-04-27 | |
| CVE-2025-3886 | Cato Networks SDP Client CatoNetworks CatoClient PrivilegedHelperTool race condition | 5.7CNA v4.0 | 0.2% | 2025-04-27 | Fix |
| CVE-2025-2866 | The Document Foundation LibreOffice PDF signature forgery with adbe.pkcs7.sha1 SubFilter | 2.4CNA v4.0 | 0.1% | 2025-04-27 | Fix |
| CVE-2025-46656 | python-markdownify improper quantity validation | 3.3v3.1 | 0.2% | 2025-04-26 | Fix |
| CVE-2025-46655 | HackMD CodiMD unprotected alternate path | 4.9CNA v3.1 | 0.2% | 2025-04-26 | |
| CVE-2025-46654 | HackMD CodiMD unprotected alternate path | 4.9CNA v3.1 | 0.3% | 2025-04-26 | Fix |
| CVE-2025-46653 | Formidable relies on hexoid to prevent guessing of filenames for untrusted executable content | 3.1v3.1 | 0.4% | 2025-04-26 | Fix |
| CVE-2025-46652 | IZArc Mark-of-the-Web handling vulnerability | 6.1CNA v3.1 | 0.3% | 2025-04-26 | |
| CVE-2025-46646 | Artifex Ghostscript path traversal | 4.5CNA v3.1 | 0.2% | 2025-04-26 | Fix |
| CVE-2025-3954 | ChurchCRM Referer server-side request forgery | 6.3CNA v4.0 | 0.6% | 2025-04-26 | |
| CVE-2025-3915 | Aeropage Sync for Airtable missing authorization | 4.3v3.1 | 0.3% | 2025-04-26 | Fix |
| CVE-2025-3914 | Aeropage Sync for Airtable WordPress plugin authenticated (Subscriber+) arbitrary file upload | 8.8v3.1 | 17.4% | 2025-04-26 | Exploit codeFix |
| CVE-2025-3906 | Integração entre Eduzz e Woocommerce - missing authorization to Authenticated privilege escalation | 8.8CNA v3.1 | 0.5% | 2025-04-26 | |
| CVE-2025-3491 | The Add custom page template plugin for WordPress is vulnerable to PHP Code Injection leading to Remote Code Execution in all versions up to, and including, 2.0.1 via the 'acpt_validate_setting' function. This is due to insufficient sanitization of the 'template_name' parameter. This makes it possib | 7.2CNA v3.1 | 0.8% | 2025-04-26 | |
| CVE-2025-2907 | Order Delivery Date Pro for WooCommerce WordPress plugin unauthenticated arbitrary option update | 9.8CISA ADP v3.1 | 1.4% | 2025-04-26 | NucleiExploit codeFix |
| CVE-2025-2851 | GL.iNet GL-A1300 Slate Plus RPC plugins.so buffer overflow | 8.6CNA v4.0 | 0.4% | 2025-04-26 | Fix |
| CVE-2025-2850 | GL.iNet GL-A1300 Slate Plus Download interface improper authorization | 5.1CNA v4.0 | 0.2% | 2025-04-26 | Fix |
| CVE-2025-2811 | GL.iNet GL-A1300 Slate Plus API redos | 6.9CNA v4.0 | 0.4% | 2025-04-26 | Fix |
| CVE-2025-2801 | dorinabc Smart Forms shortcode execution code injection | 7.3CNA v3.1 | 0.5% | 2025-04-26 | |
| CVE-2025-2105 | Jupiter X Core WordPress plugin unauthenticated PHP object injection via PHAR | 8.1CNA v3.1 | 0.8% | 2025-04-26 | Fix |
| CVE-2025-2101 | Edumall WordPress theme unauthenticated local file inclusion | 8.1CNA v3.1 | 0.9% | 2025-04-26 | Fix |
| CVE-2025-1458 | Element Pack Elementor Addons WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-04-26 | Fix |
| CVE-2025-46618 | JetBrains TeamCity cross-site scripting | 3.5CNA v3.1 | 63.0% | 2025-04-25 | Fix |
| CVE-2025-46617 | Quantum StorNext hard-coded credentials | 7.2CNA v3.1 | 0.3% | 2025-04-25 | Fix |
| CVE-2025-46616 | Quantum StorNext unrestricted file upload | 9.9CNA v3.1 | 0.7% | 2025-04-25 | Fix |
| CVE-2025-46613 | openplcproject OpenPLC race condition | 7.5CNA v3.1 | 0.2% | 2025-04-25 | |
| CVE-2025-46599 | CNCF K3s Kubernetes kubelet configuration exposes credentials | 6.8CNA v3.1 | 0.5% | 2025-04-25 | Fix |
| CVE-2025-46595 | backdropcms Flag An cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-04-25 | Fix |
| CVE-2025-46547 | Sherpa Orchestrator cross-site request forgery | 6.1v3.1 | 0.2% | 2025-04-25 | |
| CVE-2025-46546 | Sherpa Orchestrator SQL injection | 8.8v3.1 | 0.4% | 2025-04-25 | |
| CVE-2025-46545 | Sherpa Orchestrator cross-site scripting | 4.8v3.1 | 0.3% | 2025-04-25 | |
| CVE-2025-46544 | Sherpa Orchestrator incorrect authorization | 6.5v3.1 | 0.3% | 2025-04-25 | |
| CVE-2025-46535 | Custom Login and Registration WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2025-04-25 | |
| CVE-2025-46482 | WP Quiz WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-04-25 | |
| CVE-2025-46433 | JetBrains TeamCity relative path traversal | 4.9CNA v3.1 | 0.5% | 2025-04-25 | Fix |
| CVE-2025-46432 | JetBrains TeamCity sensitive information in log files | 4.3CNA v3.1 | 1.0% | 2025-04-25 | Fix |
| CVE-2025-46333 | z2d OOB composition could lead to invalid memory access and corruption | 7.3CNA v4.0 | 0.2% | 2025-04-25 | |
| CVE-2025-43865 | React Router allows pre-render data spoofing on React-Router framework mode | 8.2CNA v3.1 | 0.8% | 2025-04-25 | Fix |
| CVE-2025-43864 | remix-run react-router react Router allows a DoS via cache poisoning by forcing SPA mode | 7.5CNA v3.1 | 20.5% | 2025-04-25 | Exploit codeFix |
| CVE-2025-43862 | Dify allows unauthorized access and Modification of APP Orchestration | 7.6CNA v3.1 | 0.3% | 2025-04-25 | Fix |
| CVE-2025-43016 | JetBrains Rider relative path traversal | 5.4CNA v3.1 | 0.4% | 2025-04-25 | Fix |
| CVE-2025-32986 | Netscout Ngeniusone information disclosure | 7.5CISA ADP v3.1 | 0.4% | 2025-04-25 | Fix |
| CVE-2025-32985 | Netscout Ngeniusone hard-coded credentials | 9.8CISA ADP v3.1 | 0.4% | 2025-04-25 | Fix |
| CVE-2025-32984 | Netscout Ngeniusone cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-04-25 | Fix |
| CVE-2025-32983 | Netscout Ngeniusone information disclosure | 7.5CISA ADP v3.1 | 0.4% | 2025-04-25 | Fix |
| CVE-2025-32982 | Netscout Ngeniusone improper authorization | 7.5CISA ADP v3.1 | 0.4% | 2025-04-25 | Fix |
| CVE-2025-32981 | Netscout Ngeniusone incorrect default permissions | 7.1CISA ADP v3.1 | 0.2% | 2025-04-25 | |
| CVE-2025-32980 | NETSCOUT nGeniusONE sudo configuration incorrect privilege assignment | 9.8CISA ADP v3.1 | 0.4% | 2025-04-25 | |
| CVE-2025-32979 | Netscout Ngeniusone insecure temporary file | 6.5CISA ADP v3.1 | 0.3% | 2025-04-25 | Fix |
| CVE-2025-32432 | Craft CMS code injection | 10.0CNA v3.1 | 99.8% | 2025-04-25 | KEVNucleiMetasploitEmerging ThreatsExploit codeKCVFix |
| CVE-2025-32045 | Moodle: Hidden grades shown to users without permission on some grade reports | 5.3CNA v3.1 | 0.3% | 2025-04-25 | Fix |
| CVE-2025-32044 | Moodle: Unauthenticated rest API user data exposure | 7.5CNA v3.1 | 0.5% | 2025-04-25 | Exploit codeFix |
| CVE-2025-28354 | Entrust Printer Manager path traversal | 6.5CISA ADP v3.1 | 0.5% | 2025-04-25 | |
| CVE-2025-28128 | Mytel Telecom Online Account System authentication bypass by spoofing | 7.0CISA ADP v3.1 | 0.4% | 2025-04-25 | |
| CVE-2025-28076 | EasyVirt DCScope management API SQL injection | 6.5CISA ADP v3.1 | 0.3% | 2025-04-25 | |
| CVE-2025-25775 | CodeAstro Bus Ticket Booking System SQL injection | 9.8CISA ADP v3.1 | 0.5% | 2025-04-25 | |
| CVE-2025-3935 | ConnectWise ScreenConnect improper authentication | 8.1CNA v3.1 | 3.5% | 2025-04-25 | KEVFix |
| CVE-2025-3928 | Commvault Web Server unspecified vulnerability | 8.8NVD v3.1 | 2.5% | 2025-04-25 | KEVFix |
| CVE-2025-3923 | buildwps Prevent Direct Access unique file name generator information disclosure | 5.3CNA v3.1 | 0.4% | 2025-04-25 | Fix |
| CVE-2025-3912 | WS Form LITE WordPress plugin unauthorized access | 5.3CNA v3.1 | 0.4% | 2025-04-25 | Fix |
| CVE-2025-3870 | 1 Decembrie 1918 WordPress plugin cross-site request forgery to stored cross-site scripting | 6.1CNA v3.1 | 0.3% | 2025-04-25 | |
| CVE-2025-3868 | Custom Admin-Bar Favorites WordPress plugin reflected cross-site scripting | 6.1CNA v3.1 | 0.3% | 2025-04-25 | |
| CVE-2025-3867 | Ajax Comment Form CST WordPress plugin cross-site request forgery to stored cross-site scripting | 6.1CNA v3.1 | 0.3% | 2025-04-25 | |
| CVE-2025-3866 | The Add Google +1 (Plus one) social share Button plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.0. This is due to missing or incorrect nonce validation on the google-plus-one-share-button page. This makes it possible for unauthenticated att | 6.1CNA v3.1 | 0.3% | 2025-04-25 | |
| CVE-2025-3861 | The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access and modification of data| due to a misconfigured capability check on the 'pda_lite_custom_permission_check' function in versions 2.8.6 to 2.8.8.2. This makes it possible for authenticated at | 5.4CNA v3.1 | 0.3% | 2025-04-25 | Fix |
| CVE-2025-3775 | ShopLentor WordPress plugin server-side request forgery | 6.5CNA v3.1 | 0.3% | 2025-04-25 | Fix |
| CVE-2025-3752 | Able Player, accessible HTML5 media player WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-04-25 | Fix |
| CVE-2025-3743 | Upsell Funnel Builder for WooCommerce WordPress plugin unauthenticated order manipulation | 5.3CNA v3.1 | 0.4% | 2025-04-25 | Fix |
| CVE-2025-3647 | Moodle: Idor when accessing the cohorts report | 4.3CNA v3.1 | 0.3% | 2025-04-25 | Fix |
| CVE-2025-3645 | Moodle: Idor in messaging web service allows access to some user details | 4.3CNA v3.1 | 0.4% | 2025-04-25 | Fix |
| CVE-2025-3644 | Moodle: Ajax section delete does not respect course_can_delete_section | 4.3CNA v3.1 | 0.3% | 2025-04-25 | Fix |
| CVE-2025-3643 | Moodle: Reflected XSS risk in policy tool | 5.4CNA v3.1 | 0.3% | 2025-04-25 | Fix |
| CVE-2025-3642 | Moodle: Authenticated remote code execution risk in the Moodle lms equella repository | 8.8CNA v3.1 | 1.0% | 2025-04-25 | Fix |
| CVE-2025-3641 | Moodle: Authenticated remote code execution risk in the Moodle lms dropbox repository | 8.8CNA v3.1 | 1.0% | 2025-04-25 | Fix |
| CVE-2025-3640 | Moodle: Idor in web service allows users enrolled in a course to access some details of other users | 4.3CNA v3.1 | 0.4% | 2025-04-25 | Fix |
| CVE-2025-3638 | Moodle: Csrf risk in brickfield tool's analysis request action | 8.8CISA ADP v3.1 | 0.3% | 2025-04-25 | Fix |
| CVE-2025-3637 | Moodle: Csrf token exposure via URL in Moodle mod_data module | 3.1CNA v3.1 | 0.4% | 2025-04-25 | Fix |
| CVE-2025-3636 | Moodle: Idor in Moodle rss block allows unauthorized access to rss feeds | 4.3CNA v3.1 | 0.3% | 2025-04-25 | Fix |
| CVE-2025-3635 | Moodle: Csrf risk in Moodle user tours manager allows tour duplication | 3.5CNA v3.1 | 0.2% | 2025-04-25 | Fix |
| CVE-2025-3634 | Moodle: Moodle allows course self-enrolment before completing mfa | 4.3CNA v3.1 | 0.3% | 2025-04-25 | Fix |
| CVE-2025-3628 | Moodle: Moodle assignment submission search leaks anonymous student identities | 4.3CNA v3.1 | 0.3% | 2025-04-25 | Fix |
