CVE-2025 records published in May 2025
Page four of four: records 3,001 to 3,226 of the 3,226 published in May 2025, newest first. The first page carries the figures for May 2025.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2025-4186 | Wangshen SecGate 3600 g=route_ispinfo_export_save path traversal | 5.3CNA v4.0 | 0.5% | 2025-05-02 | |
| CVE-2025-4185 | Wangshen SecGate 3600 g=obj_area_export_save path traversal | 5.3CNA v4.0 | 13.3% | 2025-05-02 | Emerging Threats |
| CVE-2025-4184 | PCMan FTP Server QUOTE command buffer overflow | 9.8v3.1 | 0.8% | 2025-05-02 | |
| CVE-2025-4179 | Flynax Bridge WordPress plugin unauthenticated limited privilege escalation | 7.3CNA v3.1 | 0.4% | 2025-05-02 | Fix |
| CVE-2025-4177 | Flynax Bridge WordPress plugin unauthenticated arbitrary user deletion | 5.3v3.1 | 0.3% | 2025-05-02 | Fix |
| CVE-2025-4166 | Vault may Include Sensitive Data in Error Logs when using the KV v2 plugin | 4.5CNA v3.1 | 0.4% | 2025-05-02 | Fix |
| CVE-2025-4131 | GmapsMania WordPress plugin authenticated (Contributor+) stored cross-site scripting via shortcode | 6.4CNA v3.1 | 0.2% | 2025-05-02 | |
| CVE-2025-3927 | Digigram PYKO-OUT web server missing authorization | 9.8CISA ADP v3.1 | 0.6% | 2025-05-02 | |
| CVE-2025-3879 | Vault’s Azure Authentication method bound_location Restriction could be Bypassed on Login | 6.6CNA v3.1 | 0.4% | 2025-05-02 | Fix |
| CVE-2025-3858 | Formality WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-05-02 | Fix |
| CVE-2025-3748 | Taxonomy Chain Menu WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-05-02 | Fix |
| CVE-2025-3746 | OTP-less one tap Sign in WordPress plugin privilege escalation | 9.8CNA v3.1 | 0.5% | 2025-05-02 | |
| CVE-2025-3709 | Flowring Technology Agentflow Account Lockout Bypass | 9.8CNA v3.1 | 0.6% | 2025-05-02 | Fix |
| CVE-2025-3708 | Le-show Medical Practice Management System SQL injection | 9.8CNA v3.1 | 0.5% | 2025-05-02 | Fix |
| CVE-2025-3707 | Sunnet eHRD CTMS SQL injection | 6.5CNA v3.1 | 0.4% | 2025-05-02 | Fix |
| CVE-2025-3670 | KiwiChat NextClient WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-05-02 | |
| CVE-2025-3514 | SureForms WordPress plugin Admin+ stored XSS | 3.5CISA ADP v3.1 | 0.3% | 2025-05-02 | Fix |
| CVE-2025-3513 | SureForms WordPress plugin Admin+ stored XSS | 3.5CISA ADP v3.1 | 0.3% | 2025-05-02 | Fix |
| CVE-2025-3510 | tagDiv Composer WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-05-02 | Fix |
| CVE-2025-3488 | WPML Multilingual CMS - Authenticated stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-05-02 | Fix |
| CVE-2025-3438 | MStore API WordPress plugin privilege escalation | 7.3v3.1 | 0.3% | 2025-05-02 | Fix |
| CVE-2025-2880 | Yame Link In Bio WordPress plugin unauthenticated information exposure | 5.3CNA v3.1 | 0.4% | 2025-05-02 | |
| CVE-2025-2812 | SQLi in Mydata Informatics' Ticket Sales Automation | 9.8CNA v3.1 | 0.5% | 2025-05-02 | Exploit codeFix |
| CVE-2025-2605 | Honeywell MB-Secure authenticated command injection | 9.9CNA v3.1 | 16.0% | 2025-05-02 | Fix |
| CVE-2025-2488 | XSS in Profelis Informatics' SambaBox | 6.1v3.1 | 0.3% | 2025-05-02 | Fix |
| CVE-2025-2421 | Remote code execution in Profelis Informatics' SambaBox | 9.8v3.1 | 0.6% | 2025-05-02 | Fix |
| CVE-2025-1884 | Dassault Systèmes SOLIDWORKS eDrawings SLDPRT file reading procedure use-after-free | 7.8CNA v3.1 | 0.2% | 2025-05-02 | |
| CVE-2025-1883 | Out-of-bounds write vulnerability exists in SOLIDWORKS eDrawings on Release SOLIDWORKS Desktop 2025 | 7.8CNA v3.1 | 0.2% | 2025-05-02 | |
| CVE-2025-1327 | Homey WordPress theme insecure direct object reference | 4.3CNA v3.1 | 0.2% | 2025-05-02 | Fix |
