CVE-2025 records published in May 2025
This page lists the 3,226 CVE-2025 records published in May 2025, newest first, 1,000 to a page. The Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog lists 19 of them. Each CVE opens on cve-security.com with its sources, detection content and vendor fixes, and the search on the CVE-2025 list filters these records by severity or signal.
- Critical
- 72022.3% of these records
- Listed in CISA KEV
- 190.6% of these records
- Reported exploited
- 50.2% of these records
- Detection signal
- 682.1% of these records
- Exploit code
- 922.9% of these records
- Actionable vendor fix
- 1,96761.0% of these records
Figures as of 2026-10-24 13:47 UTC. Records published in May 2025 have had from about 17 months to about 18 months to collect KEV listings, exploitation reports, detection content and exploit code. Records published more recently have had less time, which can hold their shares down.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2025-5390 | JeeWMS file filedeal.do filedeal access control | 9.8v3.1 | 0.3% | 2025-05-31 | |
| CVE-2025-5389 | JeeWMS file generateController.do dogenerateOne2Many access control | 9.8v3.1 | 0.3% | 2025-05-31 | |
| CVE-2025-5388 | JeeWMS generateController.do dogenerate SQL injection | 9.8v3.1 | 0.4% | 2025-05-31 | |
| CVE-2025-5387 | JeeWMS file generateController.do dogenerate access control | 9.8v3.1 | 0.3% | 2025-05-31 | |
| CVE-2025-5386 | JeeWMS cgformTransController.do transEditor SQL injection | 9.8v3.1 | 0.3% | 2025-05-31 | |
| CVE-2025-5385 | JeeWMS cgformTemplateController.do doAdd path traversal | 9.8v3.1 | 0.5% | 2025-05-31 | |
| CVE-2025-5384 | JeeWMS cgAutoListController.do CgAutoListController SQL injection | 9.8v3.1 | 0.3% | 2025-05-31 | |
| CVE-2025-5383 | YiFang CMS Article Management module cross-site scripting | 4.8v3.1 | 0.3% | 2025-05-31 | |
| CVE-2025-5381 | YiFang CMS Admin Panel downloadFile path traversal | 7.2v3.1 | 0.7% | 2025-05-31 | |
| CVE-2025-5380 | ashinigit 天青一白 XueShengZhuSu 学生住宿管理系统 Image file upload upload path traversal | 5.3CNA v4.0 | 0.4% | 2025-05-31 | |
| CVE-2025-5379 | NuCom NC-WR744G console application hard-coded credentials | 5.3CNA v4.0 | 0.3% | 2025-05-31 | |
| CVE-2025-5378 | Astun Technology iShare Maps mycouncil2.aspx cross-site scripting | 6.1v3.1 | 0.4% | 2025-05-31 | |
| CVE-2025-5377 | Astun Technology iShare Maps historic1.asp cross-site scripting | 6.1v3.1 | 0.4% | 2025-05-31 | |
| CVE-2025-5376 | SourceCodester Health Center Patient Record Management System patient.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-31 | |
| CVE-2025-5375 | PHPGurukul HPGurukul Online Birth Certificate System registered-users.php SQL injection | 8.8v3.1 | 0.3% | 2025-05-31 | |
| CVE-2025-5374 | PHPGurukul Online Birth Certificate System all-applications.php SQL injection | 8.8v3.1 | 0.3% | 2025-05-31 | |
| CVE-2025-5373 | PHPGurukul Online Birth Certificate System users-applications.php SQL injection | 8.8v3.1 | 0.3% | 2025-05-31 | |
| CVE-2025-5371 | SourceCodester Health Center Patient Record Management System admin.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-31 | |
| CVE-2025-5370 | PHPGurukul News Portal forgot-password.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-31 | |
| CVE-2025-5369 | SourceCodester PHP Display Username After Login login.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-31 | |
| CVE-2025-5368 | PHPGurukul Daily Expense Tracker System expense-yearwise-reports-detailed.php SQL injection | 8.8v3.1 | 0.4% | 2025-05-31 | |
| CVE-2025-5367 | PHPGurukul Online Shopping Portal Project category.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-31 | |
| CVE-2025-5365 | Campcodes Online Hospital Management System patient-search.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-31 | |
| CVE-2025-5292 | Element Pack Addons for Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-05-31 | Fix |
| CVE-2025-5290 | Borderless Elementor Addons and Templates WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-05-31 | Fix |
| CVE-2025-5285 | Product Subtitle for WooCommerce WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-05-31 | Fix |
| CVE-2025-5016 | Relevanssi (Free) and (Premium) unauthenticated stored cross-site scripting via Excerpt Highlights | 4.7CNA v3.1 | 0.2% | 2025-05-31 | Fix |
| CVE-2025-4857 | Newsletters WordPress plugin authenticated (Administrator+) local file inclusion | 7.2CNA v3.1 | 0.8% | 2025-05-31 | Fix |
| CVE-2025-4691 | Syntactics eaSYNC Booking view_request_details endpoint insecure direct object reference | 5.3CNA v3.1 | 0.3% | 2025-05-31 | Fix |
| CVE-2025-4672 | Offsprout Page Builder - Authenticated privilege escalation | 8.8CNA v3.1 | 0.4% | 2025-05-31 | |
| CVE-2025-4631 | Profitori WordPress plugin privilege escalation | 9.8CNA v3.1 | 0.7% | 2025-05-31 | Exploit code |
| CVE-2025-4607 | PSW Front-end Login and Registration WordPress plugin privilege escalation | 9.8CNA v3.1 | 0.6% | 2025-05-31 | |
| CVE-2025-4595 | FastSpring WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-05-31 | |
| CVE-2025-4590 | Daisycon prijsvergelijkers WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-05-31 | Fix |
| CVE-2025-4103 | WP-GeoMeta - missing authorization to Authenticated privilege escalation | 8.8CNA v3.1 | 0.4% | 2025-05-31 | |
| CVE-2025-3813 | Royal Elementor Addons and Templates WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-05-31 | Fix |
| CVE-2025-48949 | Navidrome allows SQL injection via role parameter | 8.9CNA v4.0 | 0.5% | 2025-05-30 | Fix |
| CVE-2025-48948 | Navidrome Transcoding permission bypass vulnerability Report | 7.4CNA v4.0 | 0.5% | 2025-05-30 | Fix |
| CVE-2025-48946 | liboqs affected by theoretical design flaw in HQC | 3.7CNA v3.1 | 0.2% | 2025-05-30 | Fix |
| CVE-2025-48944 | vLLM Tool Schema allows DoS via Malformed pattern and type fields | 6.5CNA v3.1 | 0.5% | 2025-05-30 | Fix |
| CVE-2025-48943 | vLLM allows clients to crash the openai server with invalid regex | 6.5CNA v3.1 | 0.5% | 2025-05-30 | Fix |
| CVE-2025-48942 | vLLM DOS: Remotely kill vLLM over HTTP with invalid JSON schema | 6.5CNA v3.1 | 0.6% | 2025-05-30 | Fix |
| CVE-2025-48938 | go-gh browser URL handler vulnerability | 2.6CNA v4.0 | 0.5% | 2025-05-30 | Fix |
| CVE-2025-48936 | ZITADEL allows account takeover via Malicious X-Forwarded-Proto header injection | 8.1CNA v3.1 | 0.4% | 2025-05-30 | Fix |
| CVE-2025-48912 | Apache Superset: Improper authorization bypass on row level security via SQL injection | 7.1CNA v4.0 | 0.7% | 2025-05-30 | Fix |
| CVE-2025-48889 | Gradio allows Unauthorized File Copy via Path Manipulation | 5.3CNA v3.1 | 0.7% | 2025-05-30 | Fix |
| CVE-2025-48887 | vLLM has a regular expression denial of service vulnerability in `pythonic_tool_parser.py` | 6.5CNA v3.1 | 0.5% | 2025-05-30 | Fix |
| CVE-2025-48885 | application-urlshortener users can create arbitrary pages as long as they have view access to them | 5.7CNA v4.0 | 0.2% | 2025-05-30 | Fix |
| CVE-2025-48883 | Chrome PHP is missing encoding in `CssSelector` | 5.3CNA v4.0 | 0.5% | 2025-05-30 | Fix |
| CVE-2025-48882 | PHPOffice Math allows XXE when processing an XML file in the MathML format | 8.7CNA v4.0 | 0.5% | 2025-05-30 | Fix |
| CVE-2025-48881 | Valtimo object API incorrect authorization | 8.3CNA v3.1 | 0.3% | 2025-05-30 | Fix |
| CVE-2025-48880 | FreeScout has race condition when Deleting Users | 5.1CNA v4.0 | 0.4% | 2025-05-30 | Fix |
| CVE-2025-48875 | FreeScout Vulnerable to stored XSS | 4.6CNA v4.0 | 0.3% | 2025-05-30 | Fix |
| CVE-2025-48865 | Fabio allows HTTP clients to manipulate custom headers it adds | 9.1CNA v3.1 | 0.5% | 2025-05-30 | Fix |
| CVE-2025-48757 | Lovable incorrect authorization | 9.3CNA v3.1 | 0.8% | 2025-05-30 | Fix |
| CVE-2025-48492 | GetSimpleCMS-CE GetSimple CMS RCE in Edit component | 8.6CNA v4.0 | 0.9% | 2025-05-30 | |
| CVE-2025-48491 | aryan6673 project-ai Project AI API key exposure in Source Code | 2.7CNA v4.0 | 0.6% | 2025-05-30 | |
| CVE-2025-48490 | Lomkit laravel-rest-api Laravel Rest Api has a Search Validation Bypass | 6.6CNA v4.0 | 0.6% | 2025-05-30 | Fix |
| CVE-2025-48489 | FreeScout Vulnerable to stored XSS | 4.6CNA v4.0 | 0.2% | 2025-05-30 | Fix |
| CVE-2025-48488 | FreeScout Vulnerable to stored XSS | 4.6CNA v4.0 | 0.3% | 2025-05-30 | Fix |
| CVE-2025-48487 | FreeScout Vulnerable to stored XSS | 6.0CNA v4.0 | 0.3% | 2025-05-30 | Fix |
| CVE-2025-48486 | FreeScout Vulnerable to stored XSS | 6.1CNA v4.0 | 0.3% | 2025-05-30 | Fix |
| CVE-2025-48485 | FreeScout Vulnerable to stored XSS | 6.1CNA v4.0 | 0.3% | 2025-05-30 | Fix |
| CVE-2025-48484 | FreeScout Vulnerable to stored XSS | 4.6CNA v4.0 | 0.3% | 2025-05-30 | Fix |
| CVE-2025-48483 | FreeScout stored XSS leads to CSRF | 6.3CNA v4.0 | 0.2% | 2025-05-30 | Fix |
| CVE-2025-48482 | FreeScout has Business Logic Errors | 5.3CNA v4.0 | 0.3% | 2025-05-30 | Fix |
| CVE-2025-48481 | FreeScout has Business Logic Errors | 6.1CNA v4.0 | 0.5% | 2025-05-30 | Fix |
| CVE-2025-48480 | FreeScout has Business Logic Errors | 7.0CNA v4.0 | 0.3% | 2025-05-30 | Fix |
| CVE-2025-48479 | FreeScout has Business Logic Errors | 8.5CNA v4.0 | 0.3% | 2025-05-30 | Fix |
| CVE-2025-48478 | FreeScout has Business Logic Errors | 7.0CNA v4.0 | 0.4% | 2025-05-30 | Fix |
| CVE-2025-48477 | FreeScout has Business Logic Errors | 7.1CNA v4.0 | 0.5% | 2025-05-30 | Fix |
| CVE-2025-48476 | FreeScout has Business Logic Errors | 7.1CNA v4.0 | 0.5% | 2025-05-30 | Fix |
| CVE-2025-48381 | Cvat has information disclosure via browsable API | 5.3CNA v4.0 | 0.3% | 2025-05-30 | Fix |
| CVE-2025-48334 | WordPress Woo Slider Pro plugin arbitrary content deletion vulnerability | 4.3v3.1 | 0.2% | 2025-05-30 | |
| CVE-2025-48331 | WordPress WooCommerce Orders and Customers Exporter plugin sensitive data exposure | 7.5CNA v3.1 | 0.4% | 2025-05-30 | |
| CVE-2025-48068 | Information exposure in Next.js dev server due to lack of origin verification | 2.3CNA v4.0 | 0.2% | 2025-05-30 | Fix |
| CVE-2025-47952 | Traefik allows path traversal using URL encoding | 2.9CNA v4.0 | 0.9% | 2025-05-30 | Fix |
| CVE-2025-47697 | UCHIDA YOKO wivia 5 client-side enforcement of server-side security | 7.5v3.1 | 0.3% | 2025-05-30 | Fix |
| CVE-2025-46352 | Consilium Safety CS5000 Fire Panel use of hard-coded credentials | 9.3CNA v4.0 | 0.7% | 2025-05-30 | Fix |
| CVE-2025-44906 | jhead use-after-free | 7.8CISA ADP v3.1 | 0.3% | 2025-05-30 | Fix |
| CVE-2025-44905 | HDFGroup hdf5 heap-based buffer overflow | 8.8CISA ADP v3.1 | 0.5% | 2025-05-30 | Fix |
| CVE-2025-44904 | HDFGroup hdf5 heap-based buffer overflow | 8.8CISA ADP v3.1 | 0.4% | 2025-05-30 | Fix |
| CVE-2025-44619 | Tinxy Wifi Lock Controller V1 Rf improper access control | 9.1CISA ADP v3.1 | 0.5% | 2025-05-30 | |
| CVE-2025-44614 | Tinxy Wifi Lock Controller V1 Rf cleartext storage of sensitive information | 7.5CISA ADP v3.1 | 0.2% | 2025-05-30 | |
| CVE-2025-44612 | Tinxy Wifi Lock Controller V1 Rf cleartext transmission of sensitive information | 5.9CISA ADP v3.1 | 0.2% | 2025-05-30 | |
| CVE-2025-41438 | Consilium Safety CS5000 Fire Panel initialization of a resource with an insecure default | 9.3CNA v4.0 | 0.7% | 2025-05-30 | Fix |
| CVE-2025-41406 | UCHIDA YOKO wivia 5 cross-site scripting | 6.1v3.1 | 0.2% | 2025-05-30 | Fix |
| CVE-2025-41385 | UCHIDA YOKO wivia 5 OS command injection | 7.2v3.1 | 1.2% | 2025-05-30 | Fix |
| CVE-2025-41235 | Spring Cloud Gateway Server Forwards headers from Untrusted Proxies | 8.6CNA v3.1 | 0.3% | 2025-05-30 | Fix |
| CVE-2025-40909 | Perl thread creation working directory handling race condition | 5.9CISA ADP v3.1 | 0.5% | 2025-05-30 | Fix |
| CVE-2025-5364 | Campcodes Online Hospital Management System add-patient.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-30 | |
| CVE-2025-5363 | Campcodes Online Hospital Management System index.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-30 | |
| CVE-2025-5362 | Campcodes Online Hospital Management System doctor-specilization.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-30 | |
| CVE-2025-5361 | Campcodes Online Hospital Management System contact.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-30 | |
| CVE-2025-5360 | Campcodes Online Hospital Management System book-appointment.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-30 | |
| CVE-2025-5359 | Campcodes Online Hospital Management System appointment-history.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-30 | |
| CVE-2025-5358 | PHPGurukul/Campcodes Cyber Cafe Management System bwdates-reports-details.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-30 | |
| CVE-2025-5357 | FreeFloat FTP Server PWD command buffer overflow | 9.8v3.1 | 0.7% | 2025-05-30 | |
| CVE-2025-5356 | FreeFloat FTP Server BYE command buffer overflow | 9.8v3.1 | 0.7% | 2025-05-30 | |
| CVE-2025-5259 | Minimal Share Buttons WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-05-30 | Fix |
| CVE-2025-5236 | NinjaTeam Chat for Telegram WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-05-30 | Fix |
| CVE-2025-5235 | OpenSheetMusicDisplay WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-05-30 | Fix |
| CVE-2025-5190 | Browse As WordPress plugin authenticated (Subscriber+) authentication bypass via Cookie | 8.8CNA v3.1 | 0.5% | 2025-05-30 | |
| CVE-2025-5142 | Simple Page Access Restriction WordPress plugin cross-site request forgery via Multiple parameters | 6.5CNA v3.1 | 0.2% | 2025-05-30 | Fix |
| CVE-2025-5054 | Race condition in Canonical Apport | 4.7CNA v3.1 | 0.8% | 2025-05-30 | Fix |
| CVE-2025-4992 | Dassault Systèmes Service Process Engineer service items management stored cross-site scripting | 8.7CNA v3.1 | 0.3% | 2025-05-30 | |
| CVE-2025-4991 | Dassault Systèmes Collaborative Industry Innovator 3D markup stored cross-site scripting | 8.7CNA v3.1 | 0.3% | 2025-05-30 | |
| CVE-2025-4990 | Dassault Systèmes Product Manager change governance stored cross-site scripting | 8.7CNA v3.1 | 0.3% | 2025-05-30 | |
| CVE-2025-4989 | Dassault Systèmes Product Manager requirements stored cross-site scripting | 8.7CNA v3.1 | 0.3% | 2025-05-30 | |
| CVE-2025-4988 | Dassault Systèmes Multidisciplinary Optimization Engineer stored cross-site scripting | 8.7CNA v3.1 | 0.3% | 2025-05-30 | |
| CVE-2025-4986 | Dassault Systèmes Product Manager model definition stored cross-site scripting | 8.7CNA v3.1 | 0.3% | 2025-05-30 | |
| CVE-2025-4985 | Dassault Systèmes Project Portfolio Manager risk management stored cross-site scripting | 8.7CNA v3.1 | 0.3% | 2025-05-30 | |
| CVE-2025-4984 | Dassault Systèmes City Referential Manager City Discover stored cross-site scripting | 8.7CNA v3.1 | 0.3% | 2025-05-30 | |
| CVE-2025-4983 | Dassault Systèmes City Referential Manager stored cross-site scripting | 8.7CNA v3.1 | 0.3% | 2025-05-30 | |
| CVE-2025-4944 | LA-Studio Element Kit for Elementor WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-05-30 | Fix |
| CVE-2025-4943 | LA-Studio Element Kit for Elementor WordPress plugin DOM-based stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-05-30 | Fix |
| CVE-2025-4659 | Integration for Salesforce and Contact Form 7 WordPress plugin information disclosure | 5.3CNA v3.1 | 0.3% | 2025-05-30 | Fix |
| CVE-2025-4636 | JCT Airpointer local privilege escalation | 7.8CNA v3.1 | 0.2% | 2025-05-30 | |