| CVE-2025-3627 | Moodle: Partial data exposure in Moodle before completing multi-factor authentication | 4.3CNA v3.1 | 0.3% | 2025-04-25 | Fix |
| CVE-2025-3625 | Moodle: User DoS and name disclosure via IDOR in Moodle mfa email factor revoke action | 7.1CNA v3.1 | 0.4% | 2025-04-25 | Fix |
| CVE-2025-3606 | Vestel AC Charger exposure of sensitive system information to an unauthorized control sphere | 8.7CNA v4.0 | 0.4% | 2025-04-25 | Fix |
| CVE-2025-3511 | Mitsubishi Electric CC-Link IE TSN Remote I/O module NZ2GN2S1-32D improper input validation | 7.5CNA v3.1 | 0.9% | 2025-04-25 | Fix |
| CVE-2025-2986 | IBM Maximo Asset Management cross-site scripting | 5.5CNA v3.1 | 0.2% | 2025-04-25 | Fix |
| CVE-2025-2580 | Contact Form by Bit Form WordPress plugin stored cross-site scripting | 4.9CNA v3.1 | 0.3% | 2025-04-25 | Fix |
| CVE-2025-2470 | Service Finder Bookings WordPress plugin unauthenticated privilege escalation | 9.8CNA v3.1 | 0.5% | 2025-04-25 | Fix |
| CVE-2025-2238 | Vikinger WordPress theme privilege escalation | 8.8CNA v3.1 | 0.4% | 2025-04-25 | Fix |
| CVE-2025-2185 | ALBEDO Telecom Net.Time PTP/NTP Clock insufficient session expiration | 8.5CNA v4.0 | 0.3% | 2025-04-25 | Fix |
| CVE-2025-2070 | FileZ Client XML external entity injection | 5.1CNA v4.0 | 0.1% | 2025-04-25 | Fix |
| CVE-2025-2069 | FileZ Client cross-site scripting | 5.1CNA v4.0 | 0.2% | 2025-04-25 | Fix |
| CVE-2025-2068 | FileZ Client open redirect | 5.1CNA v4.0 | 0.1% | 2025-04-25 | Fix |
| CVE-2025-1565 | Mayosis Core WordPress plugin unauthenticated arbitrary file read | 7.5CNA v3.1 | 0.6% | 2025-04-25 | Fix |
| CVE-2025-1279 | BM Content Builder WordPress plugin missing authorization authenticated arbitrary options update | 8.8CNA v3.1 | 0.4% | 2025-04-25 | Fix |
| CVE-2025-0671 | Icegram Express template settings stored cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-04-25 | Fix |
| CVE-2025-46542 | Xpert Tab WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46541 | WP-reCAPTCHA-bp WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46540 | GNA Search Shortcode WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46538 | Inline Text Popup WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46536 | Carousel-of-post-images WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46534 | Image Style Hover WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46533 | Landing pages and Domain aliases for WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46532 | Tooltip WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46531 | WP AVCL Automation Helper (formerly WPFlyLeads) WordPress plugin server side request forgery (SSRF) | 4.9CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46530 | Hacklog Remote Attachment WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-04-24 | |
| CVE-2025-46529 | Business Contact Widget WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46528 | Availability Calendar WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.1% | 2025-04-24 | |
| CVE-2025-46525 | WP Cookie Consent WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46524 | WP Filter Post Category WordPress plugin cross-site request forgery (CSRF) to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-04-24 | |
| CVE-2025-46523 | COVID-19 (Coronavirus) Update Your Customers WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46522 | Tabs WordPress plugin cross-site request forgery (CSRF) to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-04-24 | |
| CVE-2025-46521 | WS Force Login Page WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-04-24 | Fix |
| CVE-2025-46520 | Related Posts via Taxonomies WordPress plugin cross-site request forgery (CSRF) to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-04-24 | |
| CVE-2025-46519 | Media Library Downloader WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-04-24 | Fix |
| CVE-2025-46517 | Blog Manager WP WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46516 | Twitter Card Generator WordPress plugin cross-site request forgery (CSRF) to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-04-24 | |
| CVE-2025-46514 | Milat jQuery Automatic Popup WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-04-24 | |
| CVE-2025-46513 | All in One Time Clock Lite WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-04-24 | Fix |
| CVE-2025-46512 | Custom Functions WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.1% | 2025-04-24 | |
| CVE-2025-46511 | BeerXML Shortcode WordPress plugin server side request forgery (SSRF) | 6.4CNA v3.1 | 0.2% | 2025-04-24 | Fix |
| CVE-2025-46510 | Contact Form 7 Calendar WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46509 | 360 View WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46508 | Advanced lazy load WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46507 | Unsafe Mimetypes WordPress plugin cross-site request forgery (CSRF) to stored XSS | 7.1CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46506 | WpZon Amazon Affiliate WordPress plugin CSRF to XSS | 7.1CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46505 | Peekaboo WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46504 | Vasaio QR Code WordPress plugin CSRF to XSS | 7.1CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46503 | Simple Google Photos Grid WordPress plugin server side request forgery (SSRF) | 4.9CNA v3.1 | 0.2% | 2025-04-24 | Fix |
| CVE-2025-46502 | LSD Custom taxonomy and category meta WordPress plugin CSRF to XSS | 7.1CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46501 | Mixcloud Embed WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46499 | PayPal Express Checkout WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46498 | Zalo Official Live Chat WordPress plugin cross-site request forgery (CSRF) | 5.4CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46497 | Navegg Analytics WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46496 | Mini twitter feed WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46495 | tomontoast Drop Caps cross-site request forgery | 6.5CNA v3.1 | 0.1% | 2025-04-24 | |
| CVE-2025-46492 | Pham Thanh Call Now PHT Blog cross-site request forgery | 7.1CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46491 | Multi-Column Taxonomy List WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46489 | Bulk Assign Linked Products For WooCommerce WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46485 | WP Customize Login Page WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46484 | Image Hover Effects For WPBakery Page Builder WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46483 | Peadig’s Google +1 Button WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46481 | Flickr Shortcode Importer WordPress plugin PHP object injection | 7.2CNA v3.1 | 0.6% | 2025-04-24 | |
| CVE-2025-46480 | Nepali Post Date WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46479 | BBCode Deluxe WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46478 | Dropdown Content WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46477 | WP Customize Login Page WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46476 | Awesome Wp Image Gallery WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46475 | Able Player WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-04-24 | Fix |
| CVE-2025-46473 | Social Counter WordPress plugin PHP object injection | 7.2CNA v3.1 | 0.6% | 2025-04-24 | Fix |
| CVE-2025-46472 | The Pack Elementor addons WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46471 | WP Custom Post Popup WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46470 | Smart Hashtags [#hashtagger] WordPress plugin broken access control | 4.3CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46469 | Send From WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-04-24 | Fix |
| CVE-2025-46467 | RAphicon WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46466 | Modern Polls WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46465 | Print Science Designer WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46462 | WPVN WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46461 | RRSSB WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46459 | Confirm User Registration WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46457 | Wp Custom CMS Block WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46453 | WordPress Zoho Creator Forms plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46452 | Google News WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46451 | Floating Social Bar WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46450 | occupancyplan WordPress plugin cross-site request forgery (CSRF) to stored XSS | 7.1CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46449 | WoWHead Tooltips WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46447 | Fable Extra WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-04-24 | Fix |
| CVE-2025-46445 | External Markdown WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46443 | Animate WordPress plugin server side request forgery (SSRF) | 4.9CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46442 | Loan Calculator WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46439 | Plugin Central WordPress plugin CSRF to arbitrary file deletion | 7.4CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46438 | GTDB Guitar Tuners WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-46436 | SCSS-Library WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46435 | Time Based Greeting WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-46421 | libsoup redirect Authorization header handling information disclosure | 6.8CNA v3.1 | 0.6% | 2025-04-24 | Fix |
| CVE-2025-46420 | Red Hat Enterprise Linux 8 libsoup: Memory leak on soup_header_parse_quality_list via soup-headers.c | 6.5CNA v3.1 | 0.6% | 2025-04-24 | Fix |
| CVE-2025-46419 | Westermo WeOS improper syntax validation | 5.9CNA v3.1 | 0.4% | 2025-04-24 | Fix |
| CVE-2025-46417 | Picklescan Vulnerable to Exfiltration via DNS via linecache and ssl.get_server_certificate | 7.5v3.1 | 0.2% | 2025-04-24 | Fix |
| CVE-2025-46275 | PLANET Technology Network Products missing authentication for critical function | 9.3CNA v4.0 | 0.6% | 2025-04-24 | Fix |
| CVE-2025-46274 | PLANET Technology Network Products use of hard-coded credentials | 9.3CNA v4.0 | 0.5% | 2025-04-24 | Fix |
| CVE-2025-46273 | PLANET Technology Network Products use of hard-coded credentials | 9.3CNA v4.0 | 0.6% | 2025-04-24 | Fix |
| CVE-2025-46272 | PLANET Technology Network Products OS command injection | 9.3CNA v4.0 | 1.2% | 2025-04-24 | Fix |
| CVE-2025-46271 | PLANET Technology Network Products OS command injection | 9.3CNA v4.0 | 2.0% | 2025-04-24 | Exploit codeFix |
| CVE-2025-46264 | WordPress PowerPress Podcasting plugin arbitrary file upload | 9.9CNA v3.1 | 0.4% | 2025-04-24 | Fix |
| CVE-2025-46261 | Seriously Simple Podcasting WordPress plugin cross-site scripting (XSS) | 4.8v3.1 | 0.3% | 2025-04-24 | Fix |
| CVE-2025-46260 | Sky Addons for Elementor WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-04-24 | Fix |
| CVE-2025-46248 | Frontend Dashboard WordPress plugin SQL injection | 9.3CNA v3.1 | 0.4% | 2025-04-24 | Fix |
| CVE-2025-46234 | Control Listings WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-04-24 | Fix |
| CVE-2025-46230 | Popup Builder WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.8% | 2025-04-24 | Fix |
| CVE-2025-44135 | code-projects Online Class and Exam Scheduling System SQL injection | 6.5CISA ADP v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-44134 | code-projects Online Class and Exam Scheduling System SQL injection | 6.5CISA ADP v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-43861 | ManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflection | 4.4CNA v3.1 | 0.3% | 2025-04-24 | Fix |
| CVE-2025-43859 | h11 accepts some malformed Chunked-Encoding bodies | 9.1CNA v3.1 | 0.6% | 2025-04-24 | Fix |
| CVE-2025-43858 | YoutubeDLSharp allows command injection on windows system due to non sanitized arguments | 9.2CNA v3.1 | 0.3% | 2025-04-24 | Fix |
| CVE-2025-43855 | tRPC 11 WebSocket DoS | 8.7CNA v4.0 | 0.4% | 2025-04-24 | Fix |
| CVE-2025-41423 | Unauthorized Playbooks Post Deletion in Mattermost Playbooks plugin | 3.1CNA v3.1 | 0.3% | 2025-04-24 | Fix |
| CVE-2025-41395 | Mattermost webapp DoS via malicious retrospective post in Playbooks | 6.5CNA v3.1 | 0.5% | 2025-04-24 | Fix |
| CVE-2025-39408 | BruteGuard Brute Force Login Protection WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-39404 | Sassy Social Share WordPress plugin open redirection | 4.7CNA v3.1 | 0.3% | 2025-04-24 | Fix |
| CVE-2025-39400 | User Registration WordPress plugin reflected cross-site scripting (XSS) | 6.1NVD v3.1 | 0.3% | 2025-04-24 | Fix |
| CVE-2025-39399 | License For Envato WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.7% | 2025-04-24 | Fix |
| CVE-2025-39397 | Anything Popup WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-39391 | Checkout Field Visibility for WooCommerce WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.7% | 2025-04-24 | Fix |
| CVE-2025-39390 | Booking and Rental Manager WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-04-24 | Fix |
| CVE-2025-39387 | Opstore WordPress theme local file inclusion | 7.5CNA v3.1 | 0.7% | 2025-04-24 | |
| CVE-2025-39385 | Sirat WordPress theme broken access control | 4.3CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-39384 | Product Lister for eBay WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.7% | 2025-04-24 | |
| CVE-2025-39383 | Xews Lite WordPress theme local file inclusion | 7.5CNA v3.1 | 0.7% | 2025-04-24 | |
| CVE-2025-39382 | ACF: Google Font Selector WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-39381 | KiotViet Sync WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-39379 | Capturly WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.7% | 2025-04-24 | Fix |
| CVE-2025-39378 | Holest Engineering Spreadsheet Price Changer for WooCommerce and WP E-commerce local file inclusion | 7.5CNA v3.1 | 0.7% | 2025-04-24 | |
| CVE-2025-39377 | Appsero Helper WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2025-04-24 | Fix |
| CVE-2025-39360 | Grace Mag WordPress theme local file inclusion | 7.5CNA v3.1 | 0.7% | 2025-04-24 | |
| CVE-2025-39359 | CWW Portfolio WordPress theme local file inclusion | 7.5CNA v3.1 | 0.7% | 2025-04-24 | |
| CVE-2025-35965 | DoS in Mattermost Playbooks via Excessive Task Actions | 6.5CNA v3.1 | 0.4% | 2025-04-24 | Fix |
| CVE-2025-32921 | Arrival WordPress theme local file inclusion | 7.5CNA v3.1 | 0.7% | 2025-04-24 | |
| CVE-2025-32730 | i-PRO Configuration Tool hard-coded cryptographic key | 6.8CNA v4.0 | 0.2% | 2025-04-24 | |
| CVE-2025-31324 | SAP NetWeaver unrestricted file upload | 10.0CNA v3.1 | 99.5% | 2025-04-24 | KEVNucleiEmerging ThreatsExploit codeKCVFix |
| CVE-2025-30409 | Acronis Cyber Protect Cloud Agent resource exhaustion | 5.5CNA v3.0 | 0.2% | 2025-04-24 | Fix |
| CVE-2025-30408 | Acronis Cyber Protect Cloud Agent incorrect permission assignment | 6.7CNA v3.0 | 0.2% | 2025-04-24 | Fix |
| CVE-2025-29568 | code-projects Online Class and Exam Scheduling System cross-site scripting | 4.8CISA ADP v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-29529 | ITC Systems Multiplan/Matrix OneCard platform Forgotpassword.aspx SQL injection | 6.5CISA ADP v3.1 | 0.3% | 2025-04-24 | Exploit code |
| CVE-2025-27820 | Apache HttpComponents: PSL (Public Suffix List) validation bypass | 7.5CISA ADP v3.1 | 1.0% | 2025-04-24 | Fix |
| CVE-2025-27581 | NIH BRICS forced browsing | 4.3CNA v3.1 | 0.4% | 2025-04-24 | Exploit code |
| CVE-2025-27580 | NIH BRICS improper seeding | 7.5CNA v3.1 | 0.7% | 2025-04-24 | Exploit code |
| CVE-2025-26382 | Johnson Controls Software House iSTAR Configuration Utility (ICU) tool | 9.3CNA v4.0 | 0.6% | 2025-04-24 | Fix |
| CVE-2025-25777 | CodeAstro Bus Ticket Booking System insecure direct object reference | 8.0CISA ADP v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-3872 | Centreon privilege escalation by altering payload in contact form | 7.2CNA v3.1 | 0.4% | 2025-04-24 | Fix |
| CVE-2025-3832 | FuseDesk WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-04-24 | Fix |
| CVE-2025-3793 | Buddypress Force Password Change WordPress plugin account takeover | 4.2CNA v3.1 | 0.2% | 2025-04-24 | |
| CVE-2025-3776 | Verification SMS with TargetSMS WordPress plugin unauthenticated limited remote code execution | 8.3CNA v3.1 | 0.9% | 2025-04-24 | Exploit code |
| CVE-2025-3761 | My Tickets Accessible Event Ticketing WordPress plugin privilege escalation | 8.8CNA v3.1 | 0.4% | 2025-04-24 | Fix |
| CVE-2025-3749 | Breeze Display WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-04-24 | Fix |
| CVE-2025-3607 | Frontend Login and Registration Blocks WordPress plugin privilege escalation | 8.8CNA v3.1 | 0.4% | 2025-04-24 | Fix |
| CVE-2025-3604 | Flynax Bridge WordPress plugin unauthenticated privilege escalation via account takeover | 9.8CNA v3.1 | 0.7% | 2025-04-24 | Exploit codeFix |
| CVE-2025-3603 | Flynax Bridge WordPress plugin unauthenticated privilege escalation via password update | 9.8CNA v3.1 | 0.6% | 2025-04-24 | Fix |
| CVE-2025-3435 | MangBoard WP WordPress plugin stored cross-site scripting | 4.4CNA v3.1 | 0.2% | 2025-04-24 | Fix |
| CVE-2025-3300 | WPMasterToolKit (WPMTK) All in one WordPress plugin to arbitrary file read and write | 7.2CNA v3.1 | 0.9% | 2025-04-24 | Fix |
| CVE-2025-3280 | ELEX WooCommerce Advanced Bulk Edit Products, Prices and Attributes WordPress plugin SQL injection | 6.5CNA v3.1 | 0.4% | 2025-04-24 | Fix |
| CVE-2025-3101 | Configurator Theme Core WordPress plugin authenticated (Subscriber+) privilege escalation | 8.8CNA v3.1 | 0.4% | 2025-04-24 | |
| CVE-2025-3065 | Database Toolset WordPress plugin unauthenticated arbitrary file deletion | 9.1CNA v3.1 | 1.1% | 2025-04-24 | |
| CVE-2025-3058 | Xelion Webchat WordPress plugin authenticated (Subscriber+) arbitrary options update | 8.8CNA v3.1 | 0.5% | 2025-04-24 | Fix |
| CVE-2025-2579 | Lottie Player WordPress plugin authenticated (Author+) stored cross-site scripting via file upload | 6.4CNA v3.1 | 0.3% | 2025-04-24 | Fix |
| CVE-2025-2558 | The Wound WordPress theme unauthenticated LFI | 8.6CISA ADP v3.1 | 2.4% | 2025-04-24 | Nuclei |
| CVE-2025-2543 | Advanced Accordion Gutenberg Block WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-04-24 | Fix |
| CVE-2025-1976 | Broadcom Brocade Fabric OS code injection | 8.6CNA v4.0 | 0.7% | 2025-04-24 | KEVFix |
| CVE-2025-1908 | Business Logic Errors in GitLab | 7.7CNA v3.1 | 0.4% | 2025-04-24 | Fix |
| CVE-2025-1453 | Category Posts Widget WordPress plugin Admin+ stored XSS | 4.8CISA ADP v3.1 | 0.3% | 2025-04-24 | Fix |
| CVE-2025-1294 | eForm WordPress plugin unauthenticated stored cross-site scripting | 7.2CNA v3.1 | 0.4% | 2025-04-24 | Fix |
| CVE-2025-1284 | Woocommerce Automatic Order Printing WordPress plugin insecure direct object reference | 4.3CNA v3.1 | 0.3% | 2025-04-24 | |
| CVE-2025-0639 | Allocation of resources without limits or throttling in GitLab | 6.5CNA v3.1 | 0.5% | 2025-04-24 | Fix |
| CVE-2025-46400 | Xfig: Fig2dev segmentation fault in read_arcobject | 5.5NVD v3.1 | 0.2% | 2025-04-23 | Fix |
| CVE-2025-46399 | Xfig: Transfig: Fig2dev segmentation fault vulnerability | 5.5NVD v3.1 | 0.2% | 2025-04-23 | Fix |
| CVE-2025-46398 | Xfig: Fig2dev stack-overflow via read_objects | 5.5NVD v3.1 | 0.3% | 2025-04-23 | Fix |
| CVE-2025-46397 | Red Hat Enterprise Linux 8 xfig: Xfig: Stack-overflow allows possible code execution | 7.8NVD v3.1 | 0.3% | 2025-04-23 | Fix |
| CVE-2025-46394 | BusyBox UI misrepresentation | 3.3v3.1 | 0.2% | 2025-04-23 | Fix |
| CVE-2025-46393 | ImageMagick incorrect buffer size calculation | 5.3v3.1 | 0.4% | 2025-04-23 | Fix |
| CVE-2025-45429 | Tenda AC9 stack-based buffer overflow | 9.8CISA ADP v3.1 | 1.1% | 2025-04-23 | Emerging Threats |
| CVE-2025-45428 | Tenda AC9 stack-based buffer overflow | 9.8CISA ADP v3.1 | 0.9% | 2025-04-23 | |
| CVE-2025-45427 | Tenda AC9 stack-based buffer overflow | 9.8CISA ADP v3.1 | 0.9% | 2025-04-23 | |
| CVE-2025-43965 | ImageMagick incorrect buffer size calculation | 7.5v3.1 | 0.6% | 2025-04-23 | Fix |
| CVE-2025-43716 | Ivanti LANDesk Management Suite path traversal | 5.8CNA v3.1 | 1.2% | 2025-04-23 | |