| CVE-2025-4635 | JCT Airpointer remote code execution | 6.6CNA v3.1 | 0.4% | 2025-05-30 | |
| CVE-2025-4634 | JCT Airpointer local file inclusion | 4.1CNA v3.1 | 0.3% | 2025-05-30 | |
| CVE-2025-4633 | JCT Airpointer default credentials | 6.5CNA v3.1 | 0.3% | 2025-05-30 | |
| CVE-2025-4598 | systemd-coredump SUID process crash handling race condition | 4.7CNA v3.1 | 1.2% | 2025-05-30 | Fix |
| CVE-2025-4597 | Woo Slider Pro WordPress plugin unauthorized access | 6.5CNA v3.1 | 0.3% | 2025-05-30 | |
| CVE-2025-4433 | Devolutions Server user group management improper access control | 8.7CNA v4.0 | 0.5% | 2025-05-30 | Fix |
| CVE-2025-4431 | Featured Image Plus WordPress plugin missing authorization authenticated Featured Image update | 4.3CNA v3.1 | 0.3% | 2025-05-30 | Fix |
| CVE-2025-4429 | WordPress Gearside Developer Dashboard plugin reflected XSS | 6.1CISA ADP v3.1 | 0.3% | 2025-05-30 | |
| CVE-2025-3611 | Mattermost fails to properly enforce access control restrictions for System Manager roles | 3.1CNA v3.1 | 0.2% | 2025-05-30 | Fix |
| CVE-2025-3230 | Bypass of System Admin User Deactivation Controls for Personal Access Tokens in Mattermost Server | 5.4CNA v3.1 | 0.2% | 2025-05-30 | Fix |
| CVE-2025-2571 | Mattermost Google OAuth authentication bypass for Converted Bot Accounts | 4.2CNA v3.1 | 0.2% | 2025-05-30 | Fix |
| CVE-2025-2503 | Lenovo PC Manager incorrect permission assignment | 6.9CNA v4.0 | 0.1% | 2025-05-30 | Fix |
| CVE-2025-2502 | Lenovo PC Manager incorrect default permissions | 8.5CNA v4.0 | 0.2% | 2025-05-30 | Exploit codeFix |
| CVE-2025-2501 | Lenovo PC Manager untrusted search path | 8.5CNA v4.0 | 0.2% | 2025-05-30 | Fix |
| CVE-2025-2500 | Hitachi Energy Asset Suite plaintext password storage | 9.1CNA v4.0 | 0.4% | 2025-05-30 | |
| CVE-2025-1907 | Instantel Micromate missing authentication for critical function | 9.3CNA v4.0 | 0.8% | 2025-05-30 | Fix |
| CVE-2025-1792 | Improper access control in Mattermost Channel Member API | 3.1CNA v3.1 | 0.2% | 2025-05-30 | Fix |
| CVE-2025-1763 | Improper neutralization of input during web page generation (cross-site scripting) in GitLab | 8.7CNA v3.1 | 0.6% | 2025-05-30 | Fix |
| CVE-2025-1484 | Hitachi Energy Asset Suite incomplete denylist | 6.3CNA v4.0 | 0.2% | 2025-05-30 | Fix |
| CVE-2025-1479 | Lenovo Legion Space for Legion Go active debug code | 4.8CNA v4.0 | 0.2% | 2025-05-30 | Fix |
| CVE-2025-0602 | Dassault Systèmes Collaborative Industry Innovator Compare stored cross-site scripting | 8.7CNA v3.1 | 0.3% | 2025-05-30 | |
| CVE-2025-48748 | Netwrix Directory Manager hard-coded credentials | 10.0CISA ADP v3.1 | 0.4% | 2025-05-29 | Fix |
| CVE-2025-48475 | FreeScout vulnerable to insufficient authorization | 5.3CNA v4.0 | 0.4% | 2025-05-29 | Fix |
| CVE-2025-48474 | FreeScout vulnerable to insufficient authorization | 5.3CNA v4.0 | 0.5% | 2025-05-29 | Fix |
| CVE-2025-48473 | FreeScout vulnerable to insufficient authorization | 5.3CNA v4.0 | 0.4% | 2025-05-29 | Fix |
| CVE-2025-48472 | FreeScout vulnerable to insufficient authorization | 6.9CNA v4.0 | 0.4% | 2025-05-29 | Fix |
| CVE-2025-48471 | FreeScout vulnerable to arbitrary file upload | 7.0CNA v4.0 | 1.1% | 2025-05-29 | Fix |
| CVE-2025-48390 | FreeScout vulnerable to remote code execution (RCE) | 8.6CNA v4.0 | 0.9% | 2025-05-29 | Fix |
| CVE-2025-48389 | FreeScout vulnerable to deserialization of untrusted data | 8.6CNA v4.0 | 0.9% | 2025-05-29 | Fix |
| CVE-2025-48388 | FreeScout has Insufficient Protection against CRLF-injection | 7.0CNA v4.0 | 0.4% | 2025-05-29 | Fix |
| CVE-2025-48336 | WordPress Course Builder theme PHP object injection | 9.8CNA v3.1 | 0.5% | 2025-05-29 | Fix |
| CVE-2025-48047 | MICI Network Co. Ltd. NetFax Server command injection | 9.4CNA v4.0 | 15.7% | 2025-05-29 | Emerging ThreatsKCVFix |
| CVE-2025-48046 | MICI Network Co. Ltd. NetFax Server Disclosure of Stored Passwords in Cleartext | 5.3CNA v4.0 | 0.5% | 2025-05-29 | Emerging ThreatsKCVFix |
| CVE-2025-48045 | MICI Network Co. Ltd. NetFax Server Default Administrator credentials disclosure | 8.7CNA v4.0 | 0.6% | 2025-05-29 | Emerging ThreatsKCVFix |
| CVE-2025-47933 | argoproj argo-cd argo CD allows cross-site scripting on repositories page | 9.1CNA v3.1 | 0.5% | 2025-05-29 | Fix |
| CVE-2025-47288 | Discourse Policy plugin private group members visible | 3.5CNA v3.1 | 0.3% | 2025-05-29 | Fix |
| CVE-2025-46823 | OpenMRS has vulnerability in FHIR2 Module Privileges | 8.0CNA v4.0 | 0.4% | 2025-05-29 | Fix |
| CVE-2025-46722 | vLLM has a Weakness in MultiModalHasher Image Hashing Implementation | 4.2CNA v3.1 | 0.3% | 2025-05-29 | Fix |
| CVE-2025-46701 | Apache Tomcat: Security constraint bypass for CGI scripts | 7.3CISA ADP v3.1 | 2.9% | 2025-05-29 | Fix |
| CVE-2025-46570 | VLLM’s Chunk-Based Prefix Caching vulnerable to potential timing side-channel | 2.6CNA v3.1 | 0.3% | 2025-05-29 | Fix |
| CVE-2025-46080 | Huocms unrestricted file upload | 5.3CISA ADP v3.1 | 0.4% | 2025-05-29 | Exploit code |
| CVE-2025-46078 | Huocms unrestricted file upload | 5.3CISA ADP v3.1 | 0.4% | 2025-05-29 | |
| CVE-2025-45474 | MacCMS server-side request forgery | 7.3CISA ADP v3.1 | 0.4% | 2025-05-29 | |
| CVE-2025-37999 | Linux kernel EROFS file-backed I/O vulnerability | 5.5v3.1 | 0.2% | 2025-05-29 | Fix |
| CVE-2025-37998 | In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix unsafe attribute parsing in output_userspace() This patch replaces the manual Netlink attribute iteration in output_userspace() with nla_for_each_nested(), which ensures that only well-formed attributes are proces | 7.8CNA v3.1 | 0.3% | 2025-05-29 | Fix |
| CVE-2025-37997 | Linux kernel netfilter ipset hash sets race condition | 7.8CNA v3.1 | 0.2% | 2025-05-29 | Fix |
| CVE-2025-37996 | Linux kernel KVM arm64 stage-2 fault handling vulnerability | 8.8CNA v3.1 | 0.2% | 2025-05-29 | Fix |
| CVE-2025-37995 | Linux kernel module kobject handling uninitialized pointer access | 5.5v3.1 | 0.2% | 2025-05-29 | Fix |
| CVE-2025-37994 | Linux kernel USB Type-C UCSI DisplayPort driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-29 | Fix |
| CVE-2025-37993 | Linux kernel m_can CAN driver vulnerability | 5.5v3.1 | 0.2% | 2025-05-29 | Fix |
| CVE-2025-33043 | AMI AptioV SMM buffer Integrity | 5.8CNA v3.1 | 0.2% | 2025-05-29 | Fix |
| CVE-2025-32752 | Dell ThinOS cleartext storage of sensitive information | 5.7CNA v3.1 | 0.2% | 2025-05-29 | Fix |
| CVE-2025-31264 | Apple macOS improper authentication | 4.6CISA ADP v3.1 | 0.3% | 2025-05-29 | Fix |
| CVE-2025-31263 | Apple macOS memory corruption | 9.1CISA ADP v3.1 | 0.4% | 2025-05-29 | Fix |
| CVE-2025-31261 | Apple macOS incorrect default permissions | 5.5CISA ADP v3.1 | 0.2% | 2025-05-29 | Fix |
| CVE-2025-31231 | Apple macOS insecure permissions | 5.5CISA ADP v3.1 | 0.2% | 2025-05-29 | Fix |
| CVE-2025-31199 | Apple macOS sensitive information in log files | 5.5CISA ADP v3.1 | 0.5% | 2025-05-29 | Fix |
| CVE-2025-31198 | Apple macOS link following | 5.5CISA ADP v3.1 | 0.2% | 2025-05-29 | Fix |
| CVE-2025-31189 | Apple macOS sandbox escape | 8.2CISA ADP v3.1 | 0.2% | 2025-05-29 | Fix |
| CVE-2025-30466 | Apple Safari origin validation error | 9.8CISA ADP v3.1 | 0.3% | 2025-05-29 | Fix |
| CVE-2025-29632 | free5gc buffer overflow | 5.4CISA ADP v3.1 | 0.4% | 2025-05-29 | Exploit code |
| CVE-2025-27151 | redis redis-check-aof may lead to stack overflow and potential RCE | 4.7CNA v3.1 | 1.0% | 2025-05-29 | Fix |
| CVE-2025-5334 | Devolutions Remote Desktop Manager user vaults component personal information exposure | 7.5CISA ADP v3.1 | 0.6% | 2025-05-29 | Fix |
| CVE-2025-5332 | 1000 Projects Online Notice Board index.php SQL injection | 9.8v3.1 | 0.6% | 2025-05-29 | |
| CVE-2025-5331 | PCMan FTP Server NLST command buffer overflow | 9.8v3.1 | 0.7% | 2025-05-29 | |
| CVE-2025-5330 | FreeFloat FTP Server RETR command buffer overflow | 9.8v3.1 | 0.8% | 2025-05-29 | |
| CVE-2025-5328 | chshcms mccms Backups.php restore_del path traversal | 8.8v3.1 | 1.2% | 2025-05-29 | |
| CVE-2025-5327 | chshcms mccms Gf.php index server-side request forgery | 8.8v3.1 | 0.5% | 2025-05-29 | |
| CVE-2025-5326 | zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 verifyToken deserialization | 8.8v3.1 | 0.5% | 2025-05-29 | |
| CVE-2025-5325 | zhilink ADP Application Developer Platform testService interface server-side template injection | 9.8v3.1 | 0.5% | 2025-05-29 | |
| CVE-2025-5324 | TechPowerUp GPU-Z 0x8000645C IOCTL GPU-Z.sys sub_140001880 memory leak | 4.8CNA v4.0 | 0.2% | 2025-05-29 | |
| CVE-2025-5323 | FOSSASIA Open Event Server mail verification handler missing cryptographic step | 6.3CNA v4.0 | 0.1% | 2025-05-29 | |
| CVE-2025-5321 | aimhubio aim run_view object query.py RestrictedPythonQuery privilege escalation | 9.9v3.1 | 0.6% | 2025-05-29 | |
| CVE-2025-5320 | gradio-app gradio CORS is_valid_origin privilege escalation | 6.3CNA v4.0 | 0.3% | 2025-05-29 | |
| CVE-2025-5307 | Santesoft Sante DICOM Viewer Pro out-of-bounds read | 7.8v3.1 | 0.2% | 2025-05-29 | Fix |
| CVE-2025-5286 | Bold Builder WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.4% | 2025-05-29 | Fix |
| CVE-2025-5276 | mcp-markdownify-server markdownify MCP Server allows server-side request forgery | 8.2CNA v4.0 | 0.4% | 2025-05-29 | Fix |
| CVE-2025-5273 | mcp-markdownify-server markdownify MCP Server allows attackers to read arbitrary files | 8.2CNA v4.0 | 0.4% | 2025-05-29 | Fix |
| CVE-2025-5122 | Map Block Leaflet WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.4% | 2025-05-29 | Fix |
| CVE-2025-4967 | Server side request forgery (SSRF) vulnerability in Portal for ArcGIS | 9.1CNA v3.1 | 0.6% | 2025-05-29 | |
| CVE-2025-4687 | Teltonika Networks RMS account pre-hijacking through invite misuse | 7.2CNA v4.0 | 0.5% | 2025-05-29 | Fix |
| CVE-2025-4670 | Easy Digital Downloads WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-05-29 | Fix |
| CVE-2025-4583 | Smash Balloon Social Photo Feed WordPress plugin stored cross-site scripting | 5.4CNA v3.1 | 0.2% | 2025-05-29 | Fix |
| CVE-2025-4081 | TCC Bypass via Dylib Substitution in DaVinci Resolve | 4.8CNA v4.0 | 0.1% | 2025-05-29 | |
| CVE-2025-3913 | Team Privacy settings authorization bypass in Mattermost Server | 5.3CNA v3.1 | 0.3% | 2025-05-29 | Fix |
| CVE-2025-3755 | Information disclosure and denial of service(DoS) vulnerability in MELSEC iQ-F Series CPU module | 9.1CNA v3.1 | 0.8% | 2025-05-29 | |
| CVE-2025-3050 | IBM Db2 denial of service | 5.3CNA v3.1 | 0.4% | 2025-05-29 | Fix |
| CVE-2025-2518 | IBM Db2 denial of service | 5.3CNA v3.1 | 0.3% | 2025-05-29 | Fix |
| CVE-2025-48931 | TeleMessage service weak hash | 5.5v3.1 | 0.1% | 2025-05-28 | Fix |
| CVE-2025-48930 | TeleMessage service cleartext storage of sensitive information in memory | 5.3v3.1 | 0.1% | 2025-05-28 | Fix |
| CVE-2025-48929 | TeleMessage service insecure storage of sensitive information | 9.8v3.1 | 0.3% | 2025-05-28 | Fix |
| CVE-2025-48928 | TeleMessage TM SGNL core dump file exposure | 4.0CNA v3.1 | 0.6% | 2025-05-28 | KEVFix |
| CVE-2025-48927 | TeleMessage TM SGNL initialization of a resource with an insecure default | 5.3CNA v3.1 | 11.1% | 2025-05-28 | KEVFix |
| CVE-2025-48926 | TeleMessage service authentication bypass | 7.5v3.1 | 0.3% | 2025-05-28 | Fix |
| CVE-2025-48925 | TeleMessage service improper authentication | 7.5v3.1 | 0.3% | 2025-05-28 | Fix |
| CVE-2025-48749 | Netwrix Directory Manager information disclosure | 9.1CISA ADP v3.1 | 0.4% | 2025-05-28 | Fix |
| CVE-2025-48747 | Netwrix Directory Manager incorrect permission assignment | 5.0CISA ADP v3.1 | 0.3% | 2025-05-28 | Fix |
| CVE-2025-48746 | Netwrix Directory Manager improper authentication | 6.5CISA ADP v3.1 | 0.3% | 2025-05-28 | Fix |
| CVE-2025-48734 | Apache Commons improper access control | 8.8CISA ADP v3.1 | 1.8% | 2025-05-28 | Exploit codeFix |
| CVE-2025-47748 | Netwrix Directory Manager hard-coded password | 5.3CISA ADP v3.1 | 0.3% | 2025-05-28 | Fix |
| CVE-2025-47295 | Fortinet FortiOS A buffer over-read | 3.4CNA v3.1 | 0.8% | 2025-05-28 | Fix |
| CVE-2025-47294 | Fortinet FortiOS A integer overflow | 4.8CNA v3.1 | 0.8% | 2025-05-28 | Fix |
| CVE-2025-46777 | Fortinet FortiPortal sensitive information in log files | 2.2CNA v3.1 | 0.2% | 2025-05-28 | Fix |
| CVE-2025-45997 | Senior-walter Web-based Pharmacy Product Management System unrestricted file upload | 8.6CISA ADP v3.1 | 0.5% | 2025-05-28 | |
| CVE-2025-45343 | Tenda W18E arbitrary code execution | 9.8CISA ADP v3.1 | 0.6% | 2025-05-28 | |
| CVE-2025-40673 | Missing authorization in DinoRANK | 5.3CNA v4.0 | 0.3% | 2025-05-28 | |
| CVE-2025-40651 | Reflected cross-site scripting (XSS) in Real Easy Store | 5.1CNA v4.0 | 0.5% | 2025-05-28 | |
| CVE-2025-36572 | Dell PowerStore hard-coded credentials | 6.5CNA v3.1 | 0.3% | 2025-05-28 | Fix |
| CVE-2025-32803 | ISC Kea insecure file permissions can result in confidential information leakage | 4.0CNA v3.1 | 0.2% | 2025-05-28 | Fix |
| CVE-2025-32802 | ISC Kea insecure handling of file paths allows multiple local attacks | 6.1CNA v3.1 | 0.2% | 2025-05-28 | Fix |
| CVE-2025-32801 | ISC Kea loading a malicious hook library can lead to local privilege escalation | 7.8CNA v3.1 | 0.3% | 2025-05-28 | Fix |
| CVE-2025-31501 | bestpractical rt cross-site scripting | 6.1NVD v3.1 | 0.2% | 2025-05-28 | Fix |
| CVE-2025-31500 | bestpractical rt cross-site scripting | 6.1NVD v3.1 | 0.2% | 2025-05-28 | Fix |
| CVE-2025-30087 | bestpractical rt cross-site scripting | 6.1NVD v3.1 | 0.3% | 2025-05-28 | Fix |
| CVE-2025-27706 | Absolute Security Secure Access management console cross-site scripting | 4.6CNA v4.0 | 0.2% | 2025-05-28 | Fix |
| CVE-2025-27703 | Privilege escalation in the management console of Absolute Secure Access prior to | 7.0CNA v4.0 | 0.3% | 2025-05-28 | Fix |
| CVE-2025-27702 | Permissions bypass in the management console of Absolute Secure Access prior to | 6.9CNA v4.0 | 0.3% | 2025-05-28 | Fix |
| CVE-2025-27528 | Apache InLong: JDBC vulnerability for Invisible Character Bypass leading to arbitrary file read | 9.1CISA ADP v3.1 | 0.7% | 2025-05-28 | Fix |
| CVE-2025-27526 | Apache InLong: JDBC vulnerability For URLEncode and backspace bypass | 6.5CISA ADP v3.1 | 0.8% | 2025-05-28 | Fix |
| CVE-2025-27522 | Apache InLong: JDBC vulnerability during verification processing | 6.5CISA ADP v3.1 | 0.8% | 2025-05-28 | Fix |
| CVE-2025-25251 | Fortinet FortiClientMac incorrect authorization | 7.4CNA v3.1 | 0.2% | 2025-05-28 | Fix |
| CVE-2025-25029 | IBM Security Guardium information disclosure | 4.9CNA v3.1 | 0.4% | 2025-05-28 | Fix |
| CVE-2025-25026 | IBM Security Guardium information disclosure | 4.3CNA v3.1 | 0.3% | 2025-05-28 | Fix |
| CVE-2025-25025 | IBM Security Guardium information disclosure | 4.3CNA v3.1 | 0.4% | 2025-05-28 | Fix |
| CVE-2025-24473 | Fortinet FortiClientWindows system information disclosure | 4.8CNA v3.1 | 0.5% | 2025-05-28 | Fix |
| CVE-2025-22252 | Fortinet FortiProxy missing authentication | 9.0CNA v3.1 | 0.9% | 2025-05-28 | Fix |
| CVE-2025-5299 | SourceCodester Client Database Management System user_order_customer_update.php unrestricted upload | 6.9CNA v4.0 | 0.6% | 2025-05-28 | |
| CVE-2025-5298 | Campcodes Online Hospital Management System betweendates-detailsreports.php SQL injection | 9.8v3.1 | 0.9% | 2025-05-28 | Exploit code |
| CVE-2025-5297 | SourceCodester Computer Store System main.c Add stack-based overflow | 6.6v3.1 | 0.3% | 2025-05-28 | |
| CVE-2025-5295 | FreeFloat FTP Server PORT command buffer overflow | 9.8v3.1 | 0.7% | 2025-05-28 | |
| CVE-2025-5287 | Likes and Dislikes WordPress plugin unauthenticated SQL injection | 7.5CNA v3.1 | 2.4% | 2025-05-28 | NucleiExploit code |
| CVE-2025-5277 | alexei-led aws-mcp-server OS command injection | 9.4CNA v4.0 | 1.2% | 2025-05-28 | Fix |
| CVE-2025-5257 | Mautic predictable Page Indexing might lead to sensitive data exposure | 6.5CNA v3.1 | 0.3% | 2025-05-28 | Fix |
| CVE-2025-5256 | Mautic open redirect vulnerability on user unlock path | 5.4CNA v3.1 | 0.2% | 2025-05-28 | Fix |
| CVE-2025-5082 | WP Attachments WordPress plugin reflected cross-site scripting via attachment_id parameter | 6.1CNA v3.1 | 0.3% | 2025-05-28 | Fix |
| CVE-2025-5025 | curl no QUIC certificate pinning with wolfSSL | 4.8CISA ADP v3.1 | 0.3% | 2025-05-28 | Fix |
| CVE-2025-4963 | WP Extended WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-05-28 | Fix |
| CVE-2025-4947 | curl QUIC certificate check skip with wolfSSL | 6.5CISA ADP v3.1 | 0.3% | 2025-05-28 | Fix |
| CVE-2025-4800 | MasterStudy LMS Pro WordPress plugin authenticated (Subscriber+) arbitrary file upload | 8.8CNA v3.1 | 1.1% | 2025-05-28 | Fix |
| CVE-2025-4493 | Devolutions Server incorrect privilege assignment | 6.5CISA ADP v3.1 | 0.4% | 2025-05-28 | Fix |
| CVE-2025-4134 | Lack of file validation in Avast Business Antivirus for Linux allows writing untrusted update files | 7.3CNA v3.1 | 0.2% | 2025-05-28 | |
| CVE-2025-4009 | Unauthenticated arbitrary command injection in Evertz SDVN | 9.3CNA v4.0 | 71.4% | 2025-05-28 | NucleiEmerging Threats |
| CVE-2025-3864 | Connection pool exhaustion in hackney | 2.3CNA v4.0 | 0.8% | 2025-05-28 | Fix |
| CVE-2025-3357 | IBM Tivoli Monitoring code execution | 9.8CNA v3.1 | 1.0% | 2025-05-28 | Fix |
| CVE-2025-1753 | Command injection in LLama-Index CLI in run-llama/llama_index | 7.8CNA v3.0 | 1.1% | 2025-05-28 | Fix |
| CVE-2025-1461 | Vuetify XSS through eventMoreText prop of VCalendar | 5.6CNA v3.1 | 0.3% | 2025-05-28 | Fix |
| CVE-2025-48828 | vBulletin unprotected alternate path | 8.1NVD v3.1 | 57.6% | 2025-05-27 | NucleiMetasploitEmerging ThreatsExploit codeKCV |
| CVE-2025-48827 | vBulletin unprotected alternate path | 9.8v3.1 | 75.8% | 2025-05-27 | Reported exploitedNucleiMetasploitEmerging ThreatsExploit codeKCV |
| CVE-2025-48798 | Red Hat Enterprise Linux 7 Extended Lifecycle Support gimp: Multiple use-after-free in xcf parser | 7.3CNA v3.1 | 0.2% | 2025-05-27 | Fix |
| CVE-2025-48797 | GIMP TGA parser heap-based buffer overflow | 7.3CNA v3.1 | 0.3% | 2025-05-27 | Fix |
| CVE-2025-48796 | Red Hat Enterprise Linux 6 gimp: Stack-based buffer overflows in file-ico | 7.3CNA v3.1 | 0.2% | 2025-05-27 | Fix |
| CVE-2025-48744 | SIGB PMB path traversal | 9.8v3.1 | 0.6% | 2025-05-27 | Fix |
| CVE-2025-48743 | SIGB PMB SQL injection | 9.8v3.1 | 0.4% | 2025-05-27 | Fix |
| CVE-2025-48742 | SIGB PMB missing authentication | 9.8v3.1 | 0.4% | 2025-05-27 | Fix |
| CVE-2025-48383 | Django-Select2 vulnerable to Widget Instance Secret Cache Key Leaking | 8.2CNA v3.1 | 0.3% | 2025-05-27 | Fix |
| CVE-2025-48382 | Fess has insecure temporary file Permissions | 1.2CNA v4.0 | 0.1% | 2025-05-27 | Fix |
| CVE-2025-48370 | auth-js vulnerable to Insecure Path Routing from Malformed User Input | 2.7CNA v4.0 | 0.9% | 2025-05-27 | Fix |
| CVE-2025-48057 | Icinga 2 certificate renewal might incorrectly renew an invalid certificate | 9.3CNA v4.0 | 0.4% | 2025-05-27 | Fix |
| CVE-2025-48054 | Radashi vulnerable to improperly controlled modification of object prototype attributes | 6.8CNA v4.0 | 0.6% | 2025-05-27 | Fix |
| CVE-2025-46173 | code-projects Online Exam Mastering System cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-05-27 | Exploit code |
| CVE-2025-45529 | Sscms Siteserver Cms ReadTextAsynchronous function arbitrary file read | 7.1CISA ADP v3.1 | 0.4% | 2025-05-27 | |
| CVE-2025-45475 | MacCMS server-side request forgery | 5.4CISA ADP v3.1 | 0.3% | 2025-05-27 | |
| CVE-2025-41653 | Weidmueller IE-SW-VL05M-5TX denial of service | 7.5CNA v3.1 | 0.6% | 2025-05-27 | Fix |
| CVE-2025-41652 | Weidmueller: Authentication bypass vulnerability in Industrial Ethernet Switches | 9.8CNA v3.1 | 0.5% | 2025-05-27 | Fix |
| CVE-2025-41651 | Weidmueller: Missing authentication vulnerability in Industrial Ethernet Switches | 9.8CNA v3.1 | 0.6% | 2025-05-27 | Fix |
| CVE-2025-41650 | Weidmueller: Denial of service vulnerability in Industrial Ethernet Switches | 7.5CNA v3.1 | 0.5% | 2025-05-27 | Fix |
| CVE-2025-41649 | Weidmueller: Out-of-bounds write vulnerability in Industrial Ethernet Switches | 7.5CNA v3.1 | 0.5% | 2025-05-27 | Fix |
| CVE-2025-40911 | Net::CIDR::Set improper input validation | 6.5CISA ADP v3.1 | 0.4% | 2025-05-27 | Fix |
| CVE-2025-33079 | IBM Controller information disclosure | 6.5CNA v3.1 | 0.3% | 2025-05-27 | Fix |
| CVE-2025-32440 | NetAlertX vulnerable to authentication bypass | 10.0CNA v3.1 | 0.6% | 2025-05-27 | Fix |
| CVE-2025-27701 | Google Android null pointer dereference | 5.5CISA ADP v3.1 | 0.1% | 2025-05-27 | Fix |
| CVE-2025-27700 | Google Android privilege escalation | 8.4CISA ADP v3.1 | 0.1% | 2025-05-27 | Fix |
| CVE-2025-26211 | gibbonedu gibbon cross-site request forgery | 8.8v3.1 | 0.2% | 2025-05-27 | Fix |
| CVE-2025-23393 | SUSE Container suse/manager/5.0/x86_64/server:5.0.4.7.19.1 reflected XSS in spacewalk-java | 5.6CNA v4.0 | 0.3% | 2025-05-27 | Fix |
| CVE-2025-23247 | NVIDIA CUDA Toolkit improper length parameter handling | 4.4CNA v3.1 | 0.3% | 2025-05-27 | Exploit codeFix |
| CVE-2025-22377 | Samsung Exynos 980 out-of-bounds write | 6.5CISA ADP v3.1 | 0.3% | 2025-05-27 | Fix |
| CVE-2025-5283 | Google Chrome libvpx use-after-free | 5.4CISA ADP v3.1 | 0.6% | 2025-05-27 | Fix |
| CVE-2025-5281 | Google Chrome BFCache inappropriate implementation | 5.4CISA ADP v3.1 | 0.2% | 2025-05-27 | Fix |
| CVE-2025-5280 | Google Chrome V8 out-of-bounds write | 8.8CISA ADP v3.1 | 2.8% | 2025-05-27 | Fix |
| CVE-2025-5279 | Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider plugin | 7.0CNA v4.0 | 0.3% | 2025-05-27 | Fix |
| CVE-2025-5278 | Red Hat Enterprise Linux 10 coreutils: Heap buffer under-read in gnu coreutils sort | 4.4CNA v3.1 | 0.3% | 2025-05-27 | Fix |
| CVE-2025-5272 | Mozilla memory safety bugs fixed in Firefox 139 and Thunderbird 139 | 7.3CISA ADP v3.1 | 0.3% | 2025-05-27 | Fix |
| CVE-2025-5271 | Mozilla Firefox devtools' preview ignored CSP headers | 6.5CISA ADP v3.1 | 0.3% | 2025-05-27 | Fix |
| CVE-2025-5270 | Mozilla Firefox SNI was sometimes unencrypted | 7.5CISA ADP v3.1 | 0.3% | 2025-05-27 | Fix |
| CVE-2025-5269 | Mozilla memory safety bug fixed in Firefox ESR and Thunderbird | 8.1CISA ADP v3.1 | 0.5% | 2025-05-27 | Fix |
| CVE-2025-5268 | Mozilla memory safety bugs fixed in Firefox 139, Thunderbird 139, Firefox ESR, and Thunderbird | 8.1CISA ADP v3.1 | 0.5% | 2025-05-27 | Fix |
| CVE-2025-5267 | Mozilla Firefox clickjacking vulnerability could have led to leaking saved payment card details | 5.4CISA ADP v3.1 | 0.3% | 2025-05-27 | Fix |
| CVE-2025-5266 | Mozilla Firefox script element events leaked cross-origin resource status | 4.3CISA ADP v3.1 | 0.3% | 2025-05-27 | Fix |
| CVE-2025-5265 | Mozilla Firefox potential local code execution in Copy as cURL command | 4.8CISA ADP v3.1 | 0.2% | 2025-05-27 | Fix |
| CVE-2025-5264 | Mozilla Firefox potential local code execution in Copy as cURL command | 4.8CISA ADP v3.1 | 0.3% | 2025-05-27 | Fix |
| CVE-2025-5263 | Mozilla Firefox error handling for script execution was incorrectly isolated from web content | 4.3CISA ADP v3.1 | 0.2% | 2025-05-27 | Fix |
| CVE-2025-5262 | Mozilla Thunderbird double free | 7.5CISA ADP v3.1 | 0.4% | 2025-05-27 | Fix |
| CVE-2025-5252 | PHPGurukul News Portal Project edit-subadmin.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-27 | |
| CVE-2025-5251 | PHPGurukul News Portal Project edit-subcategory.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-27 | |
| CVE-2025-5250 | PHPGurukul News Portal Project edit-category.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-27 | |
| CVE-2025-5249 | PHPGurukul News Portal Project add-category.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-27 | |
| CVE-2025-5248 | PHPGurukul Company Visitor Management System bwdates-reports-details.php SQL injection | 9.8v3.1 | 0.7% | 2025-05-27 | |
| CVE-2025-5247 | Gowabby HFish url.go LoadUrl improper authentication | 6.9CNA v4.0 | 0.5% | 2025-05-27 | |
| CVE-2025-5246 | Campcodes Online Hospital Management System query-details.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-27 | |
| CVE-2025-5245 | GNU Binutils objdump debug.c debug_type_samep memory corruption | 7.8NVD v3.1 | 0.3% | 2025-05-27 | Fix |
| CVE-2025-5244 | GNU Binutils ld elflink.c elf_gc_sweep memory corruption | 7.8NVD v3.1 | 0.3% | 2025-05-27 | Fix |
| CVE-2025-5232 | PHPGurukul Student Study Center Management System report.php SQL injection | 7.2v3.1 | 0.4% | 2025-05-27 | |
| CVE-2025-5231 | PHPGurukul Company Visitor Management System forgot-password.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-27 | |
| CVE-2025-5230 | PHPGurukul Online Nurse Hiring System bwdates-report-details.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-27 | |
| CVE-2025-5229 | Campcodes Online Hospital Management System view-patient.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-27 | |
| CVE-2025-5228 | D-Link DI-8100 jhttpd login.cgi httpd_get_parm stack-based overflow | 8.7CNA v4.0 | 2.9% | 2025-05-27 | |
| CVE-2025-5227 | PHPGurukul Small CRM manage-tickets.php SQL injection | 6.9CNA v4.0 | 0.4% | 2025-05-27 | |
| CVE-2025-5226 | PHPGurukul Small CRM change-password.php SQL injection | 6.9CNA v4.0 | 0.4% | 2025-05-27 | |
| CVE-2025-5225 | Campcodes Advanced Online Voting System index.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-27 | |
| CVE-2025-5224 | Campcodes Online Hospital Management System add-doctor.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-27 | |
| CVE-2025-5222 | Red Hat Enterprise Linux 10 icu: Stack buffer overflow in the srbroot::addtag function | 7.0CNA v3.1 | 0.4% | 2025-05-27 | Fix |
| CVE-2025-5221 | FreeFloat FTP Server QUOTE command buffer overflow | 9.8v3.1 | 0.7% | 2025-05-27 | |
| CVE-2025-5220 | FreeFloat FTP Server GET command buffer overflow | 9.8v3.1 | 0.7% | 2025-05-27 | |
| CVE-2025-5219 | FreeFloat FTP Server ASCII command buffer overflow | 9.8v3.1 | 0.7% | 2025-05-27 | |
| CVE-2025-5218 | FreeFloat FTP Server LITERAL command buffer overflow | 9.8v3.1 | 0.7% | 2025-05-27 | |
| CVE-2025-5217 | FreeFloat FTP Server RMDIR command buffer overflow | 9.8v3.1 | 0.7% | 2025-05-27 | |
| CVE-2025-5216 | PHPGurukul Student Record System login.php SQL injection | 9.8v3.1 | 0.6% | 2025-05-27 | |
| CVE-2025-5215 | D-Link DCS-5020L ptdc.cgi websReadEvent stack-based overflow | 9.8NVD v3.1 | 1.4% | 2025-05-27 | |
| CVE-2025-5214 | Kashipara Responsive Online Learing Platform course_detail_user_new.php SQL injection | 9.8v3.1 | 0.6% | 2025-05-27 | |
| CVE-2025-5213 | Projectworlds Responsive E-Learning System delete_file.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-27 | |
| CVE-2025-5198 | Stackrox: Xss in Stackrox | 5.0CNA v3.1 | 0.3% | 2025-05-27 | |
| CVE-2025-5117 | Property - missing authorization to Authenticated privilege escalation | 8.8CNA v3.1 | 0.4% | 2025-05-27 | Fix |
| CVE-2025-5067 | Google Chrome Tab Strip inappropriate implementation | 5.4CISA ADP v3.1 | 0.4% | 2025-05-27 | Fix |
| CVE-2025-5066 | Google Chrome messages inappropriate implementation | 6.5CISA ADP v3.1 | 0.4% | 2025-05-27 | Fix |
| CVE-2025-5065 | Google Chrome FileSystemAccess API inappropriate implementation | 6.5CISA ADP v3.1 | 0.4% | 2025-05-27 | Fix |
| CVE-2025-5064 | Google Chrome Background Fetch API inappropriate implementation | 5.4CISA ADP v3.1 | 0.3% | 2025-05-27 | Fix |
| CVE-2025-5063 | Google Chrome Compositing use-after-free | 8.8CISA ADP v3.1 | 3.6% | 2025-05-27 | Fix |
| CVE-2025-4783 | Exclusive Addons for Elementor WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.2% | 2025-05-27 | Fix |
| CVE-2025-4683 | MStore API WordPress plugin unauthorized access | 4.3CNA v3.1 | 0.3% | 2025-05-27 | Fix |
| CVE-2025-4682 | Essential Blocks WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.4% | 2025-05-27 | Fix |
| CVE-2025-4412 | SparkLabs Viscosity TCC Bypass via Dylib Loading in Viscosity.app | 4.8CNA v4.0 | 0.2% | 2025-05-27 | Fix |
| CVE-2025-3704 | Volunteer Sign Up Sheets WordPress plugin cross-site scripting (XSS) | 5.9CNA v3.1 | 0.2% | 2025-05-27 | Fix |
| CVE-2025-2826 | Arista Networks EOS improper quantity validation | 2.6CNA v3.1 | 0.5% | 2025-05-27 | |
| CVE-2025-2796 | Arista EOS IPsec anti-replay protection vulnerability | 5.3CNA v3.1 | 0.2% | 2025-05-27 | |
| CVE-2025-2407 | Mobatime AMX MTAPI web API missing authentication | 9.3CNA v4.0 | 0.5% | 2025-05-27 | Fix |
| CVE-2025-2236 | OpenText Advanced Authentication external service configuration information disclosure | 2.1CNA v4.0 | 0.2% | 2025-05-27 | Fix |
| CVE-2025-46805 | Screen version 5.0.0 and older version 4 releases have a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes when installed setuid-root. | 5.7CNA v4.0 | 0.2% | 2025-05-26 | Fix |
| CVE-2025-46804 | Screen versions allow file existence tests when installed setuid-root | 2.0CNA v4.0 | 0.2% | 2025-05-26 | Fix |
| CVE-2025-46803 | Screen creates by default world-writable PTYs | 5.1CNA v4.0 | 0.2% | 2025-05-26 | Fix |
| CVE-2025-46802 | SUSE Linux Enterprise Micro incorrect permission assignment | 5.3CNA v4.0 | 0.2% | 2025-05-26 | Fix |
| CVE-2025-41655 | Pepperl+Fuchs: Attacker can cause a DoS via URL | 7.5CNA v3.1 | 0.5% | 2025-05-26 | Fix |
| CVE-2025-41654 | Pepperl+Fuchs: Profinet Gateway LB8122A.1.EL Device is affected by information disclosure | 8.2CNA v3.1 | 0.4% | 2025-05-26 | Fix |
| CVE-2025-41441 | SYNCK GRAPHICA Mailform Pro CGI information disclosure through error messages | 5.3v3.1 | 0.4% | 2025-05-26 | Fix |
| CVE-2025-40672 | Privilege escalation in Panloader.exe | 8.5CNA v4.0 | 0.2% | 2025-05-26 | Fix |
| CVE-2025-40671 | SQL injection vulnerability in AES Multimedia's Gestnet | 9.3CNA v4.0 | 0.4% | 2025-05-26 | |
| CVE-2025-40667 | Missing authorization vulnerability in TCMAN GIM v11 | 6.5NVD v3.1 | 0.3% | 2025-05-26 | Fix |
| CVE-2025-40666 | Time-based blind SQL injection vulnerability in TCMAN GIM v11 | 9.8v3.1 | 0.4% | 2025-05-26 | Fix |
| CVE-2025-40665 | Time-based blind SQL injection vulnerability in TCMAN GIM v11 | 9.8v3.1 | 0.4% | 2025-05-26 | Fix |
| CVE-2025-40664 | Missing authentication vulnerability in TCMAN GIM v11 | 9.1v3.1 | 0.6% | 2025-05-26 | Fix |
| CVE-2025-40663 | Stored cross-site scripting (XSS) in i2A-Cronos by i2A | 5.1CNA v4.0 | 0.4% | 2025-05-26 | |
| CVE-2025-40653 | User enumeration in M3M Printer Server Web | 6.9CNA v4.0 | 0.4% | 2025-05-26 | |
| CVE-2025-40652 | Cross-site scripting (XSS) in CoverManager | 5.3CNA v4.0 | 0.4% | 2025-05-26 | |
| CVE-2025-40650 | Insecure direct object reference (IDOR) in Clickedu | 8.7CNA v4.0 | 0.4% | 2025-05-26 | |