| CVE-2025-42605 | Improper access control vulnerability in Meon Bidding Solutions | 9.3CNA v4.0 | 0.5% | 2025-04-23 | Fix |
| CVE-2025-42604 | Detailed Error Response vulnerability in Meon KYC solutions | 6.9CNA v4.0 | 0.5% | 2025-04-23 | Fix |
| CVE-2025-42603 | Information disclosure vulnerability in Meon KYC solutions | 8.7CNA v4.0 | 0.3% | 2025-04-23 | Fix |
| CVE-2025-42602 | Improper authentication vulnerability in Meon KYC solutions | 8.2CNA v4.0 | 0.4% | 2025-04-23 | Fix |
| CVE-2025-42601 | Captcha Bypass vulnerability in Meon KYC solutions | 8.2CNA v4.0 | 0.4% | 2025-04-23 | Fix |
| CVE-2025-42600 | Brute force Attack vulnerability in Meon KYC solutions | 8.2CNA v4.0 | 0.5% | 2025-04-23 | Fix |
| CVE-2025-32969 | XWiki Platform REST API query endpoint SQL injection | 9.3CNA v4.0 | 79.4% | 2025-04-23 | NucleiFix |
| CVE-2025-32968 | xwiki-platform script query API SQL injection | 8.6CNA v4.0 | 0.6% | 2025-04-23 | Fix |
| CVE-2025-32966 | Dataease H2 JDBC Connection remote code execution | 8.2CNA v4.0 | 4.5% | 2025-04-23 | NucleiKCVFix |
| CVE-2025-32818 | SonicWall SonicOS null pointer dereference | 7.5CISA ADP v3.1 | 0.8% | 2025-04-23 | Fix |
| CVE-2025-29526 | Q4 Inc Investor Relations Platform search function cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-04-23 | |
| CVE-2025-28169 | BYD QIN PLUS DM-i Dilink OS cloud broadcast communication improper certificate validation | 8.1CISA ADP v3.1 | 0.3% | 2025-04-23 | |
| CVE-2025-28028 | TOTOLINK A3000RU buffer overflow | 7.3CISA ADP v3.1 | 0.4% | 2025-04-23 | |
| CVE-2025-28025 | TOTOLINK A3000RU buffer overflow | 7.3CISA ADP v3.1 | 0.4% | 2025-04-23 | |
| CVE-2025-28022 | TOTOLINK A810R buffer overflow | 7.3CISA ADP v3.1 | 0.4% | 2025-04-23 | |
| CVE-2025-28021 | TOTOLINK A810R buffer overflow | 7.3CISA ADP v3.1 | 0.4% | 2025-04-23 | |
| CVE-2025-28020 | TOTOLINK A800R buffer overflow | 7.3CISA ADP v3.1 | 0.4% | 2025-04-23 | |
| CVE-2025-28019 | TOTOLINK A800R buffer overflow | 7.3CISA ADP v3.1 | 0.5% | 2025-04-23 | |
| CVE-2025-28018 | TOTOLINK A800R buffer overflow | 7.3CISA ADP v3.1 | 0.4% | 2025-04-23 | |
| CVE-2025-28017 | TOTOLINK A800R command injection | 6.5CISA ADP v3.1 | 1.2% | 2025-04-23 | |
| CVE-2025-25046 | IBM InfoSphere Information Server information disclosure | 3.7CNA v3.1 | 0.2% | 2025-04-23 | Fix |
| CVE-2025-25045 | IBM InfoSphere Information Server information disclosure | 4.3CNA v3.1 | 0.3% | 2025-04-23 | Fix |
| CVE-2025-21605 | Redis DoS vulnerability due to unlimited growth of output buffers abused by unauthenticated client | 7.5CNA v3.1 | 0.9% | 2025-04-23 | Fix |
| CVE-2025-3907 | Search API Solr Moderately critical cross-site request forgery SA-CONTRIB-2025-046 | 4.3CISA ADP v3.1 | 0.2% | 2025-04-23 | Fix |
| CVE-2025-3904 | Sportsleague Critical Unsupported SA-CONTRIB-2025-045 | 7.3CISA ADP v3.1 | 0.3% | 2025-04-23 | |
| CVE-2025-3903 | UEditor 百度编辑器 Critical Unsupported SA-CONTRIB-2025-044 | 7.3CISA ADP v3.1 | 0.4% | 2025-04-23 | |
| CVE-2025-3902 | Block Class Moderately critical cross-site scripting SA-CONTRIB-2025-043 | 6.1CISA ADP v3.1 | 0.2% | 2025-04-23 | Fix |
| CVE-2025-3901 | Bootstrap Site Alert Moderately critical cross-site scripting SA-CONTRIB-2025-042 | 6.1CISA ADP v3.1 | 0.2% | 2025-04-23 | Fix |
| CVE-2025-3900 | Colorbox Moderately critical cross-site scripting SA-CONTRIB-2025-041 | 6.1CISA ADP v3.1 | 0.3% | 2025-04-23 | Fix |
| CVE-2025-3530 | WordPress Simple PayPal Shopping Cart plugin unauthenticated Product Price manipulation | 7.5CNA v3.1 | 0.5% | 2025-04-23 | Fix |
| CVE-2025-3529 | WordPress Simple PayPal Shopping Cart plugin unauthenticated information exposure | 8.2CNA v3.1 | 0.4% | 2025-04-23 | Fix |
| CVE-2025-2773 | BEC Technologies Multiple Routers sys ping command injection remote code execution | 7.2CNA v3.0 | 2.1% | 2025-04-23 | |
| CVE-2025-2772 | BEC Technologies Multiple Routers insufficiently protected credentials information disclosure | 6.5v3.1 | 0.4% | 2025-04-23 | |
| CVE-2025-2771 | BEC Technologies Multiple Routers authentication bypass | 5.3CNA v3.0 | 0.9% | 2025-04-23 | |
| CVE-2025-2770 | BEC Technologies Multiple Routers Cleartext Password Storage information disclosure | 6.5v3.1 | 0.5% | 2025-04-23 | |
| CVE-2025-2769 | Bdrive NetDrive uncontrolled search path element local privilege escalation | 7.8CNA v3.0 | 0.2% | 2025-04-23 | |
| CVE-2025-2768 | Bdrive NetDrive uncontrolled search path element local privilege escalation | 7.8CNA v3.0 | 0.2% | 2025-04-23 | |
| CVE-2025-2767 | Arista NG Firewall User-Agent cross-site scripting remote code execution | 9.6v3.1 | 0.6% | 2025-04-23 | |
| CVE-2025-2765 | CarlinKit CPC200-CCPA Wireless Hotspot hard-coded credentials authentication bypass | 8.8v3.1 | 0.4% | 2025-04-23 | |
| CVE-2025-2764 | CarlinKit CPC200-CCPA update.cgi improper verification of cryptographic signature code execution | 8.0CNA v3.0 | 0.3% | 2025-04-23 | |
| CVE-2025-2763 | CarlinKit CPC200-CCPA improper verification of cryptographic signature code execution | 6.8CNA v3.0 | 0.2% | 2025-04-23 | |
| CVE-2025-2762 | CarlinKit CPC200-CCPA Missing Root of Trust local privilege escalation | 7.8CNA v3.0 | 0.2% | 2025-04-23 | |
| CVE-2025-2761 | GIMP FLI File Parsing out-of-bounds write remote code execution | 7.8v3.1 | 1.9% | 2025-04-23 | Fix |
| CVE-2025-2760 | GIMP XWD File Parsing integer overflow remote code execution | 7.8v3.1 | 18.8% | 2025-04-23 | Fix |
| CVE-2025-2703 | Grafana cross-site scripting | 6.8CNA v3.1 | 16.0% | 2025-04-23 | Fix |
| CVE-2025-2595 | Forced browsing vulnerability in CODESYS Visualization | 5.3CNA v3.1 | 0.5% | 2025-04-23 | Fix |
| CVE-2025-1522 | PostHog database_schema server-side request forgery information disclosure | 6.5NVD v3.1 | 0.6% | 2025-04-23 | |
| CVE-2025-1521 | PostHog slack_incoming_webhook server-side request forgery information disclosure | 6.5NVD v3.1 | 0.7% | 2025-04-23 | |
| CVE-2025-1520 | PostHog ClickHouse Table Functions SQL injection remote code execution | 8.0v3.1 | 0.5% | 2025-04-23 | |
| CVE-2025-1056 | Axis Communications AXIS Camera Station Pro external control of a file path | 6.1CNA v3.1 | 0.2% | 2025-04-23 | Fix |
| CVE-2025-1054 | UiCore Elements Free Elementor widgets and templates WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-04-23 | Fix |
| CVE-2025-1050 | Sonos Era 300 out-of-bounds write remote code execution | 8.8CNA v3.0 | 0.4% | 2025-04-23 | |
| CVE-2025-1049 | Sonos Era 300 heap-based buffer overflow remote code execution | 8.8CNA v3.0 | 0.4% | 2025-04-23 | |
| CVE-2025-1048 | Sonos Era 300 Speaker libsmb2 use-after-free remote code execution | 8.8CNA v3.0 | 0.5% | 2025-04-23 | |
| CVE-2025-1047 | Luxion KeyShot PVS File Parsing access of uninitialized pointer remote code execution | 7.8CNA v3.0 | 0.3% | 2025-04-23 | Fix |
| CVE-2025-1046 | Luxion KeyShot SKP File Parsing use-after-free remote code execution | 7.8CNA v3.0 | 0.3% | 2025-04-23 | Fix |
| CVE-2025-1045 | Luxion KeyShot Viewer KSP File Parsing heap-based buffer overflow remote code execution | 7.8CNA v3.0 | 0.4% | 2025-04-23 | Fix |
| CVE-2025-1021 | Synology DiskStation Manager (DSM) synocopy missing authorization | 7.5CNA v3.1 | 0.5% | 2025-04-23 | Fix |
| CVE-2025-0926 | Axis Communications AXIS Camera Station Pro incorrect permission assignment | 5.9CNA v3.1 | 0.2% | 2025-04-23 | Fix |
| CVE-2025-0618 | Trellix FireEye EDR HX code injection | 6.5CNA v3.1 | 0.7% | 2025-04-23 | |
| CVE-2025-46254 | Visual Composer Website Builder WordPress plugin cross-site scripting (XSS) | 5.4v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-46253 | GutenKit WordPress plugin cross-site scripting (XSS) | 5.4v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-46252 | Message Filter for Contact Form 7 WordPress plugin SQL injection | 7.2v3.1 | 0.4% | 2025-04-22 | Fix |
| CVE-2025-46251 | VikRestaurants Table Reservations and Take-Away WordPress plugin CSRF to stored XSS | 8.8v3.1 | 0.1% | 2025-04-22 | Fix |
| CVE-2025-46250 | Vikas Ratudi VPSUForm stored cross-site scripting | 4.8v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-46249 | Simple calendar for Elementor WordPress plugin cross-site request forgery (CSRF) | 8.8v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-46247 | Appointment Booking Calendar WordPress plugin broken access control | 9.8v3.1 | 0.4% | 2025-04-22 | Fix |
| CVE-2025-46246 | CM Answers WordPress plugin cross-site request forgery (CSRF) | 8.8v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-46245 | CM Ad Changer WordPress plugin cross-site request forgery (CSRF) | 8.8v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-46244 | Advanced Linked Variations for Woocommerce WordPress plugin broken access control | 9.8v3.1 | 0.3% | 2025-04-22 | Fix |
| CVE-2025-46243 | Recover abandoned cart for WooCommerce WordPress plugin cross-site request forgery (CSRF) | 8.8v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-46242 | Watu Quiz WordPress plugin SQL injection | 4.9NVD v3.1 | 0.4% | 2025-04-22 | Fix |
| CVE-2025-46241 | Appointment Booking Calendar WordPress plugin CSRF to SQL injection | 8.8v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-46240 | Simple Download Counter WordPress plugin cross-site scripting (XSS) | 5.4v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-46239 | Theme Switcha WordPress plugin cross-site scripting (XSS) | 5.4v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-46238 | List Last Changes WordPress plugin cross-site scripting (XSS) | 5.4v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-46237 | Link Library WordPress plugin cross-site scripting (XSS) | 5.4v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-46236 | HTML Forms WordPress plugin cross-site scripting (XSS) | 5.4v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-46235 | SKT Blocks Gutenberg based Page Builder WordPress plugin cross-site scripting (XSS) | 5.4v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-46233 | Sirv WordPress plugin cross-site scripting (XSS) | 5.4v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-46232 | Download Alt Text AI WordPress plugin broken access control | 8.8v3.1 | 0.3% | 2025-04-22 | Fix |