| CVE-2025-39498 | Spotlight - Social Media Feeds (Premium) WordPress plugin sensitive data exposure | 5.3CNA v3.1 | 0.3% | 2025-05-26 | Fix |
| CVE-2025-37992 | Linux kernel net_sched null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-26 | Fix |
| CVE-2025-35003 | Apache NuttX RTOS: NuttX Bluetooth Stack HCI and UART DoS/RCE | 9.8CISA ADP v3.1 | 1.5% | 2025-05-26 | Fix |
| CVE-2025-23395 | Local root exploit via `logfile_reopen` in screen with setuid-root bit set | 7.3CNA v4.0 | 0.2% | 2025-05-26 | Fix |
| CVE-2025-23394 | SUSE openSUSE Tumbleweed daily-backup.sh script in cyrus-imapd allows escalation from cyrus to root | 9.8CISA ADP v3.1 | 0.6% | 2025-05-26 | Fix |
| CVE-2025-23392 | SUSE Manager Server SystemsController reflected cross-site scripting | 5.6CNA v4.0 | 0.3% | 2025-05-26 | Fix |
| CVE-2025-5212 | PHPGurukul Employee Record Management System editempexp.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-26 | |
| CVE-2025-5211 | PHPGurukul Employee Record Management System myprofile.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-26 | |
| CVE-2025-5210 | PHPGurukul Employee Record Management System loginerms.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-26 | |
| CVE-2025-5208 | SourceCodester Online Hospital Management System check_availability.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-26 | |
| CVE-2025-5207 | SourceCodester Client Database Management System superadmin_update_profile.php SQL injection | 9.8v3.1 | 0.4% | 2025-05-26 | |
| CVE-2025-5206 | Pixelimity Installation index.php SQL injection | 9.8v3.1 | 0.4% | 2025-05-26 | |
| CVE-2025-5205 | 1000 Projects Daily College Class Work Report Book dcwr_entry.php SQL injection | 9.8v3.1 | 0.6% | 2025-05-26 | |
| CVE-2025-5204 | Open Asset Import Library Assimp MDLMaterialLoader.cpp ParseSkinLump_3DGS_MDL7 out-of-bounds | 7.8v3.1 | 0.3% | 2025-05-26 | Fix |
| CVE-2025-5203 | Open Asset Import Library Assimp ParsingUtils.h SkipSpaces out-of-bounds | 7.8v3.1 | 0.3% | 2025-05-26 | Fix |
| CVE-2025-5202 | Open Asset Import Library Assimp HL1MDLLoader.cpp validate_header out-of-bounds | 7.8v3.1 | 0.3% | 2025-05-26 | Fix |
| CVE-2025-5201 | Open Asset Import Library Assimp LWOLoader.cpp CountVertsAndFacesLWO2 out-of-bounds | 7.8v3.1 | 0.3% | 2025-05-26 | Fix |
| CVE-2025-5200 | Open Asset Import Library Assimp MDLLoader.cpp InternReadFile_Quake1 out-of-bounds | 7.8v3.1 | 0.3% | 2025-05-26 | Fix |
| CVE-2025-5196 | Wing FTP Server Lua Admin console unnecessary privileges | 7.5CNA v4.0 | 1.0% | 2025-05-26 | Exploit code |
| CVE-2025-5186 | thinkgem JeeSite URI Scheme form ResourceLoader.getResource server-side request forgery | 8.8v3.1 | 0.5% | 2025-05-26 | |
| CVE-2025-5185 | Summer Pearl Group Vacation Rental Management Platform cross-site request forgery | 5.3CNA v4.0 | 0.2% | 2025-05-26 | Fix |
| CVE-2025-5184 | Summer Pearl Group Vacation Rental Management Platform HTTP Response header information disclosure | 7.5v3.1 | 0.4% | 2025-05-26 | Fix |
| CVE-2025-5183 | Summer Pearl Group Vacation Rental Management Platform header redirect | 4.7v3.1 | 0.3% | 2025-05-26 | Fix |
| CVE-2025-5182 | Summer Pearl Group Vacation Rental Management Platform Listing authorization | 7.5NVD v3.1 | 0.4% | 2025-05-26 | Fix |
| CVE-2025-5181 | Summer Pearl Group Vacation Rental Management Platform updateListing cross-site scripting | 4.1v3.1 | 0.4% | 2025-05-26 | Fix |
| CVE-2025-5180 | Wondershare Filmora Installer NFWCHK.exe uncontrolled search path | 7.3v3.1 | 0.3% | 2025-05-26 | |
| CVE-2025-5179 | Realce Tecnologia Queue Ticket Kiosk Cadastro de Administrador page index.php cross-site scripting | 3.4NVD v3.1 | 0.3% | 2025-05-26 | |
| CVE-2025-5178 | Realce Tecnologia Queue Ticket Kiosk Image file ajax.php unrestricted upload | 9.8v3.1 | 0.5% | 2025-05-26 | |
| CVE-2025-5177 | Realce Tecnologia Queue Ticket Kiosk Admin Login page index.php cross-site scripting | 4.7v3.1 | 0.6% | 2025-05-26 | |
| CVE-2025-5176 | Realce Tecnologia Queue Ticket Kiosk Admin Login page index.php SQL injection | 9.1v3.1 | 0.5% | 2025-05-26 | |
| CVE-2025-5175 | erdogant pypickle pypickle.py save improper authorization | 5.5v3.1 | 0.2% | 2025-05-26 | Fix |
| CVE-2025-5174 | erdogant pypickle pypickle.py load deserialization | 7.8v3.1 | 0.3% | 2025-05-26 | Fix |
| CVE-2025-5173 | HumanSignal label-studio-ml-backend PT file neural_nets.py load deserialization | 7.8v3.1 | 0.2% | 2025-05-26 | |
| CVE-2025-5172 | Econtrata valida SQL injection | 9.8v3.1 | 0.5% | 2025-05-26 | |
| CVE-2025-5171 | llisoft MTA Maita Training System OpenController.java this.fileService.download unrestricted upload | 9.8v3.1 | 0.5% | 2025-05-26 | |
| CVE-2025-5170 | llisoft MTA Maita Training System AdminShitiController.java AdminShitiListRequestVo SQL injection | 9.8v3.1 | 0.4% | 2025-05-26 | |
| CVE-2025-5169 | Open Asset Import Library Assimp MDLLoader.cpp InternReadFile_3DGS_MDL345 out-of-bounds | 5.5v3.1 | 0.3% | 2025-05-26 | |
| CVE-2025-5168 | Open Asset Import Library Assimp MDLLoader.cpp ImportUVCoordinate_3DGS_MDL345 out-of-bounds | 5.5v3.1 | 0.3% | 2025-05-26 | |
| CVE-2025-5167 | Open Asset Import Library Assimp LWOLoader.h GetS0 out-of-bounds | 5.5v3.1 | 0.3% | 2025-05-26 | Fix |
| CVE-2025-5166 | Open Asset Import Library Assimp MDC file Parser MDCLoader.cpp InternReadFile out-of-bounds | 5.5v3.1 | 0.3% | 2025-05-26 | Fix |
| CVE-2025-5165 | Open Asset Import Library Assimp MDCLoader.cpp ValidateSurfaceHeader out-of-bounds | 5.5v3.1 | 0.3% | 2025-05-26 | Fix |
| CVE-2025-5164 | PerfreeBlog JWT JwtUtil hard-coded key | 8.1v3.1 | 0.7% | 2025-05-26 | |
| CVE-2025-5163 | yangshare Warehouse Management System improper access control | 6.9CNA v4.0 | 0.5% | 2025-05-26 | |
| CVE-2025-5162 | H3C SecCenter SMP-E1114P02 importFile unrestricted upload | 9.8v3.1 | 0.4% | 2025-05-26 | |
| CVE-2025-5161 | H3C SecCenter SMP-E1114P02 download operationDailyOut path traversal | 7.5v3.1 | 0.8% | 2025-05-26 | |
| CVE-2025-5160 | H3C SecCenter SMP-E1114P02 download path traversal | 7.5v3.1 | 0.8% | 2025-05-26 | |
| CVE-2025-5159 | H3C SecCenter SMP-E1114P02 download path traversal | 7.5v3.1 | 0.8% | 2025-05-26 | |
| CVE-2025-4057 | Activemq-artemis-operator: AMQ Broker operator starting credentials reuse | 5.5CNA v3.1 | 0.2% | 2025-05-26 | Fix |
| CVE-2025-4053 | Unauthorized creation of master key in Mifare Classic Be-Tech cards | 6.8CNA v4.0 | 0.1% | 2025-05-26 | Fix |
| CVE-2025-2146 | Canon Satera MF656Cdw buffer overflow | 9.8CNA v3.1 | 0.9% | 2025-05-26 | Fix |
| CVE-2025-1985 | Pepperl+Fuchs: Profinet Gateway LB8122A.1.EL Device is affected by XSS | 6.1CNA v3.1 | 0.3% | 2025-05-26 | Fix |
| CVE-2025-5158 | H3C SecCenter SMP-E1114P02 downloadSoftware path traversal | 7.5v3.1 | 0.8% | 2025-05-25 | |
| CVE-2025-5157 | H3C SecCenter SMP-E1114P02 fileContent path traversal | 7.5v3.1 | 0.8% | 2025-05-25 | |
| CVE-2025-5156 | H3C GR-5400AX aspForm EditWlanMacList buffer overflow | 9.8v3.1 | 0.9% | 2025-05-25 | |
| CVE-2025-5155 | qianfox FoxCMS Article.php batchCope SQL injection | 8.8v3.1 | 0.5% | 2025-05-25 | |
| CVE-2025-5154 | PhonePe App SQLite Database databases cleartext storage in file | 4.4NVD v3.1 | 0.2% | 2025-05-25 | Exploit code |
| CVE-2025-5153 | CMS Made Simple Design Manager module cross-site scripting | 4.8v3.1 | 0.4% | 2025-05-25 | |
| CVE-2025-5152 | Chanjet CRM newActivityedit.php SQL injection | 7.5v3.1 | 0.4% | 2025-05-25 | |
| CVE-2025-5151 | defog-ai introspect analysis_tools.py execute_analysis_code_safely code injection | 7.8v3.1 | 0.3% | 2025-05-25 | |
| CVE-2025-5150 | docarray Web API torch_dataset.py __getitem__ prototype pollution | 8.8v3.1 | 0.7% | 2025-05-25 | |
| CVE-2025-5149 | Wcms Login getallcon getMemberByUid improper authentication | 8.1v3.1 | 0.6% | 2025-05-25 | |
| CVE-2025-5148 | FunAudioLLM InspireMusic Pickle Data model.py load_state_dict deserialization | 4.8CNA v4.0 | 0.2% | 2025-05-25 | |
| CVE-2025-5147 | Netcore NBR1005GPEV2/NBR200V2/B6V2 network_tools tools_ping command injection | 5.3CNA v4.0 | 1.2% | 2025-05-25 | |
| CVE-2025-5146 | Netcore NBR200V2 HTTP header routerd passwd_set command injection | 5.3CNA v4.0 | 1.2% | 2025-05-25 | |
| CVE-2025-5145 | Netcore POWER13 Query String cgi-bin command injection | 5.3CNA v4.0 | 1.2% | 2025-05-25 | |
| CVE-2025-5140 | Seeyon Zhiyuan OA Web Application System ThirdMenuController server-side request forgery | 5.3CNA v4.0 | 0.4% | 2025-05-25 | |
| CVE-2025-5139 | Qualitor Office 365-type Connection testaConexaoOffice365.php command injection | 8.1v3.1 | 2.6% | 2025-05-25 | |
| CVE-2025-5138 | Bitwarden PDF file cross-site scripting | 5.1CNA v4.0 | 0.4% | 2025-05-25 | |
| CVE-2025-5137 | DedeCMS Incomplete Fix sys_verifies.php code injection | 7.2v3.1 | 0.6% | 2025-05-25 | |
| CVE-2025-5136 | Tmall Demo Payment Identifier pay random values | 6.3CNA v4.0 | 0.6% | 2025-05-25 | |
| CVE-2025-48756 | maboroshinokiseki scsir type confusion | 9.8v3.1 | 0.3% | 2025-05-24 | |
| CVE-2025-48755 | In the spiral-rs crate 0.2.0 for Rust, allocation can be attempted for a ZST (zero-sized type). | 9.8v3.1 | 0.3% | 2025-05-24 | |
| CVE-2025-48754 | memory_pages division by zero | 7.5v3.1 | 0.3% | 2025-05-24 | |
| CVE-2025-48753 | obsidiandynamics anode race condition | 9.8v3.1 | 0.2% | 2025-05-24 | |
| CVE-2025-48752 | Forestryks process-sync-rs Process Sync has a potential Unsound issue in SharedMutex | 9.8v3.1 | 0.3% | 2025-05-24 | |
| CVE-2025-48751 | tickbh ProcessLock process_lock has a Potential Unsound issue in unlock | 9.8v3.1 | 0.3% | 2025-05-24 | |
| CVE-2025-5135 | Tmall Demo Product Details page admin cross-site scripting | 6.1v3.1 | 0.3% | 2025-05-24 | |
| CVE-2025-5134 | Tmall Demo Buy Item page cross-site scripting | 6.1v3.1 | 0.3% | 2025-05-24 | |
| CVE-2025-5133 | Tmall Demo Search Box cross-site scripting | 6.1v3.1 | 0.4% | 2025-05-24 | |
| CVE-2025-5132 | Tmall Demo logout cross-site request forgery | 8.8v3.1 | 0.3% | 2025-05-24 | |
| CVE-2025-5131 | Tmall Demo uploadCategoryImage unrestricted upload | 7.2v3.1 | 0.5% | 2025-05-24 | |
| CVE-2025-5130 | Tmall Demo uploadProductImage unrestricted upload | 7.2v3.1 | 0.5% | 2025-05-24 | |
| CVE-2025-5129 | Sangfor 零信任访问控制系统 aTrust MSASN1.dll uncontrolled search path | 6.3NVD v3.1 | 0.3% | 2025-05-24 | |
| CVE-2025-5128 | ScriptAndTools Real-Estate-website-in-PHP Admin Login Panel admin SQL injection | 9.8v3.1 | 0.6% | 2025-05-24 | |
| CVE-2025-5127 | Teledyne Flir AX8 prod.php cross-site scripting | 5.4v3.1 | 0.8% | 2025-05-24 | Emerging Threats |
| CVE-2025-5126 | Teledyne Flir AX8 settingsregional.php setDataTime command injection | 8.7CNA v4.0 | 4.8% | 2025-05-24 | Emerging Threats |
| CVE-2025-5124 | Sony SNC-M1 Administrative interface default credentials | 9.2CNA v4.0 | 1.0% | 2025-05-24 | |
| CVE-2025-5058 | eMagicOne Store Manager for WooCommerce WordPress plugin unauthenticated arbitrary file upload | 9.8CNA v3.1 | 1.4% | 2025-05-24 | Exploit codeFix |
| CVE-2025-5055 | Smart Forms WordPress plugin authenticated (Admin+) stored cross-site scripting | 4.4CNA v3.1 | 0.3% | 2025-05-24 | Fix |
| CVE-2025-4603 | eMagicOne Store Manager for WooCommerce WordPress plugin unauthenticated arbitrary file deletion | 9.1CNA v3.1 | 1.4% | 2025-05-24 | Exploit codeFix |
| CVE-2025-4602 | eMagicOne Store Manager for WooCommerce WordPress plugin unauthenticated arbitrary file read | 7.5v3.1 | 0.7% | 2025-05-24 | Exploit codeFix |
| CVE-2025-4336 | eMagicOne Store Manager for WooCommerce WordPress plugin unauthenticated arbitrary file upload | 9.8v3.1 | 1.3% | 2025-05-24 | Exploit codeFix |
| CVE-2025-4223 | Page Builder: Pagelayer WordPress plugin reflected cross-site scripting | 4.7CNA v3.1 | 0.4% | 2025-05-24 | Fix |
| CVE-2025-3869 | 4stats WordPress plugin cross-site request forgery to stored cross-site scripting | 6.1CNA v3.1 | 0.3% | 2025-05-24 | |
| CVE-2025-48741 | StrangeBee TheHive missing authorization | 6.8CNA v4.0 | 0.3% | 2025-05-23 | Fix |
| CVE-2025-48740 | StrangeBee TheHive cross-site request forgery | 5.9CNA v4.0 | 0.3% | 2025-05-23 | Fix |
| CVE-2025-48739 | StrangeBee TheHive server-side request forgery | 4.6CNA v4.0 | 0.4% | 2025-05-23 | Fix |
| CVE-2025-48738 | StrangeBee TheHive resource exhaustion | 6.9CNA v4.0 | 0.5% | 2025-05-23 | Fix |
| CVE-2025-48735 | BOS IP camera request body processing SQL injection | 4.3CNA v3.1 | 0.3% | 2025-05-23 | Fix |
| CVE-2025-48708 | Artifex Ghostscript improper removal of sensitive information | 3.3NVD v3.1 | 0.3% | 2025-05-23 | Exploit codeFix |
| CVE-2025-48701 | openDCIM SQL injection | 5.4CNA v3.1 | 0.2% | 2025-05-23 | |
| CVE-2025-48695 | CyberDAVA incorrect privilege assignment | 6.4CNA v3.1 | 0.2% | 2025-05-23 | Fix |
| CVE-2025-48378 | Dnn.Platform vulnerable to stored cross-site scripting (XSS) with svg files rendered inline | 6.1CNA v4.0 | 0.3% | 2025-05-23 | Fix |
| CVE-2025-48377 | Dnn.Platform vulnerable to reflected cross-site scripting (XSS) in module actions in edit mode | 6.0CNA v4.0 | 0.2% | 2025-05-23 | Fix |
| CVE-2025-48376 | Dnn.Platform's Site Import could use an external source with a crafted request | 3.5CNA v3.1 | 0.2% | 2025-05-23 | Fix |
| CVE-2025-48375 | Schule Missing Rate Limiting on OTP Email Requests Susceptible to Abuse and DoS | 6.6CNA v4.0 | 0.4% | 2025-05-23 | Fix |
| CVE-2025-48292 | Tourmaster WordPress plugin local file inclusion | 8.1CNA v3.1 | 0.6% | 2025-05-23 | Fix |
| CVE-2025-48289 | Kids Planet WordPress theme PHP object injection | 9.8CNA v3.1 | 0.5% | 2025-05-23 | Fix |
| CVE-2025-48287 | Pix 4x sem juros - Pagaleve WordPress plugin PHP object injection | 9.8CNA v3.1 | 0.5% | 2025-05-23 | Fix |
| CVE-2025-48286 | ReDi Restaurant Reservation WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-05-23 | Fix |
| CVE-2025-48283 | Majestic Support WordPress plugin SQL injection | 9.3CNA v3.1 | 0.4% | 2025-05-23 | Fix |
| CVE-2025-48275 | Visual Header WordPress plugin broken access control | 6.5CNA v3.1 | 0.3% | 2025-05-23 | Fix |
| CVE-2025-48273 | WP Job Portal WordPress plugin arbitrary file download | 7.5CNA v3.1 | 0.5% | 2025-05-23 | Fix |
| CVE-2025-48271 | Leadinfo WordPress plugin settings Change vulnerability | 6.5CNA v3.1 | 0.3% | 2025-05-23 | Fix |
| CVE-2025-48245 | Quick Contact Form WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-05-23 | Fix |
| CVE-2025-48241 | Verge3D WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-05-23 | Fix |
| CVE-2025-47690 | Lead Form Data Collection to CRM WordPress plugin arbitrary option update to privilege escalation | 8.8CNA v3.1 | 0.4% | 2025-05-23 | Fix |
| CVE-2025-47687 | StoreKeeper for WooCommerce WordPress plugin arbitrary file upload | 10.0CNA v3.1 | 0.4% | 2025-05-23 | Fix |
| CVE-2025-47680 | xili-tidy-tags WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-05-23 | |
| CVE-2025-47678 | FunnelCockpit WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-05-23 | Fix |
| CVE-2025-47673 | Arconix Shortcodes WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.2% | 2025-05-23 | Fix |
| CVE-2025-47672 | miniOrange Discord Integration WordPress plugin local file inclusion | 8.1CNA v3.1 | 0.6% | 2025-05-23 | Fix |
| CVE-2025-47671 | Binary MLM Plan WordPress plugin SQL injection | 7.6CNA v3.1 | 0.3% | 2025-05-23 | Fix |
| CVE-2025-47670 | Social Login and Register WordPress plugin local file inclusion | 8.1CNA v3.1 | 0.6% | 2025-05-23 | Fix |