| CVE-2025-46231 | affiliate-toolkit WordPress plugin cross-site request forgery (CSRF) | 8.8v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-46229 | Textmetrics WordPress plugin cross-site scripting (XSS) | 4.8v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-46228 | Event post WordPress plugin cross-site scripting (XSS) | 5.4v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-46227 | Custom Related Posts WordPress plugin cross-site scripting (XSS) | 5.4v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-46226 | MPL-Publisher WordPress plugin cross-site scripting (XSS) | 5.4v3.1 | 0.3% | 2025-04-22 | Fix |
| CVE-2025-46225 | Post in page for Elementor WordPress plugin cross-site scripting (XSS) | 5.4v3.1 | 0.3% | 2025-04-22 | Fix |
| CVE-2025-43952 | Mettler Toledo FreeWeight.Net Web Reports Viewer reflected cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-04-22 | |
| CVE-2025-43951 | LabVantage objectname parameter local file inclusion | 9.8CISA ADP v3.1 | 0.5% | 2025-04-22 | |
| CVE-2025-43950 | DPMAdirektPro DLL hijacking | 7.8CISA ADP v3.1 | 0.2% | 2025-04-22 | |
| CVE-2025-43949 | MuM MapEdit SQL injection | 9.8CISA ADP v3.1 | 0.4% | 2025-04-22 | |
| CVE-2025-43948 | Codemers KLIMS sorting parameter code injection | 7.3CISA ADP v3.1 | 0.3% | 2025-04-22 | |
| CVE-2025-43947 | Codemers Klims improper access control | 7.3CISA ADP v3.1 | 0.3% | 2025-04-22 | |
| CVE-2025-43946 | Tcpwave Ddi unrestricted file upload | 9.8CISA ADP v3.1 | 1.0% | 2025-04-22 | |
| CVE-2025-37088 | HPE Cray Data Virtualization Service (DVS) race condition | 6.8CISA ADP v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-37087 | HPE Performance Cluster Manager (HPCM) missing authorization | 9.8CISA ADP v3.1 | 0.4% | 2025-04-22 | |
| CVE-2025-34028 | Commvault Command Center path traversal | 10.0NVD v3.1 | 97.6% | 2025-04-22 | KEVNucleiEmerging ThreatsExploit codeFix |
| CVE-2025-32965 | XRPLF xrpl.js embedded malicious code | 9.3CNA v4.0 | 0.9% | 2025-04-22 | Exploit codeFix |
| CVE-2025-32964 | Miraheze ManageWiki extension management improper authorization | 4.6CNA v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-32963 | Minio Operator uses Kubernetes apiserver audience for AssumeRoleWithWebIdentity STS | 6.9CNA v4.0 | 0.6% | 2025-04-22 | Fix |
| CVE-2025-32961 | cuba-platform jpawebapi XSS in the /download endpoint of the JPA Web API | 6.4CNA v3.1 | 0.3% | 2025-04-22 | Fix |
| CVE-2025-32960 | cuba-platform restapi XSS in the /files endpoint of the Generic REST API | 6.4CNA v3.1 | 0.3% | 2025-04-22 | Fix |
| CVE-2025-32959 | CUBA vulnerable to denial of service (DoS) in the File Storage | 6.5CNA v3.1 | 0.5% | 2025-04-22 | Fix |
| CVE-2025-32952 | jmix-framework jmix io.jmix.localfs:jmix-localfs affected by DoS in the Local File Storage | 6.5CNA v3.1 | 0.7% | 2025-04-22 | Fix |
| CVE-2025-32951 | Io.jmix.rest:jmix-rest allows XSS in the /files endpoint of the Generic REST API | 6.4CNA v3.1 | 0.4% | 2025-04-22 | Fix |
| CVE-2025-32950 | jmix-framework jmix io.jmix.localfs:jmix-localfs has a path traversal in Local File Storage | 6.5CNA v3.1 | 0.7% | 2025-04-22 | Fix |
| CVE-2025-32788 | OctoPrint Authenticated Reverse Proxy page authentication bypass | 4.3CNA v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-31328 | Cross-site request forgery (CSRF) vulnerability in SAP S/4 HANA (Learning Solution) | 4.6CNA v3.1 | 0.1% | 2025-04-22 | Fix |
| CVE-2025-31327 | OData meta-data property entity tampering in SAP Field Logistics | 4.3CNA v3.1 | 0.3% | 2025-04-22 | Fix |
| CVE-2025-29743 | D-Link DIR-816 command injection | 6.5CISA ADP v3.1 | 1.0% | 2025-04-22 | |
| CVE-2025-29621 | Francois Jacquet RosarioSIS Theme configuration content spoofing | 7.3CISA ADP v3.1 | 0.3% | 2025-04-22 | |
| CVE-2025-29547 | Horizondatasys Rollback Rx Pro null pointer dereference | 7.0CISA ADP v3.1 | 0.4% | 2025-04-22 | |
| CVE-2025-29339 | Open5GS reachable assertion | 7.5CISA ADP v3.1 | 0.8% | 2025-04-22 | |
| CVE-2025-28039 | TOTOLINK EX1200T OS command injection | 9.8CISA ADP v3.1 | 1.2% | 2025-04-22 | |
| CVE-2025-28038 | TOTOLINK EX1200T OS command injection | 9.8CISA ADP v3.1 | 1.2% | 2025-04-22 | |
| CVE-2025-28037 | TOTOLINK A950RG OS command injection | 9.8CISA ADP v3.1 | 1.2% | 2025-04-22 | |
| CVE-2025-28036 | TOTOLINK A950RG OS command injection | 9.8CISA ADP v3.1 | 1.3% | 2025-04-22 | |
| CVE-2025-28035 | TOTOLINK A830R OS command injection | 9.8CISA ADP v3.1 | 1.3% | 2025-04-22 | |
| CVE-2025-28034 | TOTOLINK A3000RU OS command injection | 9.8CISA ADP v3.1 | 1.3% | 2025-04-22 | |
| CVE-2025-28033 | TOTOLINK A3000RU stack-based buffer overflow | 7.3CISA ADP v3.1 | 0.4% | 2025-04-22 | |
| CVE-2025-28032 | TOTOLINK A3000RU stack-based buffer overflow | 7.3CISA ADP v3.1 | 0.3% | 2025-04-22 | |
| CVE-2025-28031 | TOTOLINK A810R Firmware hard-coded password | 6.5CISA ADP v3.1 | 0.3% | 2025-04-22 | |
| CVE-2025-28030 | TOTOLINK A810R stack-based buffer overflow | 8.8CISA ADP v3.1 | 0.5% | 2025-04-22 | |
| CVE-2025-28029 | TOTOLINK A3000RU stack-based buffer overflow | 7.3CISA ADP v3.1 | 0.4% | 2025-04-22 | |
| CVE-2025-28027 | TOTOLINK A3000RU stack-based buffer overflow | 7.3CISA ADP v3.1 | 0.4% | 2025-04-22 | |
| CVE-2025-28026 | TOTOLINK A3000RU stack-based buffer overflow | 7.3CISA ADP v3.1 | 0.4% | 2025-04-22 | |
| CVE-2025-28024 | TOTOLINK A810R buffer overflow | 9.8CISA ADP v3.1 | 0.6% | 2025-04-22 | |
| CVE-2025-27907 | IBM WebSphere Application Server server-side request forgery | 4.1CNA v3.1 | 0.3% | 2025-04-22 | Fix |
| CVE-2025-27087 | HPE Cray Operating System (COS) denial of service | 5.5CISA ADP v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-26413 | Apache Kvrocks: The server was crashed by the negative offset | 7.5CISA ADP v3.1 | 0.8% | 2025-04-22 | Fix |
| CVE-2025-26159 | Laravel Starter cross-site scripting (XSS) | 6.1CISA ADP v3.1 | 0.3% | 2025-04-22 | Exploit codeFix |
| CVE-2025-23253 | NVIDIA App hard-coded security constants | 2.5CNA v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-23251 | NVIDIA NeMo Framework code injection | 7.6CNA v3.1 | 0.7% | 2025-04-22 | Fix |
| CVE-2025-23250 | NVIDIA NeMo Framework path traversal | 7.6CNA v3.1 | 0.6% | 2025-04-22 | Fix |
| CVE-2025-23249 | NVIDIA NeMo Framework deserialization of untrusted data | 7.6CNA v3.1 | 0.7% | 2025-04-22 | Fix |
| CVE-2025-23176 | Tecnick improper neutralization of special elements used in an SQL command (SQL injection) | 8.8CNA v3.1 | 0.5% | 2025-04-22 | |
| CVE-2025-23175 | Tecnick Multiple XSS | 6.1CNA v3.1 | 0.2% | 2025-04-22 | |
| CVE-2025-3856 | xxyopen Novel-Plus searchByPage SQL injection | 9.8v3.1 | 0.6% | 2025-04-22 | |
| CVE-2025-3855 | CodeCanyon RISE Ultimate Project Manager Profile Picture save_profile_image resource injection | 5.3CNA v4.0 | 0.5% | 2025-04-22 | Exploit code |
| CVE-2025-3854 | H3C GR-3000AX HTTP POST request aspForm Edit_List_SSID buffer overflow | 8.6CNA v4.0 | 0.5% | 2025-04-22 | Fix |
| CVE-2025-3850 | YXJ2018 SpringBoot-Vue-OnlineExam API improper authentication | 2.7NVD v3.1 | 0.6% | 2025-04-22 | |
| CVE-2025-3849 | YXJ2018 SpringBoot-Vue-OnlineExam studentPWD unverified password change | 6.5v3.1 | 0.4% | 2025-04-22 | |
| CVE-2025-3814 | Tax Switch for WooCommerce WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-04-22 | Fix |
| CVE-2025-3767 | SQL injection in Centreon BAM boolean KPI listing | 7.2CNA v3.1 | 0.4% | 2025-04-22 | Fix |
| CVE-2025-3616 | Greenshift - Authenticated (Subscriber+) arbitrary file upload | 8.8CNA v3.1 | 2.5% | 2025-04-22 | Fix |
| CVE-2025-3577 | Zyxel AMG1302-T10B firmware path traversal | 4.9CNA v3.1 | 12.6% | 2025-04-22 | Emerging Threats |
| CVE-2025-3519 | Unblu Spark replace uploaded files knowing the file upload ID | 7.0CNA v4.0 | 0.3% | 2025-04-22 | |
| CVE-2025-3518 | Unblu Spark file upload functionality possible even when disabled | 4.3v3.1 | 0.2% | 2025-04-22 | |
| CVE-2025-3472 | Ocean Extra WordPress plugin unauthenticated arbitrary shortcode execution | 9.8v3.1 | 1.9% | 2025-04-22 | NucleiFix |
| CVE-2025-3458 | Ocean Extra WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-04-22 | Fix |
| CVE-2025-3457 | Ocean Extra WordPress plugin authenticated (Contributor+) stored cross-site scripting via shortcode | 5.4v3.1 | 0.3% | 2025-04-22 | Fix |
| CVE-2025-2987 | IBM Maximo Asset Management server-side request forgery | 3.8CNA v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-2839 | WP Import Export Lite WordPress plugin DOM-based stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-04-22 | Fix |
| CVE-2025-2594 | User Registration and Membership WordPress plugin authentication bypass | 8.1CISA ADP v3.1 | 9.5% | 2025-04-22 | Exploit codeFix |
| CVE-2025-2300 | Hitachi Ops Center Common Services sensitive information in log files | 5.5CNA v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-2092 | Checkmk remote site authentication secrets written to web log | 7.1CNA v4.0 | 0.3% | 2025-04-22 | Fix |
| CVE-2025-1951 | IBM Hardware Management Console Power Systems command execution | 8.4CNA v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-1950 | IBM Hardware Management Console Power Systems command execution | 9.3CNA v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-1732 | Zyxel USG FLEX H series uOS firmware recovery function of the Zyxel improper privilege management | 6.7CNA v3.1 | 0.2% | 2025-04-22 | Fix |
| CVE-2025-1731 | Zyxel USG FLEX H series uOS firmware incorrect permission assignment | 7.8CNA v3.1 | 0.9% | 2025-04-22 | Exploit codeFix |
| CVE-2025-43973 | GoBGP does not verify that the input length | 9.8v3.1 | 0.5% | 2025-04-21 | Fix |
| CVE-2025-43972 | GoBGP crashes in the flowspec parser | 7.5v3.1 | 0.5% | 2025-04-21 | Fix |
| CVE-2025-43971 | GoBGP panics due to a zero value for softwareVersionLen | 7.5v3.1 | 0.5% | 2025-04-21 | Fix |
| CVE-2025-43970 | GoBGP does not properly check the input length | 5.3v3.1 | 0.4% | 2025-04-21 | Fix |
| CVE-2025-43967 | struktur libheif null pointer dereference | 7.5v3.1 | 0.4% | 2025-04-21 | Fix |
| CVE-2025-43966 | struktur libheif null pointer dereference | 7.5v3.1 | 0.3% | 2025-04-21 | Fix |
| CVE-2025-43964 | LibRaw improper quantity validation | 9.8v3.1 | 0.4% | 2025-04-21 | Fix |
| CVE-2025-43963 | LibRaw out-of-bounds read | 9.1v3.1 | 0.4% | 2025-04-21 | Fix |
| CVE-2025-43962 | LibRaw out-of-bounds read | 9.1v3.1 | 0.4% | 2025-04-21 | Fix |