| CVE-2025-47663 | Hospital Management System WordPress plugin arbitrary file upload | 9.9CNA v3.1 | 0.4% | 2025-05-23 | |
| CVE-2025-47660 | WC Affiliate WordPress plugin PHP object injection | 8.8CNA v3.1 | 0.4% | 2025-05-23 | Fix |
| CVE-2025-47658 | elextensions ELEX WordPress HelpDesk and Customer Ticketing System unrestricted file upload | 8.8NVD v3.1 | 0.4% | 2025-05-23 | Fix |
| CVE-2025-47646 | PSW Front-end Login and Registration WordPress plugin broken authentication | 9.8CNA v3.1 | 24.5% | 2025-05-23 | NucleiExploit code |
| CVE-2025-47642 | Ajar in5 Embed WordPress plugin arbitrary file upload | 10.0CNA v3.1 | 0.4% | 2025-05-23 | |
| CVE-2025-47641 | Printcart Web to Print Product Designer for WooCommerce WordPress plugin arbitrary file upload | 10.0CNA v3.1 | 0.4% | 2025-05-23 | Fix |
| CVE-2025-47640 | Printcart Web to Print Product Designer for WooCommerce WordPress plugin SQL injection | 9.3CNA v3.1 | 0.3% | 2025-05-23 | Fix |
| CVE-2025-47637 | STAGGS WordPress plugin arbitrary file upload | 10.0CNA v3.1 | 0.5% | 2025-05-23 | Fix |
| CVE-2025-47631 | Hospital Management System WordPress plugin privilege escalation | 8.8CNA v3.1 | 0.4% | 2025-05-23 | |
| CVE-2025-47619 | 6Storage Rentals WordPress plugin broken access control | 6.5CNA v3.1 | 0.4% | 2025-05-23 | |
| CVE-2025-47618 | BMI Adult and Kid Calculator WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-05-23 | |
| CVE-2025-47613 | School Management System for Wordpress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-05-23 | |
| CVE-2025-47611 | User Meta WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-05-23 | |
| CVE-2025-47603 | belingoGeo WordPress plugin arbitrary file download | 7.5CNA v3.1 | 0.6% | 2025-05-23 | Fix |
| CVE-2025-47599 | Facturante WordPress plugin SQL injection | 9.3CNA v3.1 | 0.3% | 2025-05-23 | Fix |
| CVE-2025-47575 | School Management WordPress plugin SQL injection | 8.5CNA v3.1 | 0.3% | 2025-05-23 | |
| CVE-2025-47568 | ZoomSounds WordPress plugin PHP object injection | 9.8CNA v3.1 | 0.5% | 2025-05-23 | |
| CVE-2025-47558 | MapSVG WordPress plugin broken access control | 7.5CNA v3.1 | 0.4% | 2025-05-23 | Fix |
| CVE-2025-47541 | Mail Mint WordPress plugin sensitive data exposure | 7.5CNA v3.1 | 0.5% | 2025-05-23 | Fix |
| CVE-2025-47539 | Eventin WordPress plugin privilege escalation | 9.8CNA v3.1 | 25.2% | 2025-05-23 | NucleiExploit codeFix |
| CVE-2025-47535 | Opal Woo Custom Product Variation WordPress plugin arbitrary file deletion | 8.6CNA v3.1 | 0.5% | 2025-05-23 | Fix |
| CVE-2025-47532 | CoinPayments.net Payment Gateway for WooCommerce WordPress plugin PHP object injection | 9.8CNA v3.1 | 0.5% | 2025-05-23 | Fix |
| CVE-2025-47530 | WPFunnels WordPress plugin PHP object injection | 9.8CNA v3.1 | 0.5% | 2025-05-23 | Fix |
| CVE-2025-47529 | Experto CTA Widget WordPress plugin UX Design Experts missing authorization | 6.5CNA v3.1 | 0.4% | 2025-05-23 | Fix |
| CVE-2025-47513 | Infocob CRM Forms WordPress plugin arbitrary file download | 4.9CNA v3.1 | 0.5% | 2025-05-23 | Fix |
| CVE-2025-47512 | Tainacan WordPress plugin arbitrary file deletion | 8.6CNA v3.1 | 0.5% | 2025-05-23 | Fix |
| CVE-2025-47492 | Drag and Drop File Upload for Elementor Forms WordPress plugin arbitrary file deletion | 8.6CNA v3.1 | 1.4% | 2025-05-23 | Fix |
| CVE-2025-47478 | ProfileGrid WordPress plugin SQL injection | 8.5CNA v3.1 | 0.4% | 2025-05-23 | Fix |
| CVE-2025-47461 | Subaccounts for WooCommerce WordPress plugin account takeover | 8.8CNA v3.1 | 0.5% | 2025-05-23 | Fix |
| CVE-2025-47458 | B2i Investor Tools WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-05-23 | Fix |
| CVE-2025-47453 | WP Smart Import WordPress plugin local file inclusion | 9.8v3.1 | 0.7% | 2025-05-23 | Fix |
| CVE-2025-47438 | WP Job Portal WordPress plugin local file inclusion | 9.8v3.1 | 0.7% | 2025-05-23 | Fix |
| CVE-2025-47149 | Digital Arts i-FILTER use of a less trusted source | 6.9CNA v4.0 | 0.2% | 2025-05-23 | |
| CVE-2025-46539 | Fable Extra WordPress plugin SQL injection | 9.3CNA v3.1 | 0.4% | 2025-05-23 | Fix |
| CVE-2025-46537 | Section Widget WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-05-23 | |
| CVE-2025-46527 | Web3Press Decentralize Publishing with Writing NFT WordPress plugin arbitrary file read | 6.5CNA v3.1 | 0.5% | 2025-05-23 | Fix |
| CVE-2025-46526 | My Custom Widgets WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-05-23 | |
| CVE-2025-46518 | IGIT Related Posts With Thumb Image After Posts WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-05-23 | Fix |
| CVE-2025-46515 | Category Widget WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-05-23 | |
| CVE-2025-46493 | Crossword Compiler Puzzles WordPress plugin cross-site scripting (XSS) | 6.5CNA v3.1 | 0.3% | 2025-05-23 | Fix |
| CVE-2025-46490 | Crossword Compiler Puzzles WordPress plugin arbitrary file upload | 9.9CNA v3.1 | 0.5% | 2025-05-23 | Fix |
| CVE-2025-46488 | Visual Builder WordPress plugin broken access control | 7.1CNA v3.1 | 0.3% | 2025-05-23 | Fix |
| CVE-2025-46487 | EC Authorize.net WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-05-23 | |
| CVE-2025-46486 | Nomupay Payment Processing Gateway WordPress plugin arbitrary file download | 4.9CNA v3.1 | 0.5% | 2025-05-23 | Fix |
| CVE-2025-46474 | SEUR Oficial WordPress plugin local file inclusion | 8.1CNA v3.1 | 0.8% | 2025-05-23 | Fix |
| CVE-2025-46468 | Fable Extra WordPress plugin local file inclusion | 9.8CNA v3.1 | 0.6% | 2025-05-23 | Fix |
| CVE-2025-46463 | Mailing Group Listserv WordPress plugin SQL injection | 8.5CNA v3.1 | 0.4% | 2025-05-23 | Fix |
| CVE-2025-46460 | Easy Guide WordPress plugin SQL injection | 9.3CNA v3.1 | 0.4% | 2025-05-23 | |
| CVE-2025-46458 | occupancyplan WordPress plugin CSRF to SQL injection | 8.2CNA v3.1 | 0.2% | 2025-05-23 | |
| CVE-2025-46456 | Theme Blvd Sliders WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-05-23 | |
| CVE-2025-46455 | WP HRM LITE WordPress plugin SQL injection | 9.3CNA v3.1 | 0.4% | 2025-05-23 | |
| CVE-2025-46454 | Meta Keywords and Description WordPress plugin local file inclusion | 7.5CNA v3.1 | 0.7% | 2025-05-23 | |
| CVE-2025-46448 | Document Management System WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-05-23 | |
| CVE-2025-46446 | Libro de Reclamaciones WordPress plugin cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-05-23 | |
| CVE-2025-46444 | Ads Pro WordPress plugin local file inclusion | 8.1CNA v3.1 | 0.8% | 2025-05-23 | |
| CVE-2025-46440 | kStats Reloaded WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-05-23 | |
| CVE-2025-46437 | Tayori Form WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-05-23 | |
| CVE-2025-46176 | D-Link DIR-605L Telnet service hard-coded credentials | 6.5CISA ADP v3.1 | 0.4% | 2025-05-23 | |
| CVE-2025-44998 | prasathmani TinyFileManager component / stored cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-05-23 | |
| CVE-2025-43860 | OpenEMR Patient Demographics additional addresses stored cross-site scripting | 7.6CNA v3.1 | 14.4% | 2025-05-23 | Fix |
| CVE-2025-41407 | ManageEngine ADAudit Plus SQL injection | 8.3CNA v3.1 | 1.5% | 2025-05-23 | Fix |
| CVE-2025-41380 | Injection vulnerability in Iridium Certus 700 | 6.1CNA v4.0 | 0.1% | 2025-05-23 | |
| CVE-2025-41379 | Injection vulnerability in Iridium Certus 700 | 6.3CNA v4.0 | 0.4% | 2025-05-23 | |
| CVE-2025-41378 | Injection vulnerability in Iridium Certus 700 | 6.9CNA v4.0 | 0.2% | 2025-05-23 | |
| CVE-2025-41377 | SQL injection vulnerability in Gandia Integra Total | 8.7CNA v4.0 | 0.4% | 2025-05-23 | Fix |
| CVE-2025-39536 | WordPress JobHunt Job Alerts plugin arbitrary content deletion vulnerability | 8.2CNA v3.1 | 0.4% | 2025-05-23 | |
| CVE-2025-39506 | Nasa Core WordPress plugin local file inclusion | 8.1CNA v3.1 | 0.8% | 2025-05-23 | |
| CVE-2025-39505 | Goodlayers Hotel WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-05-23 | |
| CVE-2025-39504 | Goodlayers Hotel WordPress plugin SQL injection | 9.3CNA v3.1 | 0.4% | 2025-05-23 | |
| CVE-2025-39503 | Goodlayers Hotel WordPress plugin PHP object injection | 9.8CNA v3.1 | 0.6% | 2025-05-23 | |
| CVE-2025-39502 | Goodlayers Hostel WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-05-23 | |
| CVE-2025-39501 | Goodlayers Hostel WordPress plugin SQL injection | 9.3CNA v3.1 | 0.4% | 2025-05-23 | |
| CVE-2025-39500 | Goodlayers Hostel WordPress plugin PHP object injection | 9.8CNA v3.1 | 0.6% | 2025-05-23 | |
| CVE-2025-39499 | Medicare WordPress theme PHP object injection | 9.8CNA v3.1 | 0.6% | 2025-05-23 | Fix |
| CVE-2025-39495 | Avantage WordPress theme PHP object injection | 9.8CNA v3.1 | 0.6% | 2025-05-23 | Fix |
| CVE-2025-39494 | Wilmër WordPress theme local file inclusion | 9.8v3.1 | 0.7% | 2025-05-23 | Fix |
| CVE-2025-39490 | Backpack Traveler WordPress theme local file inclusion | 8.1CNA v3.1 | 0.8% | 2025-05-23 | Fix |
| CVE-2025-39489 | CouponXL WordPress theme privilege escalation | 9.8CNA v3.1 | 0.5% | 2025-05-23 | Fix |
| CVE-2025-39485 | Grand Tour WordPress theme ThemeGoods deserialization of untrusted data | 9.8CNA v3.1 | 0.6% | 2025-05-23 | |
| CVE-2025-39480 | Car Dealer WordPress theme PHP object injection | 9.8CNA v3.1 | 0.6% | 2025-05-23 | Fix |
| CVE-2025-36527 | ManageEngine ADAudit Plus SQL injection | 8.3CNA v3.1 | 38.3% | 2025-05-23 | Fix |
| CVE-2025-32967 | OpenEMR doesn't log password administration properly | 5.4CNA v3.1 | 0.3% | 2025-05-23 | Fix |
| CVE-2025-32794 | OpenEMR stored XSS via Patient Name field in Procedure Orders | 7.6CNA v3.1 | 10.1% | 2025-05-23 | Fix |
| CVE-2025-32309 | Healsoul WordPress theme local file inclusion | 8.1CNA v3.1 | 0.8% | 2025-05-23 | Fix |
| CVE-2025-32302 | Winnex WordPress theme local file inclusion | 8.1CNA v3.1 | 0.8% | 2025-05-23 | |
| CVE-2025-32294 | Oxpitan WordPress theme local file inclusion | 8.1CNA v3.1 | 0.8% | 2025-05-23 | Fix |
| CVE-2025-32293 | Finance Consultant WordPress theme PHP object injection | 8.8CNA v3.1 | 0.6% | 2025-05-23 | |
| CVE-2025-32292 | Jarvis Night Club, Concert, Festival WordPress theme PHP object injection | 9.8CNA v3.1 | 0.6% | 2025-05-23 | |
| CVE-2025-32289 | Yozi WordPress theme local file inclusion | 8.1CNA v3.1 | 0.8% | 2025-05-23 | Fix |
| CVE-2025-32286 | Butcher WordPress theme local file inclusion | 8.1CNA v3.1 | 0.8% | 2025-05-23 | |
| CVE-2025-32285 | Butcher WordPress theme cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-05-23 | Fix |
| CVE-2025-32284 | Pet World WordPress theme PHP object injection | 8.8CNA v3.1 | 0.6% | 2025-05-23 | |
| CVE-2025-31927 | WordPress Acerola theme PHP object injection | 9.8CNA v3.1 | 0.6% | 2025-05-23 | |
| CVE-2025-31924 | Crafts and Arts WordPress theme PHP object injection | 8.8CNA v3.1 | 0.6% | 2025-05-23 | |
| CVE-2025-31918 | Simple Business Directory Pro WordPress plugin privilege escalation | 9.8CNA v3.1 | 0.5% | 2025-05-23 | Fix |
| CVE-2025-31916 | JP Students Result Management System Premium WordPress plugin arbitrary file upload | 9.0CNA v3.1 | 0.4% | 2025-05-23 | |
| CVE-2025-31914 | Pixel Form BuilderPlugin and Autoresponder WordPress plugin SQL injection | 9.3CNA v3.1 | 0.4% | 2025-05-23 | Fix |
| CVE-2025-31913 | Ogami WordPress theme local file inclusion | 8.1CNA v3.1 | 0.8% | 2025-05-23 | Fix |
| CVE-2025-31912 | Enzio - Responsive Business WordPress theme local file inclusion | 8.1CNA v3.1 | 0.8% | 2025-05-23 | Fix |
| CVE-2025-31636 | WP Post Modules for Elementor WordPress plugin reflected cross-site scripting (XSS) | 7.1CNA v3.1 | 0.3% | 2025-05-23 | |
| CVE-2025-31633 | Kiamo - Responsive Business Service WordPress theme local file inclusion | 8.1CNA v3.1 | 0.8% | 2025-05-23 | Fix |
| CVE-2025-31632 | WordPress La Boom theme local file inclusion | 8.1CNA v3.1 | 0.8% | 2025-05-23 | |
| CVE-2025-31631 | Fish House WordPress theme PHP object injection | 9.8CNA v3.1 | 0.6% | 2025-05-23 | |
| CVE-2025-31430 | WordPress The Business theme PHP object injection | 9.8CNA v3.1 | 0.6% | 2025-05-23 | |
| CVE-2025-31423 | Umberto WordPress theme PHP object injection | 9.8CNA v3.1 | 0.6% | 2025-05-23 | |
| CVE-2025-31397 | Bus Ticket Booking with Seat Reservation for WooCommerce WordPress plugin SQL injection | 9.3CNA v3.1 | 0.4% | 2025-05-23 | |
| CVE-2025-31069 | HotStar Multi-Purpose Business WordPress theme PHP object injection | 9.8CNA v3.1 | 0.6% | 2025-05-23 | |
| CVE-2025-31064 | Vizeon WordPress theme local file inclusion | 8.1CNA v3.1 | 0.8% | 2025-05-23 | Fix |
| CVE-2025-31060 | Capie WordPress theme local file inclusion | 8.1CNA v3.1 | 0.8% | 2025-05-23 | Fix |
| CVE-2025-31056 | WhatsCart WordPress plugin SQL injection | 9.3CNA v3.1 | 0.4% | 2025-05-23 | |
| CVE-2025-31053 | KBx Pro Ultimate WordPress plugin arbitrary file deletion | 7.7CNA v3.1 | 0.5% | 2025-05-23 | Fix |
| CVE-2025-31049 | WordPress Dash theme PHP object injection | 9.8CNA v3.1 | 0.6% | 2025-05-23 | |
| CVE-2025-24917 | Tenable Network Monitor improper access control leads to local privilege escalation | 7.8CNA v3.1 | 0.2% | 2025-05-23 | Fix |
| CVE-2025-24916 | Tenable Network Monitor improper access control leads to Local Priviledge Escalation | 7.0CNA v3.1 | 0.1% | 2025-05-23 | Fix |
| CVE-2025-5119 | Emlog Pro api_controller.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-23 | |
| CVE-2025-5114 | easysoft zentaopms Editor index.php edit deserialization | 9.1v3.1 | 0.5% | 2025-05-23 | |
| CVE-2025-5112 | FreeFloat FTP Server MGET command buffer overflow | 9.8v3.1 | 0.7% | 2025-05-23 | |
| CVE-2025-5111 | FreeFloat FTP Server type command buffer overflow | 9.8v3.1 | 0.7% | 2025-05-23 | |
| CVE-2025-5110 | FreeFloat FTP Server VERBOSE command buffer overflow | 9.8v3.1 | 0.7% | 2025-05-23 | |
| CVE-2025-5109 | FreeFloat FTP Server STATUS command buffer overflow | 9.8v3.1 | 0.7% | 2025-05-23 | |
| CVE-2025-5108 | zongzhige ShopXO ZIP File Payment.php upload unrestricted upload | 9.8v3.1 | 0.4% | 2025-05-23 | |
| CVE-2025-5107 | Fujian Kelixun xml_cdr_details.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-23 | |
| CVE-2025-5106 | Fujian Kelixun Filename fax_view.php os command injection | 6.9CNA v4.0 | 2.1% | 2025-05-23 | |
| CVE-2025-5105 | TOZED ZLT W51 Service Port 7777 heap inspection | 6.9CNA v4.0 | 0.4% | 2025-05-23 | |
| CVE-2025-5100 | KL-001-2025-005: Mobile Dynamix PrinterShare Mobile Print double free Memory Write | 8.0CISA ADP v3.1 | 0.3% | 2025-05-23 | |
| CVE-2025-5099 | KL-001-2025-004: Mobile Dynamix PrinterShare Mobile Print out-of-bounds write | 9.8CISA ADP v3.1 | 0.7% | 2025-05-23 | |
| CVE-2025-5098 | KL-001-2025-003: Mobile Dynamix PrinterShare Mobile Print Gmail Oauth token disclosure | 9.1CISA ADP v3.1 | 0.3% | 2025-05-23 | |
| CVE-2025-5096 | TablePress WordPress plugin DOM-based stored cross-site scripting | 5.4v3.1 | 0.4% | 2025-05-23 | Fix |
| CVE-2025-4692 | ABUP IoT Cloud Platform incorrect privilege assignment | 5.9CNA v4.0 | 0.3% | 2025-05-23 | |
| CVE-2025-4594 | Tournamatch WordPress plugin authenticated (Contributor+) stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-05-23 | Fix |
| CVE-2025-4379 | Reflected XSS in DobryCMS | 5.1CNA v4.0 | 0.5% | 2025-05-23 | Fix |
| CVE-2025-3895 | Low token entropy in MegaBIP | 9.1CNA v4.0 | 0.5% | 2025-05-23 | Fix |