| CVE-2025-43961 | LibRaw out-of-bounds read | 9.1v3.1 | 0.4% | 2025-04-21 | Fix |
| CVE-2025-43922 | FileWave incorrect authorization | 8.1CNA v3.1 | 0.1% | 2025-04-21 | Fix |
| CVE-2025-43916 | Sonos api.sonos.com hard-coded credentials | 3.4CNA v3.1 | 0.2% | 2025-04-21 | Fix |
| CVE-2025-32958 | Adept exposed the GITHUB_TOKEN in workflow run artifact | 9.8CNA v3.1 | 0.6% | 2025-04-21 | Exploit code |
| CVE-2025-32956 | ManageWiki has SQL injection vulnerability in NamespaceMigrationJob | 8.0CNA v3.1 | 0.7% | 2025-04-21 | Fix |
| CVE-2025-32955 | Harden-Runner Evasion of disable-sudo policy | 6.0CNA v3.1 | 0.2% | 2025-04-21 | Fix |
| CVE-2025-32793 | Cilium packets from terminating endpoints may not be encrypted in Wireguard-enabled clusters | 4.0CNA v3.1 | 0.1% | 2025-04-21 | Fix |
| CVE-2025-32431 | Traefik path matcher middleware bypass path traversal | 8.8CNA v4.0 | 0.9% | 2025-04-21 | Fix |
| CVE-2025-32408 | Soffid IAM incorrect authorization | 2.5CNA v3.1 | 0.1% | 2025-04-21 | Fix |
| CVE-2025-29660 | Yiiot Xy-3820 path traversal | 9.8CISA ADP v3.1 | 1.2% | 2025-04-21 | Emerging ThreatsKCV |
| CVE-2025-29659 | Yiiot Xy-3820 improper authorization | 9.8CISA ADP v3.1 | 1.5% | 2025-04-21 | Emerging ThreatsKCV |
| CVE-2025-29287 | MCMS allows arbitrary file uploads in the ueditor component | 9.8CISA ADP v3.1 | 0.8% | 2025-04-21 | Fix |
| CVE-2025-28367 | Mojoportal path traversal | 6.5CISA ADP v3.1 | 1.9% | 2025-04-21 | Nuclei |
| CVE-2025-28121 | code-projects Online Exam Mastering System cross-site scripting | 6.1CISA ADP v3.1 | 0.9% | 2025-04-21 | Exploit code |
| CVE-2025-28104 | DogukanUrker FlaskBlog improper access control | 9.1CISA ADP v3.1 | 0.4% | 2025-04-21 | |
| CVE-2025-28103 | DogukanUrker FlaskBlog missing authorization | 6.4CISA ADP v3.1 | 0.2% | 2025-04-21 | |
| CVE-2025-28102 | DogukanUrker FlaskBlog cross-site scripting | 6.1CISA ADP v3.1 | 0.2% | 2025-04-21 | |
| CVE-2025-28099 | fumiao opencms path traversal | 4.3CISA ADP v3.1 | 0.4% | 2025-04-21 | |
| CVE-2025-27086 | HPE Performance Cluster Manager (HPCM) improper authentication | 8.1CISA ADP v3.1 | 0.4% | 2025-04-21 | Fix |
| CVE-2025-25228 | Extension VirtueMart.net SQL injection in VirtueMart component for Joomla | 3.8CISA ADP v3.1 | 0.2% | 2025-04-21 | |
| CVE-2025-23174 | Yoel Geva exposure of sensitive information to an unauthorized actor | 7.5CNA v3.1 | 0.4% | 2025-04-21 | |
| CVE-2025-3857 | Infinite loop condition in Amazon.IonDotnet | 8.7CNA v4.0 | 0.6% | 2025-04-21 | Fix |
| CVE-2025-3847 | markparticle WebServer Login httprequest.cpp SQL injection | 9.8v3.1 | 0.5% | 2025-04-21 | |
| CVE-2025-3846 | markparticle WebServer Registration httprequest.cpp SQL injection | 9.8v3.1 | 0.5% | 2025-04-21 | |
| CVE-2025-3845 | markparticle WebServer buffer.cpp HasWritten buffer overflow | 9.8v3.1 | 0.7% | 2025-04-21 | |
| CVE-2025-3843 | panhainan DS-Java cross-site request forgery | 6.5v3.1 | 0.3% | 2025-04-21 | |
| CVE-2025-3842 | panhainan DS-Java FileUpload.java uploadUserPic.action code injection | 9.8v3.1 | 0.7% | 2025-04-21 | |
| CVE-2025-3841 | wix-incubator jam Jinja2 template jam.py special elements used in a template engine | 9.8v3.1 | 0.4% | 2025-04-21 | |
| CVE-2025-3840 | Saviynt OVA based Connect improper neutralization of input during web page generation | 2.1CNA v4.0 | 0.3% | 2025-04-21 | |
| CVE-2025-3838 | Improper authorization in the installer for the EOL OVA based connect component | 6.1CNA v4.0 | 0.1% | 2025-04-21 | |
| CVE-2025-3837 | Improper input validation vulnerability in the End of Life (EOL) OVA based connect component | 6.1CNA v4.0 | 0.3% | 2025-04-21 | |
| CVE-2025-2517 | Reference to Expired Domain vulnerability in OpenText™ ArcSight Enterprise Security Manager | 2.3CNA v4.0 | 0.4% | 2025-04-21 | Fix |
| CVE-2025-2298 | Authenticated API endpoint allows arbitrary file deletion in Dremio Software | 8.4CNA v4.0 | 0.3% | 2025-04-21 | Fix |
| CVE-2025-0632 | Formulatrix Rock Maker Web local file inclusion (LFI) leading to sensitive data exposure | 9.2CNA v4.0 | 0.9% | 2025-04-21 | |
| CVE-2025-43955 | Convertigo exposed dangerous method | 6.8v3.1 | 0.3% | 2025-04-20 | Fix |
| CVE-2025-43954 | QMarkdown cross-site scripting (XSS) | 6.1v3.1 | 0.2% | 2025-04-20 | Fix |
| CVE-2025-43929 | kitty origin validation error | 7.8v3.1 | 0.2% | 2025-04-20 | Exploit codeFix |
| CVE-2025-43928 | Infodraw Media Relay Service path traversal | 9.8v3.1 | 0.9% | 2025-04-20 | |
| CVE-2025-43921 | GNU Mailman incorrect authorization | 5.3v3.1 | 0.4% | 2025-04-20 | Exploit code |
| CVE-2025-43920 | GNU Mailman OS command injection | 8.1v3.1 | 0.6% | 2025-04-20 | Exploit code |
| CVE-2025-43919 | GNU Mailman path traversal | 7.5v3.1 | 1.3% | 2025-04-20 | Exploit code |
| CVE-2025-3830 | kuangstudy KuangSimpleBBS QuestionController.java fileUpload unrestricted upload | 9.8v3.1 | 0.5% | 2025-04-20 | |
| CVE-2025-3829 | PHPGurukul Men Salon Management System sales-reports-detail.php SQL injection | 9.8v3.1 | 0.6% | 2025-04-20 | |
| CVE-2025-3828 | PHPGurukul Men Salon Management System view-appointment.php SQL injection | 9.8v3.1 | 0.6% | 2025-04-20 | |
| CVE-2025-3827 | PHPGurukul Men Salon Management System forgot-password.php SQL injection | 9.8v3.1 | 0.6% | 2025-04-20 | |
| CVE-2025-3826 | SourceCodester Web-based Pharmacy Product Management System add-supplier.php cross-site scripting | 4.1v3.1 | 0.4% | 2025-04-20 | |
| CVE-2025-3825 | SourceCodester Web-based Pharmacy Product Management System add-category.php cross-site scripting | 4.1v3.1 | 0.4% | 2025-04-20 | |
| CVE-2025-3824 | SourceCodester Web-based Pharmacy Product Management System add-product.php cross-site scripting | 4.1v3.1 | 0.4% | 2025-04-20 | |
| CVE-2025-3823 | SourceCodester Web-based Pharmacy Product Management System add-stock.php cross-site scripting | 4.1v3.1 | 0.4% | 2025-04-20 | |
| CVE-2025-3822 | SourceCodester Web-based Pharmacy Product Management System changepassword.php cross-site scripting | 5.4v3.1 | 0.5% | 2025-04-20 | |
| CVE-2025-3821 | SourceCodester Web-based Pharmacy Product Management System add-admin.php cross-site scripting | 5.4v3.1 | 0.4% | 2025-04-20 | |
| CVE-2025-43918 | SSL.com use of a less trusted source | 6.4CNA v3.1 | 0.1% | 2025-04-19 | Fix |
| CVE-2025-43917 | Pritunl-Client incorrect authorization | 8.2CNA v3.1 | 0.2% | 2025-04-19 | Fix |
| CVE-2025-3820 | Tenda W12/i24 httpd cgiSysUplinkCheckSet stack-based overflow | 8.7CNA v4.0 | 12.7% | 2025-04-19 | Emerging Threats |
| CVE-2025-3819 | PHPGurukul Men Salon Management System search-appointment.php SQL injection | 9.8v3.1 | 0.6% | 2025-04-19 | |
| CVE-2025-3818 | webpy web.py db.py PostgresDB._process_insert_query SQL injection | 5.3CNA v4.0 | 0.3% | 2025-04-19 | Fix |
| CVE-2025-3817 | SourceCodester Online Eyewear Shop Master.php SQL injection | 8.8v3.1 | 0.5% | 2025-04-19 | |
| CVE-2025-3816 | westboy CicadasCMS Scheduled Task save os command injection | 7.2v3.1 | 6.2% | 2025-04-19 | |
| CVE-2025-3809 | Debug Log Manager WordPress plugin unauthenticated stored cross-site scripting | 7.2CNA v3.1 | 0.3% | 2025-04-19 | Fix |
| CVE-2025-3808 | zhenfeng13 My-BBS cross-site request forgery | 6.5v3.1 | 0.3% | 2025-04-19 | |
| CVE-2025-3807 | zhenfeng13 My-BBS Endpoint UploadController.java upload unrestricted upload | 9.8v3.1 | 0.5% | 2025-04-19 | |
| CVE-2025-3806 | dazhouda lecms Edit Profile admin cross-site scripting | 4.8CNA v4.0 | 0.3% | 2025-04-19 | |
| CVE-2025-3805 | sarrionandia tournatrack Jinja2 template check_id.py injection | 4.8CNA v4.0 | 0.2% | 2025-04-19 | |
| CVE-2025-3804 | thautwarm vscode-diana Jinja2 Template Gen.py injection | 4.8CNA v4.0 | 0.2% | 2025-04-19 | |
| CVE-2025-3803 | Tenda W12/i24 httpd cgiSysScheduleRebootSet stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-04-19 | Emerging Threats |
| CVE-2025-3802 | Tenda W12/i24 httpd cgiPingSet stack-based overflow | 8.7CNA v4.0 | 1.1% | 2025-04-19 | |
| CVE-2025-3801 | songquanpeng one-api System setting cross-site scripting | 4.8CNA v4.0 | 0.3% | 2025-04-19 | |
| CVE-2025-3800 | Wcms AnonymousController.php SQL injection | 9.8v3.1 | 0.6% | 2025-04-19 | |
| CVE-2025-3799 | Wcms AnonymousController.php SQL injection | 9.8v3.1 | 0.5% | 2025-04-19 | |
| CVE-2025-3798 | Wcms Advertisement Image AdvadminController.php sub unrestricted upload | 7.2v3.1 | 0.5% | 2025-04-19 | |
| CVE-2025-3797 | SeaCMS admin_topic.php SQL injection | 7.2v3.1 | 0.5% | 2025-04-19 | |
| CVE-2025-3661 | SB Chart block WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-04-19 | Fix |
| CVE-2025-3404 | Download Manager WordPress plugin authenticated (Author+) arbitrary file deletion | 8.8CNA v3.1 | 1.1% | 2025-04-19 | Fix |
| CVE-2025-3284 | User Registration and Membership WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.2% | 2025-04-19 | Fix |
| CVE-2025-3278 | UrbanGo Membership WordPress plugin unauthenticated privilege escalation | 9.8CNA v3.1 | 0.6% | 2025-04-19 | Fix |
| CVE-2025-3275 | Themesflat Addons For Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-04-19 | Fix |
| CVE-2025-3103 | CLEVER WordPress plugin arbitrary file read | 7.5CNA v3.1 | 0.4% | 2025-04-19 | Fix |
| CVE-2025-2111 | WP Headers And Footers WordPress plugin cross-site request forgery to arbitrary options update | 7.5CNA v3.1 | 0.2% | 2025-04-19 | Fix |
| CVE-2025-2010 | JobWP WordPress plugin SQL injection | 7.5CNA v3.1 | 1.8% | 2025-04-19 | NucleiFix |
| CVE-2025-1457 | Element Pack Elementor Addons WordPress plugin DOM-based stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-04-19 | Fix |
| CVE-2025-1093 | LiquidThemes AI Hub generate_image function arbitrary file upload | 9.8CNA v3.1 | 1.0% | 2025-04-19 | Fix |
| CVE-2025-43903 | Freedesktop Poppler improper signature verification | 3.3NVD v3.1 | 0.1% | 2025-04-18 | Fix |
| CVE-2025-42599 | Qualitia Active! Mail stack-based buffer overflow | 9.8v3.1 | 3.3% | 2025-04-18 | KEVFix |
| CVE-2025-40364 | Linux kernel io_uring provided buffers vulnerability | 7.8CNA v3.1 | 0.3% | 2025-04-18 | Fix |
| CVE-2025-40325 | Linux kernel RAID10 discard handling vulnerability | 5.5NVD v3.1 | 0.2% | 2025-04-18 | Fix |
| CVE-2025-40114 | Linux kernel veml6075 light sensor driver out-of-bounds read | 7.8v3.1 | 0.2% | 2025-04-18 | Fix |