| CVE-2025-3894 | Stored XSS in MegaBIP | 4.8CNA v4.0 | 0.4% | 2025-05-23 | Fix |
| CVE-2025-3893 | SQL injection in MegaBIP | 8.6CNA v4.0 | 0.4% | 2025-05-23 | Fix |
| CVE-2025-3580 | Grafana improper access control | 5.5CNA v3.1 | 0.5% | 2025-05-23 | Fix |
| CVE-2025-2394 | Disclosure of Alibaba (OSS) Keys in Ecovacs Home Android and iOS Mobile Applications | 4.7CNA v4.0 | 0.2% | 2025-05-23 | |
| CVE-2025-1123 | Solid Mail WordPress plugin stored cross-site scripting | 7.2CNA v3.1 | 0.4% | 2025-05-23 | Fix |
| CVE-2025-48374 | project-zot zot Keycloak OIDC login information disclosure | 5.5CNA v4.0 | 0.2% | 2025-05-22 | Fix |
| CVE-2025-48373 | Schule has Client-Side Role-Based Access Control (RBAC) Bypass vulnerability | 6.6CNA v4.0 | 0.4% | 2025-05-22 | Fix |
| CVE-2025-48372 | Schule has Insecure OTP Length, is Susceptible to brute-force Attacks | 6.6CNA v4.0 | 0.3% | 2025-05-22 | Fix |
| CVE-2025-48371 | OpenFGA authorization bypass | 5.8CNA v4.0 | 0.5% | 2025-05-22 | Fix |
| CVE-2025-48369 | GroupOffice vulnerable to stored XSS in Tasks Comment Section | 5.3CNA v4.0 | 0.3% | 2025-05-22 | Fix |
| CVE-2025-48368 | GroupOffice's DOM-based XSS in all Date Input fields allows arbitrary JavaScript Execution | 5.8CNA v4.0 | 0.3% | 2025-05-22 | Fix |
| CVE-2025-48366 | Intermesh Group-Office phone number field stored cross-site scripting | 6.9CNA v4.0 | 0.3% | 2025-05-22 | Fix |
| CVE-2025-48075 | Fiber panics when fiber.Ctx.BodyParser parses invalid range index | 7.7CNA v4.0 | 0.5% | 2025-05-22 | Fix |
| CVE-2025-48066 | wire-webapp has no database deletion on client logout | 6.0CNA v3.1 | 0.1% | 2025-05-22 | Fix |
| CVE-2025-48061 | wire-webapp has Insufficient Session Invalidation after User Logout | 5.6CNA v3.1 | 0.1% | 2025-05-22 | Fix |
| CVE-2025-47780 | asterisk cli_permissions.conf: Deny option does not work for disallowing shell commands | 4.8CNA v4.0 | 0.3% | 2025-05-22 | Fix |
| CVE-2025-47779 | asterisk using malformed From header can forge identity with; or null in name portion | 7.7CNA v3.1 | 0.5% | 2025-05-22 | Fix |
| CVE-2025-47181 | Microsoft Edge (Chromium-based) update elevation of privilege | 8.8CNA v3.1 | 0.6% | 2025-05-22 | Exploit codeFix |
| CVE-2025-46716 | Sandboxie arbitrary Kernel Read in SbieDrv.sys API (API_SET_SECURE_PARAM) | 5.5CNA v3.1 | 0.2% | 2025-05-22 | Fix |
| CVE-2025-46715 | Sandboxie arbitrary Kernel Write in SbieDrv.sys API (API_GET_SECURE_PARAM) | 7.8CNA v3.1 | 0.2% | 2025-05-22 | Fix |
| CVE-2025-46714 | Sandboxie has Pool buffer overflow in SbieDrv.sys API (API_GET_SECURE_PARAM) | 7.8CNA v3.1 | 0.2% | 2025-05-22 | Fix |
| CVE-2025-46713 | Sandboxie has Pool buffer overflow in SbieDrv.sys API (API_SET_SECURE_PARAM) | 7.8CNA v3.1 | 0.2% | 2025-05-22 | |
| CVE-2025-45472 | Lumigo Autodeploy-layer insecure permissions | 8.8CISA ADP v3.1 | 0.4% | 2025-05-22 | |
| CVE-2025-45471 | Lumigo Measure-cold-start insecure permissions | 8.8CISA ADP v3.1 | 0.4% | 2025-05-22 | |
| CVE-2025-45468 | Devsapp Fc-stable-diffusion insecure permissions | 8.8CISA ADP v3.1 | 0.4% | 2025-05-22 | |
| CVE-2025-43596 | MSP360 Backup (for Windows) insecure filesystem permissions | 9.8v3.1 | 0.4% | 2025-05-22 | Fix |
| CVE-2025-41403 | ManageEngine ADAudit Plus SQL injection | 8.3CNA v3.1 | 1.7% | 2025-05-22 | Fix |
| CVE-2025-33138 | IBM Aspera Faspex HTML injection | 5.4CNA v3.1 | 0.3% | 2025-05-22 | Fix |
| CVE-2025-33137 | IBM Aspera Faspex information disclosure | 7.1CNA v3.1 | 0.3% | 2025-05-22 | Fix |
| CVE-2025-33136 | IBM Aspera Faspex information disclosure | 7.1CNA v3.1 | 0.3% | 2025-05-22 | Fix |
| CVE-2025-32915 | Checkmk sensitive data exposed during automatic agent updates | 4.3CNA v4.0 | 0.1% | 2025-05-22 | Fix |
| CVE-2025-32815 | Infoblox Netmri improper authentication | 6.5CISA ADP v3.1 | 39.7% | 2025-05-22 | NucleiEmerging ThreatsFix |
| CVE-2025-32814 | Infoblox Netmri SQL injection | 9.8CISA ADP v3.1 | 36.4% | 2025-05-22 | NucleiEmerging ThreatsFix |
| CVE-2025-32813 | Infoblox Netmri command injection | 7.2CISA ADP v3.1 | 43.9% | 2025-05-22 | NucleiEmerging ThreatsFix |
| CVE-2025-30173 | ABB ASPECT-Enterprise admin Authorized file upload | 6.0CNA v4.0 | 0.3% | 2025-05-22 | Fix |
| CVE-2025-30172 | ABB ASPECT-Enterprise admin Authorized remote code execution | 8.9CNA v4.0 | 0.5% | 2025-05-22 | Fix |
| CVE-2025-30171 | ABB ASPECT-Enterprise Admin Authorized System file deletion | 7.3CNA v4.0 | 0.3% | 2025-05-22 | Fix |
| CVE-2025-30170 | ABB ASPECT-Enterprise admin Authorized Exposure of file path, file size or file existence | 5.9CNA v4.0 | 0.3% | 2025-05-22 | Fix |
| CVE-2025-30169 | ABB ASPECT-Enterprise Admin Authorized file upload and Execute PHP | 6.0CNA v4.0 | 0.3% | 2025-05-22 | Fix |
| CVE-2025-23183 | UBtech URL redirection to untrusted site (open redirect) | 6.1CNA v3.1 | 0.2% | 2025-05-22 | |
| CVE-2025-23182 | UBtech observable discrepancy | 4.3CNA v3.1 | 0.3% | 2025-05-22 | |
| CVE-2025-5081 | Campcodes Cybercafe Management System adminprofile.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-22 | |
| CVE-2025-5080 | Tenda FH451 webExcptypemanFilter stack-based overflow | 8.7CNA v4.0 | 1.0% | 2025-05-22 | |
| CVE-2025-5079 | PHPGurukul/Campcodes Online Shopping Portal updateorder.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-22 | |
| CVE-2025-5078 | PHPGurukul/Campcodes Online Shopping Portal subcategory.php SQL injection | 9.8v3.1 | 0.6% | 2025-05-22 | |
| CVE-2025-5077 | Campcodes Online Shopping Portal edit-subcategory.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-22 | |
| CVE-2025-5076 | FreeFloat FTP Server SEND command buffer overflow | 9.8v3.1 | 0.7% | 2025-05-22 | |
| CVE-2025-5075 | FreeFloat FTP Server DEBUG command buffer overflow | 9.8v3.1 | 0.7% | 2025-05-22 | |
| CVE-2025-5074 | FreeFloat FTP Server PROMPT command buffer overflow | 9.8v3.1 | 0.7% | 2025-05-22 | |
| CVE-2025-5073 | FreeFloat FTP Server MKDIR command buffer overflow | 9.8v3.1 | 0.7% | 2025-05-22 | |
| CVE-2025-5062 | WooCommerce WordPress plugin PostMessage-based cross-site scripting | 6.1CNA v3.1 | 0.4% | 2025-05-22 | Fix |
| CVE-2025-5024 | Red Hat Enterprise Linux 10 resource leak | 7.4CNA v3.1 | 0.8% | 2025-05-22 | Fix |
| CVE-2025-4979 | Insufficient granularity of access control in GitLab | 4.9CNA v3.1 | 0.4% | 2025-05-22 | Fix |
| CVE-2025-4975 | Tapo privilege escalation on shared devices using notifications | 4.8CNA v4.0 | 0.1% | 2025-05-22 | Fix |
| CVE-2025-4575 | OpenSSL the x509 application adds trusted use instead of rejected use | 6.5CISA ADP v3.1 | 0.4% | 2025-05-22 | Fix |
| CVE-2025-4419 | Hot Random Image WordPress plugin path traversal to authenticated limited arbitrary Image access | 4.3CNA v3.1 | 0.4% | 2025-05-22 | Fix |
| CVE-2025-4405 | Hot Random Image WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-05-22 | Fix |
| CVE-2025-4366 | Cloudflare Pingora pingora-proxy caching HTTP request smuggling | 6.1NVD v3.1 | 0.5% | 2025-05-22 | Fix |
| CVE-2025-4338 | Lantronix Device Installer improper restriction of XML external entity reference | 6.9CNA v4.0 | 0.2% | 2025-05-22 | |
| CVE-2025-4280 | Poedit TCC Bypass via Inherited Permissions in Bundled Interpreter in Poedit.app | 4.8CNA v4.0 | 0.2% | 2025-05-22 | Fix |
| CVE-2025-4133 | Blog2Social: Social Media Auto Post and Scheduler WordPress plugin Contributor+ stored XSS | 5.4CISA ADP v3.1 | 0.3% | 2025-05-22 | Fix |
| CVE-2025-4123 | Grafana cross-site-scripting (XSS) via custom loaded frontend plugin | 7.6CNA v3.1 | 97.0% | 2025-05-22 | Reported exploitedNucleiEmerging ThreatsExploit codeFix |
| CVE-2025-3945 | Tridium Niagara Framework improper neutralization of argument delimiters in a command | 7.2CNA v3.1 | 0.7% | 2025-05-22 | Fix |
| CVE-2025-3944 | Tridium Niagara Framework incorrect permission assignment for critical resource | 7.2CNA v3.1 | 0.5% | 2025-05-22 | KCVFix |
| CVE-2025-3943 | Tridium Niagara Framework use of GET request method with sensitive query strings | 4.1CNA v3.1 | 10.7% | 2025-05-22 | Emerging ThreatsKCVFix |
| CVE-2025-3942 | Tridium Niagara Framework improper output neutralization for logs | 4.3CNA v3.1 | 0.3% | 2025-05-22 | Fix |
| CVE-2025-3941 | Tridium Niagara Framework Improper Handling of Windows: DATA Alternate Data Stream | 5.4CNA v3.1 | 0.5% | 2025-05-22 | Fix |
| CVE-2025-3940 | Improper Use of Validation Framework | 5.3CNA v3.1 | 0.4% | 2025-05-22 | Fix |
| CVE-2025-3939 | Tridium Niagara Framework observable response discrepancy | 5.3CNA v3.1 | 0.3% | 2025-05-22 | Fix |
| CVE-2025-3938 | Tridium Niagara Framework missing cryptographic step | 6.8CNA v3.1 | 0.3% | 2025-05-22 | Fix |
| CVE-2025-3937 | Tridium Niagara Framework use of password hash with insufficient computational effort | 7.7CNA v3.1 | 0.4% | 2025-05-22 | Fix |
| CVE-2025-3936 | Tridium Niagara Framework incorrect permission assignment for critical resource | 6.5CNA v3.1 | 0.4% | 2025-05-22 | Fix |
| CVE-2025-3887 | GStreamer H265 Codec Parsing stack-based buffer overflow remote code execution | 8.8CNA v3.0 | 0.9% | 2025-05-22 | Fix |
| CVE-2025-3885 | Harman Becker MGU21 Bluetooth improper input validation denial of service | 6.5v3.1 | 0.3% | 2025-05-22 | |
| CVE-2025-3884 | Cloudera Hue Ace Editor directory traversal information disclosure | 7.5CNA v3.0 | 1.7% | 2025-05-22 | |
| CVE-2025-3883 | eCharge Hardy Barth cPH2 index.php command injection remote code execution | 8.8CNA v3.0 | 0.7% | 2025-05-22 | |
| CVE-2025-3882 | eCharge Hardy Barth cPH2 nwcheckexec.php dest command injection remote code execution | 8.8CNA v3.0 | 0.7% | 2025-05-22 | |
| CVE-2025-3881 | eCharge Hardy Barth cPH2 check_req.php ntp command injection remote code execution | 8.8CNA v3.0 | 0.7% | 2025-05-22 | |
| CVE-2025-3836 | ManageEngine ADAudit Plus SQL injection | 8.3CNA v3.1 | 5.9% | 2025-05-22 | Fix |
| CVE-2025-3486 | Allegra isZipEntryValide directory traversal remote code execution | 8.8v3.1 | 1.5% | 2025-05-22 | Fix |
| CVE-2025-3484 | MedDream PACS Server DICOM File Parsing stack-based buffer overflow remote code execution | 9.8CNA v3.0 | 1.0% | 2025-05-22 | |
| CVE-2025-3483 | MedDream PACS Server DICOM File Parsing stack-based buffer overflow remote code execution | 7.8NVD v3.1 | 0.6% | 2025-05-22 | |
| CVE-2025-3482 | MedDream PACS Server DICOM File Parsing stack-based buffer overflow remote code execution | 7.8NVD v3.1 | 0.6% | 2025-05-22 | |
| CVE-2025-3481 | MedDream PACS Server DICOM File Parsing stack-based buffer overflow remote code execution | 7.8NVD v3.1 | 0.6% | 2025-05-22 | |
| CVE-2025-3480 | MedDream web DICOM Viewer cleartext transmission of Credentials information disclosure | 6.5v3.1 | 0.2% | 2025-05-22 | |
| CVE-2025-3444 | ManageEngine ServiceDesk Plus MSP local file inclusion | 6.5CNA v3.1 | 1.6% | 2025-05-22 | Fix |
| CVE-2025-3111 | Allocation of resources without limits or throttling in GitLab | 6.5CNA v3.1 | 0.5% | 2025-05-22 | Fix |
| CVE-2025-2853 | Allocation of resources without limits or throttling in GitLab | 6.5CNA v3.1 | 0.5% | 2025-05-22 | Fix |
| CVE-2025-2759 | GStreamer incorrect permission assignment local privilege escalation | 7.8v3.1 | 0.1% | 2025-05-22 | Fix |
| CVE-2025-2506 | EnterpriseDB pglogical missing authorization | 5.3CNA v3.1 | 0.3% | 2025-05-22 | Fix |
| CVE-2025-2410 | ABB ASPECT-Enterprise admin Authorized Port (iptables) manipulation (open/close/disable ports) | 8.9CNA v4.0 | 0.5% | 2025-05-22 | Fix |
| CVE-2025-2409 | ABB ASPECT-Enterprise Admin Authorized System file corruption | 8.9CNA v4.0 | 0.5% | 2025-05-22 | Fix |
| CVE-2025-2272 | Privilege escalation and arbitrary code execution in F1E Endpoint | 7.3CNA v4.0 | 0.2% | 2025-05-22 | Fix |
| CVE-2025-1110 | Insufficient granularity of access control in GitLab | 2.7CNA v3.1 | 0.3% | 2025-05-22 | Fix |
| CVE-2025-0993 | Allocation of resources without limits or throttling in GitLab | 7.5CNA v3.1 | 0.5% | 2025-05-22 | Fix |
| CVE-2025-0679 | Exposure of private personal information to an unauthorized actor in GitLab | 4.3CNA v3.1 | 0.3% | 2025-05-22 | Fix |
| CVE-2025-0605 | Weak authentication in GitLab | 4.6CNA v3.1 | 0.3% | 2025-05-22 | Fix |
| CVE-2025-48417 | eCharge Hardy Barth cPH2 and cPP2 charging stations HTTPS web interface hard-coded cryptographic key | 6.5CISA ADP v3.1 | 0.2% | 2025-05-21 | |
| CVE-2025-48416 | Backdoor Functionality via SSH in eCharge Hardy Barth cPH2 / cPP2 charging stations | 8.1CISA ADP v3.1 | 0.5% | 2025-05-21 | |
| CVE-2025-48415 | Backdoor Functionality via USB Drive in eCharge Hardy Barth cPH2 / cPP2 charging stations | 6.2CISA ADP v3.1 | 0.2% | 2025-05-21 | |
| CVE-2025-48414 | Hard-coded web interface credentials in eCharge Hardy Barth cPH2 / cPP2 charging stations | 6.5CISA ADP v3.1 | 0.3% | 2025-05-21 | |
| CVE-2025-48413 | Hard-coded OS root credentials in eCharge Hardy Barth cPH2 / cPP2 charging stations | 7.7CISA ADP v3.1 | 0.2% | 2025-05-21 | |
| CVE-2025-48207 | reint_downloadmanager TYPO3 extension is susceptible to insecure direct object reference | 8.6CNA v3.1 | 0.4% | 2025-05-21 | Fix |
| CVE-2025-48206 | The Backup Plus extension for TYPO3 (ns_backup) allows XSS | 6.1CISA ADP v3.1 | 0.2% | 2025-05-21 | Fix |
| CVE-2025-48205 | The Front End User Registration extension for TYPO3 allows insecure direct object reference | 8.6CNA v3.1 | 0.4% | 2025-05-21 | Fix |
| CVE-2025-48204 | The Backup Plus extension for TYPO3 (ns_backup) allows command injections | 6.8CNA v3.1 | 0.8% | 2025-05-21 | Fix |
| CVE-2025-48203 | SEO (cs_seo) TYPO3 extension cross-site scripting (XSS) | 6.4CNA v3.1 | 0.2% | 2025-05-21 | Fix |
| CVE-2025-48202 | The femanager TYPO3 extension allows insecure direct object reference | 5.3CNA v3.1 | 0.3% | 2025-05-21 | Fix |
| CVE-2025-48201 | The Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location | 8.6CNA v3.1 | 0.4% | 2025-05-21 | Fix |
| CVE-2025-48200 | The Front End User Registration extension for TYPO3 (sr_feuser_register) remote code execution | 10.0CNA v3.1 | 0.7% | 2025-05-21 | Fix |
| CVE-2025-48070 | Plane has insecure permissions in UserSerializer | 3.5CNA v3.1 | 0.3% | 2025-05-21 | Fix |
| CVE-2025-48069 | ejson2env has insufficient input sanitization | 6.6CNA v3.1 | 1.3% | 2025-05-21 | Fix |
| CVE-2025-48064 | GitHub Desktop vulnerable to maliciously crafted file renames leading to information disclosure | 3.3CNA v3.1 | 0.2% | 2025-05-21 | Fix |
| CVE-2025-48063 | XWiki Platform required rights enforcement improper authorization | 4.8CNA v4.0 | 1.0% | 2025-05-21 | Fix |
| CVE-2025-48060 | jqlang jq AddressSanitizer: Stack-buffer-overflow in jq_fuzz_execute (jv_string_vfmt) | 7.7CNA v4.0 | 0.6% | 2025-05-21 | Fix |
| CVE-2025-48012 | One Time Password Moderately critical Access bypass SA-CONTRIB-2025-063 | 4.8CISA ADP v3.1 | 0.3% | 2025-05-21 | Fix |
| CVE-2025-48011 | One Time Password Moderately critical Access bypass SA-CONTRIB-2025-062 | 4.8CISA ADP v3.1 | 0.3% | 2025-05-21 | Fix |
| CVE-2025-48010 | One Time Password Moderately critical Access bypass SA-CONTRIB-2025-061 | 4.8CISA ADP v3.1 | 0.3% | 2025-05-21 | Fix |
| CVE-2025-48009 | Single Content Sync Moderately critical Access bypass SA-CONTRIB-2025-060 | 3.1CISA ADP v3.1 | 0.2% | 2025-05-21 | Fix |
| CVE-2025-47947 | ModSecurity has possible DoS | 7.5CNA v3.1 | 0.6% | 2025-05-21 | Exploit codeFix |
| CVE-2025-47942 | openedx edx-platform Learners on edX Platform can download python_lib.zip | 5.3CNA v3.1 | 0.4% | 2025-05-21 | |
| CVE-2025-47291 | containerd CRI plugin cgroup assignment incorrect privilege assignment | 4.6CNA v4.0 | 0.3% | 2025-05-21 | Fix |
| CVE-2025-46822 | OsamaTaher Java-springboot-codebase unauthenticated arbitrary file read via Absolute Path | 7.7CNA v4.0 | 4.0% | 2025-05-21 | NucleiExploit code |
| CVE-2025-46412 | Vertiv Liebert RDU101 and UNITY authentication bypass using an alternate path or channel | 9.3CNA v4.0 | 0.6% | 2025-05-21 | Fix |
| CVE-2025-45755 | Vtiger CRM A stored cross-site scripting | 6.1CISA ADP v3.1 | 0.3% | 2025-05-21 | |
| CVE-2025-45754 | Seeddms A stored cross-site scripting | 5.4CISA ADP v3.1 | 0.3% | 2025-05-21 | |
| CVE-2025-45753 | Vtiger CRM code injection | 7.2CISA ADP v3.1 | 0.4% | 2025-05-21 | |
| CVE-2025-45752 | Seeddms code injection | 7.2CISA ADP v3.1 | 0.6% | 2025-05-21 | |
| CVE-2025-44895 | PLANET Technology Wgs-804hpt stack-based buffer overflow | 6.5CISA ADP v3.1 | 0.3% | 2025-05-21 | |
| CVE-2025-44892 | PLANET Technology Wgs-804hpt stack-based buffer overflow | 6.5CISA ADP v3.1 | 0.3% | 2025-05-21 | |
| CVE-2025-44083 | D-Link DI-8100 improper authentication | 9.8CISA ADP v3.1 | 0.8% | 2025-05-21 | |
| CVE-2025-44040 | orangehrm improper privilege management | 7.2CISA ADP v3.1 | 0.4% | 2025-05-21 | Fix |
| CVE-2025-41426 | Vertiv Liebert RDU101 and UNITY stack-based buffer overflow | 9.3CNA v4.0 | 0.8% | 2025-05-21 | Fix |
| CVE-2025-41232 | Spring Security authorization bypass for method security annotations on private methods | 9.1CNA v3.1 | 0.6% | 2025-05-21 | Fix |
| CVE-2025-40775 | ISC BIND 9 DNS message with invalid TSIG causes an assertion failure | 7.5CNA v3.1 | 15.2% | 2025-05-21 | Exploit codeFix |
| CVE-2025-36535 | AutomationDirect MB-Gateway missing authentication for critical function | 10.0CNA v4.0 | 1.0% | 2025-05-21 | Fix |
| CVE-2025-34027 | Versa Concerto authentication bypass file write remote code execution | 9.0v3.1 | 45.2% | 2025-05-21 | Nuclei |
| CVE-2025-34026 | Versa Concerto improper authentication | 7.5NVD v3.1 | 81.9% | 2025-05-21 | KEVNucleiKCVFix |
| CVE-2025-34025 | Versa Concerto Insecure Docker Mount Container Escape | 8.8v3.1 | 0.6% | 2025-05-21 | KCV |
| CVE-2025-27998 | Steam Client privilege escalation | 8.4CISA ADP v3.1 | 0.2% | 2025-05-21 | |
| CVE-2025-27997 | Blizzard Battle.Net uncontrolled search path | 8.4CISA ADP v3.1 | 0.2% | 2025-05-21 | |
| CVE-2025-27804 | OS command injection vulnerability in eCharge Hardy Barth cPH2 / cPP2 charging stations | 6.5CISA ADP v3.1 | 1.0% | 2025-05-21 | |
| CVE-2025-27803 | Missing authentication in eCharge Hardy Barth cPH2 / cPP2 charging stations | 6.5CISA ADP v3.1 | 0.4% | 2025-05-21 | |
| CVE-2025-27558 | IEEE 802.11 mesh network frame validation vulnerability | 9.1CISA ADP v3.1 | 0.3% | 2025-05-21 | Fix |
| CVE-2025-25539 | Onespan Vasco Self-service Portal Vasco v3.14and local file inclusion | 6.5CISA ADP v3.1 | 0.4% | 2025-05-21 | |
| CVE-2025-20267 | Cisco Identity Services stored cross-site scripting | 4.8CNA v3.1 | 0.3% | 2025-05-21 | Fix |
| CVE-2025-20258 | Cisco Duo command injection | 5.4CNA v3.1 | 0.3% | 2025-05-21 | Fix |
| CVE-2025-20257 | Cisco Secure Network Analytics API subsystem incorrect authorization | 6.5CNA v3.1 | 0.3% | 2025-05-21 | Fix |
| CVE-2025-20256 | Cisco Secure Network Analytics Manager server-side template injection | 6.5CNA v3.1 | 0.6% | 2025-05-21 | Fix |
| CVE-2025-20255 | Cisco Webex Meetings acceptance of untrusted data | 4.3CNA v3.1 | 0.2% | 2025-05-21 | Fix |
| CVE-2025-20250 | Cisco Webex Meetings cross-site scripting | 6.1CNA v3.1 | 0.3% | 2025-05-21 | Fix |
| CVE-2025-20247 | Cisco Webex Meetings cross-site scripting | 6.1CNA v3.1 | 0.3% | 2025-05-21 | Fix |
| CVE-2025-20246 | Cisco Webex Meetings cross-site scripting | 6.1CNA v3.1 | 0.3% | 2025-05-21 | Fix |
| CVE-2025-20242 | Cisco Unified Contact Center Enterprise improper access control | 6.5CNA v3.1 | 5.7% | 2025-05-21 | Fix |
| CVE-2025-20152 | Cisco Identity Services Engine Software ISE restart | 8.6CNA v3.1 | 0.7% | 2025-05-21 | Fix |
| CVE-2025-20114 | Cisco Unified Intelligence Center insecure direct object reference | 4.3CNA v3.1 | 0.3% | 2025-05-21 | Fix |
| CVE-2025-20113 | Cisco Unified Intelligence Center privilege escalation | 7.1CNA v3.1 | 0.4% | 2025-05-21 | Fix |
| CVE-2025-20112 | Cisco Unified Communications Products privilege escalation | 5.1CNA v3.1 | 0.1% | 2025-05-21 | Fix |
| CVE-2025-5059 | Campcodes Online Shopping Portal edit-subcategory.php unrestricted upload | 7.2v3.1 | 0.5% | 2025-05-21 | |
| CVE-2025-5057 | Campcodes Online Shopping Portal insert-product.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-21 | |
| CVE-2025-5056 | Campcodes Online Shopping Portal edit-products.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-21 | |
| CVE-2025-5053 | FreeFloat FTP Server MDIR command buffer overflow | 9.8v3.1 | 0.7% | 2025-05-21 | |
| CVE-2025-5052 | FreeFloat FTP Server LS command buffer overflow | 9.8v3.1 | 0.7% | 2025-05-21 | |
| CVE-2025-5051 | FreeFloat FTP Server BINARY command buffer overflow | 9.8v3.1 | 0.7% | 2025-05-21 | |
| CVE-2025-5050 | FreeFloat FTP Server BELL command buffer overflow | 9.8v3.1 | 0.7% | 2025-05-21 | |
| CVE-2025-5049 | FreeFloat FTP Server APPEND command buffer overflow | 9.8v3.1 | 0.7% | 2025-05-21 | |
| CVE-2025-5033 | XiaoBingby TeaCMS addUser cross-site request forgery | 5.3CNA v4.0 | 0.3% | 2025-05-21 | |
| CVE-2025-5032 | Campcodes Online Shopping Portal edit-category.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-21 | |
| CVE-2025-5031 | Ackites KillWxapkg wxapkg File Decompression resource consumption | 2.3CNA v4.0 | 0.4% | 2025-05-21 | |
| CVE-2025-5030 | Ackites KillWxapkg wxapkg file parser unpack.go processFile os command injection | 8.1v3.1 | 2.3% | 2025-05-21 | |
| CVE-2025-5029 | Kingdee Cloud Galaxy Private Cloud BBC System file deleteFileAction.jhtml path traversal | 5.3CNA v4.0 | 0.5% | 2025-05-21 | Fix |
| CVE-2025-5020 | Opening maliciously-crafted URLs in Firefox from other apps such as Safari could have allowed attackers to spoof website addresses if the URLs utilized non-HTTP schemes used internally by the Firefox iOS client. This vulnerability was fixed in Firefox for iOS 139. | 4.3CISA ADP v3.1 | 0.2% | 2025-05-21 | Fix |
| CVE-2025-5013 | HkCms Search index.html cross-site scripting | 4.7v3.1 | 0.7% | 2025-05-21 | |
| CVE-2025-5011 | moonlightL hexo-boot Dynamic List page index.html cross-site scripting | 4.7v3.1 | 0.4% | 2025-05-21 | |
| CVE-2025-5010 | moonlightL hexo-boot Blog Backend index.html cross-site scripting | 4.7v3.1 | 0.4% | 2025-05-21 | |
| CVE-2025-4969 | libsoup find_boundary multipart parsing out-of-bounds read | 6.5CNA v3.1 | 0.9% | 2025-05-21 | Fix |
| CVE-2025-4949 | XXE vulnerability in Eclipse JGit | 6.8CNA v4.0 | 0.8% | 2025-05-21 | Fix |
| CVE-2025-4803 | Glossary by WPPedia WordPress plugin authenticated (Administrator+) PHP object injection | 7.2CNA v3.1 | 0.7% | 2025-05-21 | |
| CVE-2025-4611 | Slim SEO WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.5% | 2025-05-21 | Exploit codeFix |
| CVE-2025-4524 | Madara Responsive and modern WordPress theme for manga sites unauthenticated local file inclusion | 9.8CNA v3.1 | 10.4% | 2025-05-21 | NucleiExploit codeFix |
| CVE-2025-4416 | Events Log Track Moderately critical denial of service SA-CONTRIB-2025-059 | 7.5CISA ADP v3.1 | 0.4% | 2025-05-21 | Fix |
| CVE-2025-4415 | Piwik PRO Moderately critical cross-site scripting SA-CONTRIB-2025-058 | 4.8CISA ADP v3.1 | 0.2% | 2025-05-21 | Fix |
| CVE-2025-4221 | Animated Buttons WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-05-21 | |
| CVE-2025-4219 | DPEPress WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-05-21 | |
| CVE-2025-4217 | WP YouTube Video Optimizer WordPress plugin authenticated (Contributor+) stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-05-21 | |
| CVE-2025-4105 | Splitit WordPress plugin missing authorization to Multiple Administrative actions | 5.4CNA v3.1 | 0.3% | 2025-05-21 | Fix |
| CVE-2025-4094 | Digits WordPress plugin Auth bypass via OTP Bruteforcing | 9.8CISA ADP v3.1 | 15.8% | 2025-05-21 | Exploit codeFix |
| CVE-2025-4008 | Smartbedded Meteobridge command injection | 8.8NVD v3.1 | 93.7% | 2025-05-21 | KEVNucleiEmerging ThreatsFix |
| CVE-2025-3781 | Raisely Donation Form WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-05-21 | Fix |
| CVE-2025-3751 | TIBCO ActiveMatrix BusinessWorks SQL injection | 7.0CNA v4.0 | 0.3% | 2025-05-21 | Fix |
| CVE-2025-3750 | Network Posts Extended WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-05-21 | |
| CVE-2025-2261 | TIBCO BPM Enterprise XSS | 7.0CNA v4.0 | 0.4% | 2025-05-21 | Fix |
| CVE-2025-2102 | HYPR Passwordless link following | 5.7CNA v4.0 | 0.2% | 2025-05-21 | Fix |
| CVE-2025-1712 | Checkmk arbitrary file write with vcrtrace | 8.7CNA v4.0 | 0.8% | 2025-05-21 | Fix |
| CVE-2025-1421 | Formula injection in a CSV file in Proget MDM | 2.4CNA v4.0 | 0.2% | 2025-05-21 | Fix |
| CVE-2025-1420 | Proget activation message field stored cross-site scripting | 2.4CNA v4.0 | 0.2% | 2025-05-21 | Fix |
| CVE-2025-1419 | Proget comment section stored cross-site scripting | 2.4CNA v4.0 | 0.2% | 2025-05-21 | Fix |
| CVE-2025-1418 | Information disclosure in Proget MDM | 5.1CNA v4.0 | 0.2% | 2025-05-21 | Fix |
| CVE-2025-1417 | Information disclosure in Proget MDM | 4.6CNA v4.0 | 0.2% | 2025-05-21 | Fix |
| CVE-2025-1416 | Password disclosure in Proget MDM | 7.0CNA v4.0 | 0.2% | 2025-05-21 | Fix |
| CVE-2025-1415 | Information disclosure in Proget MDM | 5.1CNA v4.0 | 0.2% | 2025-05-21 | Fix |
| CVE-2025-0372 | HYPR Passwordless race condition | 5.9CNA v4.0 | 0.1% | 2025-05-21 | Fix |
| CVE-2025-48391 | JetBrains YouTrack missing authentication | 7.7CNA v3.1 | 0.4% | 2025-05-20 | Fix |
| CVE-2025-48056 | Hubble CLI vulnerable to character injection | 5.3CNA v3.1 | 0.3% | 2025-05-20 | Fix |
| CVE-2025-48018 | An authenticated user can modify application state data. | 7.5CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-48017 | Schweitzer Engineering Laboratories SEL-5056 Software-Defined Network Flow Controller path traversal | 9.0CNA v3.1 | 0.4% | 2025-05-20 | Fix |
| CVE-2025-48016 | OpenFlow discovery protocol can exhaust resources because it is not rate limited | 4.3CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-48015 | Failed login response could be different depending on whether the username was local or central. | 3.7CNA v3.1 | 0.3% | 2025-05-20 | Fix |
| CVE-2025-48014 | Password guessing limits could be bypassed when using LDAP authentication. | 7.5CNA v3.1 | 0.4% | 2025-05-20 | Fix |
| CVE-2025-47941 | TYPO3 has broken authentication in Backend MFA | 7.2CNA v3.1 | 0.5% | 2025-05-20 | Fix |
| CVE-2025-47940 | TYPO3 CMS vulnerable to privilege escalation to System Maintainer | 7.2CNA v3.1 | 0.4% | 2025-05-20 | Fix |
| CVE-2025-47939 | TYPO3 CMS vulnerable to unrestricted file upload in File Abstraction Layer | 5.4CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-47938 | TYPO3 vulnerable to unverified password change for Backend Users | 3.8CNA v3.1 | 0.3% | 2025-05-20 | Fix |
| CVE-2025-47937 | TYPO3 vulnerable to information disclosure via DBAL Restriction Handling | 3.7CNA v3.1 | 0.3% | 2025-05-20 | Fix |
| CVE-2025-47936 | TYPO3 vulnerable to server side request forgery via Webhooks | 3.3CNA v3.1 | 0.3% | 2025-05-20 | Fix |
| CVE-2025-47854 | JetBrains TeamCity open redirect | 4.3CNA v3.1 | 0.3% | 2025-05-20 | Fix |
| CVE-2025-47853 | JetBrains TeamCity cross-site scripting | 4.8CNA v3.1 | 0.7% | 2025-05-20 | Fix |
| CVE-2025-47852 | JetBrains TeamCity cross-site scripting | 4.8CNA v3.1 | 0.7% | 2025-05-20 | Fix |
| CVE-2025-47851 | JetBrains TeamCity cross-site scripting | 4.8CNA v3.1 | 2.7% | 2025-05-20 | Fix |
| CVE-2025-47850 | JetBrains YouTrack missing authentication | 4.3CNA v3.1 | 0.4% | 2025-05-20 | Fix |
| CVE-2025-47290 | Containerd vulnerable to host filesystem access during image unpack | 7.6CNA v4.0 | 0.5% | 2025-05-20 | Fix |
| CVE-2025-47277 | vLLM allows remote code execution via PyNcclPipe Communication service | 9.8CNA v3.1 | 1.0% | 2025-05-20 | Fix |
| CVE-2025-46725 | Langroid has a code injection vulnerability in LanceDocChatAgent through vector_store | 8.1CNA v4.0 | 0.5% | 2025-05-20 | Fix |
| CVE-2025-46724 | Langroid has a code injection vulnerability in TableChatAgent | 9.8CNA v3.1 | 0.8% | 2025-05-20 | Fix |
| CVE-2025-45862 | TOTOLINK A3002R stack-based buffer overflow | 6.5CISA ADP v3.1 | 0.3% | 2025-05-20 | |
| CVE-2025-44898 | PLANET Technology Wgs-804hpt stack-based buffer overflow | 9.8CISA ADP v3.1 | 0.5% | 2025-05-20 | |
| CVE-2025-44897 | PLANET Technology Wgs-804hpt stack-based buffer overflow | 9.8CISA ADP v3.1 | 0.5% | 2025-05-20 | |
| CVE-2025-44896 | PLANET Technology Wgs-804hpt stack-based buffer overflow | 9.8CISA ADP v3.1 | 0.5% | 2025-05-20 | |
| CVE-2025-44894 | PLANET Technology Wgs-804hpt stack-based buffer overflow | 9.8CISA ADP v3.1 | 0.5% | 2025-05-20 | |
| CVE-2025-44893 | PLANET Technology Wgs-804hpt stack-based buffer overflow | 9.8CISA ADP v3.1 | 0.7% | 2025-05-20 | |
| CVE-2025-44891 | PLANET Technology Wgs-804hpt stack-based buffer overflow | 9.8CISA ADP v3.1 | 0.5% | 2025-05-20 | |
| CVE-2025-44890 | PLANET Technology Wgs-804hpt stack-based buffer overflow | 9.8CISA ADP v3.1 | 0.5% | 2025-05-20 | |
| CVE-2025-44888 | PLANET Technology Wgs-804hpt stack-based buffer overflow | 9.8CISA ADP v3.1 | 0.5% | 2025-05-20 | |
| CVE-2025-44887 | PLANET Technology Wgs-804hpt stack-based buffer overflow | 9.8CISA ADP v3.1 | 0.5% | 2025-05-20 | |
| CVE-2025-44886 | PLANET Technology Wgs-804hpt stack-based buffer overflow | 9.8CISA ADP v3.1 | 0.5% | 2025-05-20 | |
| CVE-2025-44885 | PLANET Technology Wgs-804hpt stack-based buffer overflow | 9.8CISA ADP v3.1 | 0.5% | 2025-05-20 | |
| CVE-2025-44884 | PLANET Technology Wgs-804hpt stack-based buffer overflow | 9.8CISA ADP v3.1 | 0.5% | 2025-05-20 | |
| CVE-2025-44883 | PLANET Technology Wgs-804hpt stack-based buffer overflow | 9.8CISA ADP v3.1 | 0.5% | 2025-05-20 | |
| CVE-2025-44882 | WAVLINK WL-WN579A3 component /cgi-bin/firewall.cgi command injection | 9.8CISA ADP v3.1 | 1.8% | 2025-05-20 | |
| CVE-2025-44881 | WAVLINK WL-WN579A3 component /cgi-bin/qos.cgi command injection | 9.8CISA ADP v3.1 | 1.8% | 2025-05-20 | |
| CVE-2025-44880 | WAVLINK WL-WN579A3 component /cgi-bin/adm.cgi command injection | 9.8CISA ADP v3.1 | 1.8% | 2025-05-20 | |
| CVE-2025-44084 | D-Link DI-8100 command injection | 9.8CISA ADP v3.1 | 21.6% | 2025-05-20 | |
| CVE-2025-41231 | VMware Cloud Foundation missing authorisation | 7.3CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-41230 | VMware Cloud Foundation information disclosure | 7.5CNA v3.1 | 0.4% | 2025-05-20 | Fix |
| CVE-2025-41229 | VMware Cloud Foundation directory traversal | 8.2CNA v3.1 | 0.7% | 2025-05-20 | Fix |
| CVE-2025-41228 | VMware ESXi and vCenter Server reflected cross-site scripting (XSS) | 4.3CNA v3.1 | 0.9% | 2025-05-20 | Exploit codeFix |
| CVE-2025-41227 | VMware ESXi denial of service | 5.5CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-41226 | VMware ESXi guest Operations denial of service | 6.8CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-41225 | VMware vCenter Server authenticated command-execution | 8.8CNA v3.1 | 0.3% | 2025-05-20 | Fix |