| CVE-2025-40014 | Linux kernel AMD SPI driver vulnerability | 7.8v3.1 | 0.2% | 2025-04-18 | Fix |
| CVE-2025-39989 | Linux kernel x86/mce memory leak | 5.5v3.1 | 0.2% | 2025-04-18 | Fix |
| CVE-2025-39930 | Linux kernel ASoC simple-card-utils driver vulnerability | 8.4CNA v3.1 | 0.3% | 2025-04-18 | Fix |
| CVE-2025-39778 | Linux kernel out-of-bounds read | 7.1v3.1 | 0.2% | 2025-04-18 | Fix |
| CVE-2025-39755 | Linux kernel cb7210 PCMCIA GPIB driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-04-18 | Fix |
| CVE-2025-39735 | Linux kernel JFS extended attribute handling out-of-bounds read | 7.1CNA v3.1 | 0.3% | 2025-04-18 | Fix |
| CVE-2025-39728 | Linux kernel Samsung clock driver vulnerability | 5.5v3.1 | 0.3% | 2025-04-18 | Fix |
| CVE-2025-39688 | Linux kernel NFS server stateid lookup vulnerability | 7.5CNA v3.1 | 0.6% | 2025-04-18 | Fix |
| CVE-2025-39471 | Modal Survey WordPress plugin SQL injection | 9.3CNA v3.1 | 0.4% | 2025-04-18 | |
| CVE-2025-39470 | Ivy School WordPress theme local file inclusion | 8.1CNA v3.1 | 0.7% | 2025-04-18 | Fix |
| CVE-2025-39469 | Modal Survey WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-04-18 | |
| CVE-2025-38637 | Linux kernel SKBPRIO queuing discipline reachable assertion | 5.5v3.1 | 0.3% | 2025-04-18 | Fix |
| CVE-2025-38575 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: use aead_request_free to match aead_request_alloc Use aead_request_free() instead of kfree() to properly free memory allocated by aead_request_alloc(). This ensures sensitive crypto data is zeroed before being freed. | 5.5v3.1 | 0.3% | 2025-04-18 | Fix |
| CVE-2025-38479 | In the Linux kernel, the following vulnerability has been resolved: dmaengine: fsl-edma: free irq correctly in remove path Add fsl_edma->txirq/errirq check to avoid below warning because no errirq at i.MX9 platform. Otherwise there will be kernel dump: WARNING: CPU: 0 PID: 11 at kernel/irq/devres. | 7.8v3.1 | 0.3% | 2025-04-18 | Fix |
| CVE-2025-38240 | Linux kernel dp null pointer dereference | 5.5v3.1 | 0.3% | 2025-04-18 | Fix |
| CVE-2025-38152 | Linux kernel remoteproc resource table handling null pointer dereference | 5.5v3.1 | 0.3% | 2025-04-18 | Fix |
| CVE-2025-38104 | Linux kernel drm/amdgpu race condition | 4.7v3.1 | 0.2% | 2025-04-18 | Fix |
| CVE-2025-38049 | Linux kernel x86 resctrl CLOSID allocation null pointer dereference | 5.5v3.1 | 0.3% | 2025-04-18 | Fix |
| CVE-2025-37925 | Linux kernel JFS filesystem inode handling vulnerability | 5.5v3.1 | 0.3% | 2025-04-18 | Fix |
| CVE-2025-37893 | Linux kernel LoongArch BPF JIT compiler off-by-one error | 7.8CNA v3.1 | 0.3% | 2025-04-18 | Fix |
| CVE-2025-37860 | Linux kernel sfc null pointer dereference | 5.5NVD v3.1 | 0.3% | 2025-04-18 | Fix |
| CVE-2025-37838 | Linux kernel ssi_protocol driver use-after-free | 7.8CNA v3.1 | 0.2% | 2025-04-18 | Fix |
| CVE-2025-37785 | Linux kernel ext4 directory entry validation out-of-bounds read | 7.8CNA v3.1 | 0.3% | 2025-04-18 | Fix |
| CVE-2025-36625 | Tenable Nessus log injection | 4.3CNA v3.1 | 0.3% | 2025-04-18 | Fix |
| CVE-2025-32953 | z80pack vulnerable to Exposure of the GITHUB_TOKEN in Workflow Run Artifact | 8.7CNA v3.1 | 0.5% | 2025-04-18 | |
| CVE-2025-32796 | Dify allows Unauthorized APP Enable/Disable via API | 6.5CNA v3.1 | 0.4% | 2025-04-18 | Fix |
| CVE-2025-32795 | Dify allows Insecure User Role Access Control for APP Editing | 6.5CNA v3.1 | 0.3% | 2025-04-18 | Fix |
| CVE-2025-32792 | endojs endo ses's global contour bindings leak into Compartment lexical scope | 8.7CNA v4.0 | 0.6% | 2025-04-18 | Fix |
| CVE-2025-32790 | Dify allows Insecure User Role Access Control for APP DSL Exporting | 6.3CNA v3.1 | 0.3% | 2025-04-18 | Fix |
| CVE-2025-32442 | Fastify vulnerable to invalid content-type parsing, which could lead to validation bypass | 7.5CNA v3.1 | 0.7% | 2025-04-18 | Fix |
| CVE-2025-32434 | PyTorch: `torch.load` with `weights_only=True` leads to remote code execution | 9.3CNA v4.0 | 2.4% | 2025-04-18 | Exploit codeFix |
| CVE-2025-32389 | NamelessMC vulnerable to SQL Injections in /user/messaging and /panel/users/reports pages | 8.6CNA v4.0 | 0.5% | 2025-04-18 | Fix |
| CVE-2025-32377 | RasaHQ rasa-pro-security-advisories Rasa Pro missing authentication for Voice Connector APIs | 6.5CNA v3.1 | 0.5% | 2025-04-18 | Fix |
| CVE-2025-31120 | NamelessMC vulnerable to Cookie-Based View Count Manipulation | 5.3CNA v3.1 | 0.5% | 2025-04-18 | Fix |
| CVE-2025-31118 | NamelessMC has Forum Reply Submission Time Limit Bypass | 7.1CNA v3.1 | 0.5% | 2025-04-18 | Fix |
| CVE-2025-30357 | NamelessMC Forum Topic Deletion Triggered by Unrelated User Deletion | 7.3CNA v3.1 | 0.5% | 2025-04-18 | Fix |
| CVE-2025-30158 | NamelessMC Forum iframe width/height abuse causing UI-based denial of service | 7.1CNA v3.1 | 0.5% | 2025-04-18 | Fix |
| CVE-2025-29953 | Apache ActiveMQ NMS OpenWire Client: Deserialization allowlist bypass | 9.8CISA ADP v3.1 | 2.1% | 2025-04-18 | Fix |
| CVE-2025-29784 | NamelessMC has lack of Length Validation for s parameter in GET requests | 7.5CNA v3.1 | 0.6% | 2025-04-18 | Fix |
| CVE-2025-29625 | Astrolog buffer overflow | 7.8CISA ADP v3.1 | 0.3% | 2025-04-18 | |
| CVE-2025-29513 | NodeBB cross-site scripting | 6.1CISA ADP v3.1 | 42.8% | 2025-04-18 | |
| CVE-2025-29512 | NodeBB cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-04-18 | |
| CVE-2025-29209 | TOTOLINK X18 command injection | 9.8CISA ADP v3.1 | 1.2% | 2025-04-18 | |
| CVE-2025-29058 | Qimou Cms code injection | 9.8CISA ADP v3.1 | 0.8% | 2025-04-18 | |
| CVE-2025-28355 | personal-management-system cross-site request forgery | 4.7CISA ADP v3.1 | 0.2% | 2025-04-18 | Exploit code |
| CVE-2025-28242 | DAEnetIP4 METO /login_ok.htm endpoint session fixation | 9.8CISA ADP v3.1 | 1.8% | 2025-04-18 | Nuclei |
| CVE-2025-28238 | Elber REBLE310 session fixation | 9.8CISA ADP v3.1 | 0.4% | 2025-04-18 | |
| CVE-2025-28237 | WorldCast Systems ECRESO FM/DAB/TV Transmitter improper privilege management | 8.8CISA ADP v3.1 | 0.4% | 2025-04-18 | |
| CVE-2025-28236 | Nautel VX Series transmitters firmware update process remote code execution | 9.8CISA ADP v3.1 | 0.4% | 2025-04-18 | |
| CVE-2025-28235 | Soundcraft Ui Series /socket.io/1/websocket/ endpoint information disclosure | 7.5CISA ADP v3.1 | 0.4% | 2025-04-18 | |
| CVE-2025-28233 | Incorrect access control in BW Broadcast TX600 (14980), TX300 (32990) (31448), TX150, TX1000, TX30, and TX50 Hardware Version: 2, Software Version: 1.6.0, Control Version: 1.0, AIO Firmware Version: 1.7 allows attackers to access log files and extract session identifiers to execute a session hijacki | 9.1CISA ADP v3.1 | 0.4% | 2025-04-18 | |
| CVE-2025-28232 | Jmbroadcast JMB0150 Firmware improper access control | 9.1CISA ADP v3.1 | 0.6% | 2025-04-18 | |
| CVE-2025-28231 | Itel Electronics IP Stream improper access control | 9.1CISA ADP v3.1 | 0.4% | 2025-04-18 | |
| CVE-2025-28230 | Jmbroadcast JMB0150 Firmware hard-coded credentials | 9.1CISA ADP v3.1 | 0.5% | 2025-04-18 | |
| CVE-2025-28229 | Orban Optimod 5950 Firmware authentication bypass | 9.8CISA ADP v3.1 | 0.8% | 2025-04-18 | |
| CVE-2025-28228 | Electrolink Fm/dab/tv Transmitter Web Management System information disclosure | 7.5CISA ADP v3.1 | 1.8% | 2025-04-18 | Nuclei |
| CVE-2025-28197 | Kidocode crawl4ai server-side request forgery | 9.1CISA ADP v3.1 | 0.4% | 2025-04-18 | |
| CVE-2025-28059 | Nagios Network Analyzer insufficient session expiration | 7.5CISA ADP v3.1 | 0.8% | 2025-04-18 | Fix |
| CVE-2025-27599 | Element X Android intent handling improper input validation | 6.5CNA v3.1 | 0.4% | 2025-04-18 | Fix |
| CVE-2025-25985 | Macro-video V380E6 C1 plaintext password storage | 2.6CISA ADP v3.1 | 0.3% | 2025-04-18 | |
| CVE-2025-25984 | Macro-video V380E6 C1 hard-coded password | 6.8CISA ADP v3.1 | 0.4% | 2025-04-18 | |
| CVE-2025-25983 | Macro-video V380 Pro recoverable password storage | 3.4CISA ADP v3.1 | 0.3% | 2025-04-18 | |
| CVE-2025-25427 | XSS in TP-Link TL-WR841N v14/v14.6/v14.8 Upnp page | 8.6CNA v4.0 | 0.6% | 2025-04-18 | Fix |
| CVE-2025-24914 | Tenable Nessus Local Priviledge Escalation | 7.8CNA v3.1 | 0.2% | 2025-04-18 | Fix |
| CVE-2025-3796 | PHPGurukul Men Salon Management System contact-us.php SQL injection | 8.8v3.1 | 0.5% | 2025-04-18 | |
| CVE-2025-3795 | DaiCuo SEO Optimization Settings Section cross-site scripting | 3.4NVD v3.1 | 0.4% | 2025-04-18 | |
| CVE-2025-3792 | SeaCMS admin_link.php SQL injection | 7.2v3.1 | 0.7% | 2025-04-18 | |
| CVE-2025-3791 | symisc UnQLite UnQLite.c jx9MemObjStore heap-based overflow | 4.8CNA v4.0 | 0.2% | 2025-04-18 | |
| CVE-2025-3790 | baseweb JSite Apache Druid Monitoring console index.html access control | 6.9CNA v4.0 | 0.8% | 2025-04-18 | |
| CVE-2025-3789 | baseweb JSite save cross-site scripting | 5.4v3.1 | 0.4% | 2025-04-18 | |
| CVE-2025-3788 | baseweb JSite save cross-site scripting | 5.4v3.1 | 0.4% | 2025-04-18 | |
| CVE-2025-3787 | PbootCMS Image server-side request forgery | 6.5v3.1 | 0.5% | 2025-04-18 | |
| CVE-2025-3786 | Tenda AC15 WifiExtraSet fromSetWirelessRepeat buffer overflow | 8.8v3.1 | 1.1% | 2025-04-18 | |
| CVE-2025-3785 | D-Link DWR-M961 Authorization interface formStaticDHCP stack-based overflow | 8.7CNA v4.0 | 12.8% | 2025-04-18 | Emerging Threats |
| CVE-2025-3783 | SourceCodester Web-based Pharmacy Product Management System add-product.php unrestricted upload | 9.8v3.1 | 1.0% | 2025-04-18 | |
| CVE-2025-3598 | Coupon Affiliates Affiliate Plugin for WooCommerce WordPress plugin reflected cross-site scripting | 6.1CNA v3.1 | 0.4% | 2025-04-18 | Fix |
| CVE-2025-3520 | Avatar WordPress plugin authenticated (Subscriber+) arbitrary file deletion | 8.1CNA v3.1 | 1.0% | 2025-04-18 | |
| CVE-2025-3106 | LA-Studio Element Kit for Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.4% | 2025-04-18 | Fix |
| CVE-2025-3056 | Download Manager WordPress plugin stored cross-site scripting | 5.4CNA v3.1 | 0.4% | 2025-04-18 | Fix |
| CVE-2025-2950 | IBM i improper HTTP header neutralization | 5.4CNA v3.1 | 0.3% | 2025-04-18 | Fix |
| CVE-2025-2613 | Login Manager WordPress plugin stored cross-site scripting | 4.4CNA v3.1 | 0.2% | 2025-04-18 | |
| CVE-2025-2492 | ASUS Router AiCloud improper authentication | 9.2CNA v4.0 | 1.1% | 2025-04-18 | Reported exploitedExploit codeKCVFix |