| CVE-2025-40635 | SQL injection at Comerzzia | 9.3CNA v4.0 | 0.3% | 2025-05-20 | |
| CVE-2025-40634 | Stack-based buffer overflow in TP-Link Archer AX50 | 9.2CNA v4.0 | 0.7% | 2025-05-20 | Exploit codeFix |
| CVE-2025-40633 | Stored cross-site scripting (XSS) in Koibox | 5.1CNA v4.0 | 0.4% | 2025-05-20 | |
| CVE-2025-37991 | Linux kernel parisc floating-point trap handler double free | 7.8v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37990 | Linux kernel brcm80211 Wi-Fi driver vulnerability | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37989 | Linux kernel PHY LED trigger driver memory leak | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37988 | Linux kernel mount namespace handling race condition | 7.8CNA v3.1 | 0.1% | 2025-05-20 | Fix |
| CVE-2025-37987 | Linux kernel pds_core adminq driver vulnerability | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37986 | Linux kernel USB Type-C class driver vulnerability | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37985 | Linux kernel USB WDM driver race condition | 4.7v3.1 | 0.1% | 2025-05-20 | Fix |
| CVE-2025-37984 | Linux kernel ECDSA key size calculation integer overflow | 7.0CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37983 | Linux kernel inode allocation error path memory leak | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37982 | Linux kernel wl1251 Wi-Fi driver memory leak | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37981 | Linux kernel smartpqi driver out-of-bounds write | 7.8v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37980 | Linux kernel block queue registration memory leak | 5.5NVD v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37979 | Linux kernel sc7280 LPASS audio driver out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37978 | Linux kernel block integrity page handling vulnerability | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37977 | Linux kernel Exynos UFS driver cache coherency vulnerability | 7.8CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37975 | Linux kernel module relocation loader out-of-bounds read | 7.1v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37974 | Linux kernel s390 PCI device scan null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37973 | Linux kernel cfg80211 multi-link element defragmentation out-of-bounds read | 8.1CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37972 | Linux kernel mtk-pmic-keys driver null pointer dereference | 5.5NVD v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37971 | Linux kernel bcm2835 camera driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37970 | Linux kernel st_lsm6dsx IMU driver denial of service | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37969 | Linux kernel st_lsm6dsx IMU driver denial of service | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37968 | Linux kernel opt3001 light sensor driver deadlock | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37967 | Linux kernel UCSI DisplayPort altmode driver deadlock | 5.5v3.1 | 0.1% | 2025-05-20 | Fix |
| CVE-2025-37966 | Linux kernel tagged address control denial of service | 5.5v3.1 | 0.1% | 2025-05-20 | Fix |
| CVE-2025-37965 | Linux kernel AMD display DML helper vulnerability | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37964 | Linux kernel TLB flush handling vulnerability | 7.8CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37963 | Linux kernel unprivileged cBPF mitigation vulnerability | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37962 | Linux kernel ksmbd lease context parsing memory leak | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37961 | Linux kernel IPVS tunnel routing vulnerability | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37960 | Linux kernel memblock allocator denial of service | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37959 | Linux kernel BPF redirect peer packet handling vulnerability | 9.4CNA v3.1 | 0.4% | 2025-05-20 | Fix |
| CVE-2025-37958 | Linux kernel THP deferred split scan null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37957 | Linux kernel KVM SVM SMM handling use-after-free | 8.8CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37956 | Linux kernel ksmbd rename handling vulnerability | 8.8CNA v3.1 | 0.4% | 2025-05-20 | Fix |
| CVE-2025-37955 | Linux kernel virtio-net memory leak | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37954 | Linux kernel SMB client directory cache race condition | 7.5CNA v3.1 | 0.4% | 2025-05-20 | Fix |
| CVE-2025-37953 | Linux kernel sch_htb null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37952 | Linux kernel ksmbd file table use-after-free | 8.8CNA v3.1 | 0.4% | 2025-05-20 | Fix |
| CVE-2025-37951 | Linux kernel v3d GPU job scheduler memory leak | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37950 | Linux kernel ocfs2 folio allocation null pointer dereference | 5.5v3.1 | 0.1% | 2025-05-20 | Fix |
| CVE-2025-37949 | Linux kernel xenbus driver null pointer dereference | 7.8CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37948 | In the Linux kernel, the following vulnerability has been resolved: arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs A malicious BPF program may manipulate the branch history to influence what the hardware speculates will happen next. On exit from a BPF program, emit the BHB mitit | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37947 | Linux kernel ksmbd stream write handling out-of-bounds write | 8.8CNA v3.1 | 0.6% | 2025-05-20 | Exploit codeFix |
| CVE-2025-37946 | Linux kernel s390 PCI driver use-after-free | 7.8v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37945 | Linux kernel phylink-controlled PHY state machine null pointer dereference | 5.5NVD v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37944 | Linux kernel ath12k Wi-Fi driver out-of-bounds write | 8.8CNA v3.1 | 0.3% | 2025-05-20 | Fix |
| CVE-2025-37943 | Linux kernel ath12k Wi-Fi driver out-of-bounds write | 8.8CNA v3.1 | 0.3% | 2025-05-20 | Fix |
| CVE-2025-37941 | Linux kernel wcd937x audio codec driver memory leak | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37940 | Linux kernel ftrace function graph hash improper locking | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37939 | Linux kernel libbpf BTF.ext parser buffer overflow | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37938 | Linux kernel tracing event format verifier null pointer dereference | 7.1CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37937 | Linux kernel dib8000 DVB frontend driver divide-by-zero | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37936 | Linux kernel KVM Intel PEBS virtualization denial of service | 8.7CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37935 | Linux kernel mtk_eth_soc Ethernet driver denial of service | 9.8CNA v3.1 | 0.5% | 2025-05-20 | Fix |
| CVE-2025-37934 | Linux kernel ASoC simple-card-utils audio driver vulnerability | 7.8v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37933 | Linux kernel octeon_ep network driver double free | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37932 | In the Linux kernel, the following vulnerability has been resolved: sch_htb: make htb_qlen_notify() idempotent htb_qlen_notify() always deactivates the HTB class and in fact could trigger a warning if it is already deactivated. Therefore, it is not idempotent and not friendly to its callers, like | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37931 | Linux kernel btrfs subpage metadata writeback vulnerability | 7.3CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37930 | Linux kernel nouveau fence handling reachable assertion | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37929 | Linux kernel arm64 Spectre-BHB mitigation null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37928 | In the Linux kernel, the following vulnerability has been resolved: dm-bufio: don't schedule in atomic context A BUG was reported as below when CONFIG_DEBUG_ATOMIC_SLEEP and try_verify_in_tasklet are enabled. [ 129.444685][ T934] BUG: sleeping function called from invalid context at drivers/md/dm- | 7.8v3.1 | 0.7% | 2025-05-20 | Exploit codeFix |
| CVE-2025-37927 | Linux kernel AMD IOMMU ACPI HID parser out-of-bounds write | 7.8v3.1 | 0.3% | 2025-05-20 | Fix |
| CVE-2025-37926 | Linux kernel ksmbd session RPC handler use-after-free | 8.8CNA v3.1 | 0.5% | 2025-05-20 | Fix |
| CVE-2025-37924 | Linux kernel ksmbd kerberos authentication use-after-free | 9.8CNA v3.1 | 22.1% | 2025-05-20 | Fix |
| CVE-2025-37923 | Linux kernel ftrace trace_seq buffer out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37922 | Linux kernel book3s64 radix vmemmap null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37921 | Linux kernel VXLAN vnifilter FDB vulnerability | 7.8CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37920 | Linux kernel AF_XDP generic receive path race condition | 7.8CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37919 | Linux kernel AMD ACP audio driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37918 | Linux kernel btusb Bluetooth driver null pointer dereference | 8.8CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37917 | Linux kernel mtk-star-emac Ethernet driver vulnerability | 7.5CNA v3.1 | 0.6% | 2025-05-20 | Fix |
| CVE-2025-37916 | Linux kernel pds_core driver use-after-free | 7.8v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37915 | Linux kernel drr use-after-free | 7.8CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37914 | Linux kernel ets use-after-free | 7.8CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37913 | Linux kernel qfq use-after-free | 7.8CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37912 | Linux kernel ice null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37911 | Linux kernel bnxt_en Ethernet driver out-of-bounds read | 7.8CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37910 | Linux kernel PTP OCP Adva board SMA sysfs driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37909 | Linux kernel lan743x Ethernet driver memory leak | 5.5NVD v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37908 | Linux kernel slab allocator memory profiling incomplete cleanup | 7.8CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37907 | Linux kernel accel/ivpu deadlock | 5.5v3.1 | 0.1% | 2025-05-20 | Fix |
| CVE-2025-37906 | Linux kernel ublk block driver race condition | 7.8CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37905 | Linux kernel ARM SCMI firmware driver memory leak | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37904 | Linux kernel Btrfs inode allocation memory leak | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37903 | Linux kernel AMD display HDCP driver use-after-free | 7.8CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37901 | Linux kernel Qualcomm MPM interrupt controller denial of service | 7.8CNA v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37900 | Linux kernel IOMMU user copy helper null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37899 | Linux kernel ksmbd session logoff use-after-free | 8.8CNA v3.1 | 0.9% | 2025-05-20 | Fix |
| CVE-2025-37898 | Linux kernel powerpc64 ftrace module loader vulnerability | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37897 | Linux kernel plfxlc Wi-Fi driver reachable assertion | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37896 | Linux kernel SPI memory driver divide by zero | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37895 | Linux kernel bnxt_en Ethernet driver improper error handling | 5.5v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-37894 | Linux kernel TCP socket lookup null pointer dereference | 9.8CNA v3.1 | 0.5% | 2025-05-20 | Fix |
| CVE-2025-37892 | Linux kernel INFTL flash driver vulnerability | 7.8v3.1 | 0.2% | 2025-05-20 | Fix |
| CVE-2025-30193 | PowerDNS DNSdist denial of service via crafted TCP exchange | 7.5CNA v3.1 | 0.6% | 2025-05-20 | Fix |
| CVE-2025-26086 | Rsiqueue Management System blind SQL injection | 7.5CISA ADP v3.1 | 14.1% | 2025-05-20 | Emerging Threats |
| CVE-2025-22157 | Atlassian Jira Core Data Center privilege escalation | 7.2CNA v4.0 | 0.7% | 2025-05-20 | Fix |
| CVE-2025-5008 | Projectworlds Online Time Table Generator add_teacher.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-20 | |
| CVE-2025-5007 | Part-DB Profile Picture Feature AttachmentSubmitHandler.php handleUpload cross-site scripting | 5.1CNA v4.0 | 0.3% | 2025-05-20 | Fix |
| CVE-2025-5006 | Campcodes Online Shopping Portal category.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-20 | |
| CVE-2025-5004 | Projectworlds Online Time Table Generator add_course.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-20 | |
| CVE-2025-5003 | Projectworlds Online Time Table Generator semester_ajax.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-20 | |
| CVE-2025-5002 | SourceCodester Client Database Management System user_proposal_update_order.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-20 | |
| CVE-2025-5001 | GNU PSPP pspp-convert.c calloc integer overflow | 5.5v3.1 | 0.3% | 2025-05-20 | |
| CVE-2025-5000 | Linksys FGW3000-AH/FGW3000-HK HTTP POST request sysconf.cgi control_panel_sw command injection | 9.8v3.1 | 6.6% | 2025-05-20 | |
| CVE-2025-4999 | Linksys FGW3000-AH/FGW3000-HK HTTP POST request sysconf.cgi sub_4153FC command injection | 9.8v3.1 | 6.9% | 2025-05-20 | |
| CVE-2025-4998 | H3C Magic R200G HTTP POST request aspForm EditWlanMacList denial of service | 7.1CNA v4.0 | 0.5% | 2025-05-20 | |
| CVE-2025-4997 | H3C R2+ProG HTTP POST request aspForm SetAPInfoById denial of service | 7.1CNA v4.0 | 0.5% | 2025-05-20 | |
| CVE-2025-4996 | Intelbras RF 301K Add Static IP cross-site scripting | 4.8CNA v4.0 | 0.3% | 2025-05-20 | |
| CVE-2025-4980 | Netgear DGND3700 mini_http currentsetting.htm information disclosure | 6.9CNA v4.0 | 0.6% | 2025-05-20 | |
| CVE-2025-4978 | Netgear DGND3700 Basic Authentication BRS_top.html improper authentication | 9.3CNA v4.0 | 21.0% | 2025-05-20 | |
| CVE-2025-4977 | Netgear DGND3700 BRS_top.html information disclosure | 6.9CNA v4.0 | 0.6% | 2025-05-20 | |
| CVE-2025-4971 | Broadcom Automic Automation Agent Unix privilege escalation | 8.5CNA v4.0 | 0.6% | 2025-05-20 | Exploit codeFix |
| CVE-2025-4951 | Rapid7 AppSpider Pro cross-site scripting | 4.6CNA v3.1 | 0.2% | 2025-05-20 | |
| CVE-2025-4364 | Assured Telematics Fleet Management System information disclosure | 8.7CNA v4.0 | 0.4% | 2025-05-20 | Fix |
| CVE-2025-4322 | Motors WordPress theme unauthenticated privilege escalation via password Update/account takeover | 9.8CNA v3.1 | 15.2% | 2025-05-20 | NucleiExploit codeFix |
| CVE-2025-3079 | Canon imageRUNNER Series insufficiently protected credentials | 6.3CNA v4.0 | 0.7% | 2025-05-20 | Fix |
| CVE-2025-3078 | Canon imageRUNNER ADVANCE Series insufficiently protected credentials | 6.3CNA v4.0 | 0.7% | 2025-05-20 | Fix |
| CVE-2025-2929 | Order Delivery Date Pro for WooCommerce WordPress plugin reflected XSS | 7.1CISA ADP v3.1 | 0.3% | 2025-05-20 | Fix |
| CVE-2025-48346 | Embed and Integrate Etsy Shop WordPress plugin broken access control | 5.3CNA v3.1 | 0.3% | 2025-05-19 |