| CVE-2025-2162 | MapPress Maps for WordPress plugin Admin+ stored XSS | 4.8CISA ADP v3.1 | 0.4% | 2025-04-18 | Fix |
| CVE-2025-1863 | Yokogawa Electric GX10 / GX20 / GP10 / GP20 Paperless Recorders insecure default configuration | 9.8CNA v3.1 | 0.7% | 2025-04-18 | |
| CVE-2025-1697 | HP Touchpoint Analytics Service potential escalation of privilege | 6.9CNA v4.0 | 0.2% | 2025-04-18 | Fix |
| CVE-2025-0467 | GPU Ddk rgxfw_hwperf_get_packet_buffer OOB write | 8.2CISA ADP v3.1 | 0.2% | 2025-04-18 | Fix |
| CVE-2025-43717 | PEAR HTTP_Request2 vulnerable to cross-site scripting | 5.4CNA v3.1 | 0.3% | 2025-04-17 | Fix |
| CVE-2025-43715 | Nullsoft Scriptable Install System improper check for exceptional conditions | 8.1CNA v3.1 | 0.2% | 2025-04-17 | Fix |
| CVE-2025-43708 | VisiCut uncontrolled recursion | 7.5v3.1 | 0.4% | 2025-04-17 | |
| CVE-2025-43015 | JetBrains RubyMine insecure default initialization | 8.3CNA v3.1 | 0.3% | 2025-04-17 | Fix |
| CVE-2025-43014 | JetBrains Toolbox App missing authentication step | 6.1CNA v3.1 | 0.2% | 2025-04-17 | Fix |
| CVE-2025-43013 | JetBrains Toolbox App cleartext transmission of sensitive information | 6.9CNA v3.1 | 0.2% | 2025-04-17 | Fix |
| CVE-2025-43012 | JetBrains Toolbox App command injection | 8.3CNA v3.1 | 0.6% | 2025-04-17 | Fix |
| CVE-2025-42921 | JetBrains Toolbox App improper certificate host validation | 4.2CNA v3.1 | 0.2% | 2025-04-17 | Fix |
| CVE-2025-39596 | Quentn WP WordPress plugin privilege escalation | 9.8CNA v3.1 | 0.6% | 2025-04-17 | Exploit codeFix |
| CVE-2025-39595 | Quentn WP WordPress plugin SQL injection | 9.3CNA v3.1 | 0.4% | 2025-04-17 | Fix |
| CVE-2025-39594 | Arigato Autoresponder and Newsletter WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-04-17 | Fix |
| CVE-2025-39588 | Ultimate Store Kit Elementor Addons WordPress plugin deserialization of untrusted data | 9.8CNA v3.1 | 0.5% | 2025-04-17 | Fix |
| CVE-2025-39587 | Cost Calculator Builder WordPress plugin SQL injection | 9.3CNA v3.1 | 0.4% | 2025-04-17 | Fix |
| CVE-2025-39586 | ProfileGrid WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2025-04-17 | Fix |
| CVE-2025-39583 | BERTHA AI WordPress plugin arbitrary content deletion vulnerability | 7.1CNA v3.1 | 0.3% | 2025-04-17 | Fix |
| CVE-2025-39580 | Dashi WordPress plugin broken access control | 5.8CNA v3.1 | 0.3% | 2025-04-17 | Fix |
| CVE-2025-39569 | Taskbuilder WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2025-04-17 | Fix |
| CVE-2025-39568 | StoreContrl Woocommerce WordPress plugin arbitrary file download | 7.5CNA v3.1 | 0.5% | 2025-04-17 | Fix |
| CVE-2025-39567 | Web Directory Free WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-04-17 | Fix |
| CVE-2025-39562 | Payment Form for PayPal Pro WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-04-17 | Fix |
| CVE-2025-39559 | Bring Fraktguiden for WooCommerce WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2025-04-17 | Fix |
| CVE-2025-39558 | CRM Perks WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-04-17 | Fix |
| CVE-2025-39554 | AI Text to Speech WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2025-04-17 | Fix |
| CVE-2025-39551 | FluentBoards WordPress plugin PHP object injection | 9.8CNA v3.1 | 0.5% | 2025-04-17 | Fix |
| CVE-2025-39550 | FluentCommunity WordPress plugin PHP object injection | 9.8CNA v3.1 | 0.5% | 2025-04-17 | Fix |
| CVE-2025-39542 | Xelion Webchat WordPress plugin privilege escalation | 8.8CNA v3.1 | 0.4% | 2025-04-17 | Fix |
| CVE-2025-39535 | Vitepos WordPress plugin broken authentication | 7.2CNA v3.1 | 0.5% | 2025-04-17 | Fix |
| CVE-2025-39533 | Starfish Review Generation and Marketing WordPress plugin privilege escalation | 8.8CNA v3.1 | 0.4% | 2025-04-17 | Fix |
| CVE-2025-39532 | Spice Blocks WordPress plugin broken access control | 7.5CNA v3.1 | 0.4% | 2025-04-17 | |
| CVE-2025-39527 | Rating by BestWebSoft WordPress plugin PHP object injection | 8.8CNA v3.1 | 0.5% | 2025-04-17 | |
| CVE-2025-39526 | Hotel Booking WordPress plugin local file inclusion | 8.1CNA v3.1 | 0.7% | 2025-04-17 | Fix |
| CVE-2025-39521 | Contact Form vCard Generator WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-04-17 | |
| CVE-2025-39519 | Bulk Page Stub Creator WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-04-17 | Fix |
| CVE-2025-39464 | AdminQuickbar WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-04-17 | Fix |
| CVE-2025-39462 | Smart Agreements WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.7% | 2025-04-17 | Fix |
| CVE-2025-39461 | Docket Cache WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.7% | 2025-04-17 | Fix |
| CVE-2025-39457 | Booking and Rental Manager WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-04-17 | Fix |
| CVE-2025-39456 | WP Logger WordPress plugin broken access control | 5.4CNA v3.1 | 0.3% | 2025-04-17 | Fix |
| CVE-2025-39455 | IP2Location Variables WordPress plugin CSRF to cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-04-17 | Fix |
| CVE-2025-39453 | Advanced Dynamic Pricing for WooCommerce WordPress plugin algol.plus cross-site request forgery | 4.3CNA v3.1 | 0.2% | 2025-04-17 | Fix |
| CVE-2025-39452 | WPCafe WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.8% | 2025-04-17 | Fix |
| CVE-2025-39444 | MaxButtons WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-04-17 | Fix |
| CVE-2025-39443 | Verge3D WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-04-17 | Fix |
| CVE-2025-39442 | Review Wave Google Places Reviews WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.2% | 2025-04-17 | |
| CVE-2025-39441 | Dashboard Notepads WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.2% | 2025-04-17 | |
| CVE-2025-39440 | Broken Links Remover WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.2% | 2025-04-17 | |
| CVE-2025-39439 | wpLike2Get WordPress plugin sensitive data exposure | 5.3CNA v3.1 | 0.4% | 2025-04-17 | |
| CVE-2025-39438 | Theme Changer WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-04-17 | Fix |
| CVE-2025-39437 | Anthologize WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-04-17 | |
| CVE-2025-39436 | WordPress I Draw plugin arbitrary file upload | 9.1CNA v3.1 | 0.7% | 2025-04-17 | Exploit code |
| CVE-2025-39435 | My Marginalia WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.2% | 2025-04-17 | |
| CVE-2025-39434 | Avatar WordPress plugin insecure direct object references (IDOR) | 4.3CNA v3.1 | 0.3% | 2025-04-17 | |
| CVE-2025-39433 | Bknewsticker WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.2% | 2025-04-17 | |
| CVE-2025-39432 | bbPress2 shortcode whitelist WordPress plugin CSRF to XSS | 7.1CNA v3.1 | 0.3% | 2025-04-17 | |
| CVE-2025-39431 | Amazon Showcase WordPress plugin CSRF to XSS | 7.1CNA v3.1 | 0.2% | 2025-04-17 | |
| CVE-2025-39430 | mLanguage WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.2% | 2025-04-17 | |
| CVE-2025-39429 | WordPress Széchenyi 2020 Logo plugin local file inclusion | 7.5CNA v3.1 | 0.7% | 2025-04-17 | Fix |
| CVE-2025-39428 | Gravity Forms CSS Themes with Fontawesome and Placeholders WordPress plugin cross-site scripting | 5.9CNA v3.1 | 0.3% | 2025-04-17 | |
| CVE-2025-39427 | WP Post to PDF Enhanced WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.3% | 2025-04-17 | |
| CVE-2025-39426 | illow Cookies Consent WordPress plugin cross-site request forgery (CSRF) | 4.3CNA v3.1 | 0.2% | 2025-04-17 | |
| CVE-2025-39425 | Style Manager WordPress plugin cross-site request forgery (CSRF) to settings Change | 4.3CNA v3.1 | 0.2% | 2025-04-17 | Fix |
| CVE-2025-39424 | Simple Maps WordPress plugin CSRF to XSS | 7.1CNA v3.1 | 0.2% | 2025-04-17 | Fix |
| CVE-2025-39423 | Jenst Add to Header cross-site request forgery | 7.1CNA v3.1 | 0.2% | 2025-04-17 | |
| CVE-2025-39422 | WP Social Bookmarking WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.2% | 2025-04-17 | |
| CVE-2025-39421 | WP Sticky Side Buttons WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.2% | 2025-04-17 | |
| CVE-2025-39420 | WP Twitter Button WordPress plugin cross-site request forgery (CSRF) | 7.1CNA v3.1 | 0.3% | 2025-04-17 | |
| CVE-2025-39419 | Revision Diet WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.2% | 2025-04-17 | |
| CVE-2025-39418 | RSS Manager WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.2% | 2025-04-17 | |
| CVE-2025-39417 | Redirect wordpress to welcome or landing page plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.2% | 2025-04-17 | |
| CVE-2025-39416 | translit it! WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.2% | 2025-04-17 | |
| CVE-2025-39415 | Social Media Links WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.2% | 2025-04-17 | |
| CVE-2025-39414 | spam-stopper WordPress plugin CSRF to stored XSS | 7.1CNA v3.1 | 0.2% | 2025-04-17 | |
| CVE-2025-32686 | Team Members WordPress plugin PHP object injection | 8.8CNA v3.1 | 0.6% | 2025-04-17 | Fix |
| CVE-2025-32682 | MapSVG Lite WordPress plugin arbitrary file upload | 9.9CNA v3.1 | 0.6% | 2025-04-17 | Exploit codeFix |
| CVE-2025-32674 | Product Excel Import Export and Bulk Edit for WooCommerce WordPress plugin cross-site scripting | 7.1CNA v3.1 | 0.3% | 2025-04-17 | |
| CVE-2025-32670 | Spark GF Failed Submissions WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-04-17 | Fix |
| CVE-2025-32666 | Hive Support WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-04-17 | Fix |
| CVE-2025-32665 | Office Locator WordPress plugin SQL injection | 9.3CNA v3.1 | 0.4% | 2025-04-17 | |
| CVE-2025-32662 | uListing WordPress plugin deserialization of untrusted data | 8.8CNA v3.1 | 0.5% | 2025-04-17 | |
| CVE-2025-32660 | JS Job Manager WordPress plugin arbitrary file upload | 9.8v3.1 | 0.4% | 2025-04-17 | |
| CVE-2025-32658 | HelpGent WordPress plugin PHP object injection | 9.8CNA v3.1 | 0.5% | 2025-04-17 | |
| CVE-2025-32655 | DevriX Restrict User Registration cross-site request forgery | 7.1CNA v3.1 | 0.2% | 2025-04-17 | |
| CVE-2025-32653 | Cart66 Cloud WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-04-17 | |
| CVE-2025-32652 | Solace Extra WordPress plugin arbitrary file upload | 9.9CNA v3.1 | 0.4% | 2025-04-17 | Fix |
| CVE-2025-32651 | SERPed.net WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-04-17 | Fix |