| CVE-2025-1326 | Homey WordPress theme unauthorized access | 4.3v3.1 | 0.2% | 2025-05-02 | Fix |
| CVE-2025-1301 | Reflected XSS in Yordam Informatics' Library Automation System | 6.1v3.1 | 0.2% | 2025-05-02 | Fix |
| CVE-2025-0427 | Mali GPU Kernel Driver allows access to already freed memory | 7.8v3.1 | 0.2% | 2025-05-02 | Fix |
| CVE-2025-0072 | Mali GPU Kernel Driver allows improper GPU memory processing operations | 7.8v3.1 | 0.4% | 2025-05-02 | Fix |
| CVE-2025-47154 | Ladybird use-after-free | 9.0CNA v3.1 | 0.7% | 2025-05-01 | |
| CVE-2025-47153 | Debian trixie out-of-bounds access | 6.5CNA v3.1 | 0.4% | 2025-05-01 | Fix |
| CVE-2025-46635 | Tenda RX2 Pro improper access control | 7.1CISA ADP v3.1 | 0.3% | 2025-05-01 | |
| CVE-2025-46634 | Tenda RX2 Pro web management portal of the Tenda cleartext transmission of sensitive information | 8.2CISA ADP v3.1 | 0.2% | 2025-05-01 | |
| CVE-2025-46633 | Tenda RX2 Pro web management portal of the Tenda cleartext transmission of sensitive information | 8.2CISA ADP v3.1 | 0.3% | 2025-05-01 | |
| CVE-2025-46632 | Tenda RX2 Pro nonce reuse | 6.5CISA ADP v3.1 | 0.3% | 2025-05-01 | |
| CVE-2025-46631 | Tenda RX2 Pro improper authentication | 6.5CISA ADP v3.1 | 7.5% | 2025-05-01 | |
| CVE-2025-46630 | Tenda RX2 Pro improper authentication | 6.5CISA ADP v3.1 | 0.4% | 2025-05-01 | |
| CVE-2025-46629 | Tenda RX2 Pro improper access control | 6.5CISA ADP v3.1 | 0.9% | 2025-05-01 | |
| CVE-2025-46628 | Tenda RX2 Pro improper access control | 7.3CISA ADP v3.1 | 1.0% | 2025-05-01 | |
| CVE-2025-46627 | Tenda RX2 Pro weak credentials | 8.2CISA ADP v3.1 | 0.4% | 2025-05-01 | |
| CVE-2025-46626 | Tenda RX2 Pro inadequate encryption strength | 7.3CISA ADP v3.1 | 0.2% | 2025-05-01 | |
| CVE-2025-46625 | Tenda RX2 Pro command injection | 8.8CISA ADP v3.1 | 0.8% | 2025-05-01 | |
| CVE-2025-46569 | OPA server Data API HTTP path injection of Rego | 7.4CNA v4.0 | 0.5% | 2025-05-01 | Fix |
| CVE-2025-46568 | Stirling-PDF server-side request forgery (SSRF)-Induced arbitrary file read | 7.7CNA v4.0 | 0.5% | 2025-05-01 | Fix |
| CVE-2025-46567 | LLaMA-Factory allows arbitrary code execution via unsafe deserialization in Ilamafy_baichuan2.py | 6.1CNA v3.1 | 0.3% | 2025-05-01 | Fix |
| CVE-2025-46566 | Dataease redshift JDBC Connection remote code execution | 6.8CNA v4.0 | 0.8% | 2025-05-01 | Fix |
| CVE-2025-46565 | Vite's server.fs.deny bypassed with /. for files under project root | 6.0CNA v4.0 | 1.2% | 2025-05-01 | NucleiFix |
| CVE-2025-46345 | Auth0 Account Link Extension JWT signature validation vulnerability | 6.9CNA v4.0 | 0.4% | 2025-05-01 | Fix |
| CVE-2025-46337 | SQL injection in ADOdb PostgreSQL driver pg_insert_id method | 10.0CNA v3.1 | 0.7% | 2025-05-01 | Fix |
| CVE-2025-44867 | Tenda W20E command injection | 6.3CISA ADP v3.1 | 1.2% | 2025-05-01 | |
| CVE-2025-44866 | Tenda W20E command injection | 6.3CISA ADP v3.1 | 1.2% | 2025-05-01 | |
| CVE-2025-44865 | Tenda W20E command injection | 6.3CISA ADP v3.1 | 1.2% | 2025-05-01 | |
| CVE-2025-44864 | Tenda W20E command injection | 6.3CISA ADP v3.1 | 1.2% | 2025-05-01 | |
| CVE-2025-44863 | TOTOLINK CA300-PoE command injection | 6.5CISA ADP v3.1 | 0.9% | 2025-05-01 | |
| CVE-2025-44862 | TOTOLINK CA300-PoE command injection | 6.3CISA ADP v3.1 | 0.9% | 2025-05-01 | |
| CVE-2025-44861 | TOTOLINK CA300-PoE command injection | 6.3CISA ADP v3.1 | 0.9% | 2025-05-01 | |
| CVE-2025-44860 | TOTOLINK CA300-PoE command injection | 6.5CISA ADP v3.1 | 0.9% | 2025-05-01 | |
| CVE-2025-44854 | TOTOLINK CP900 command injection | 6.3CISA ADP v3.1 | 0.9% | 2025-05-01 | |
| CVE-2025-44848 | TOTOLINK Ca600-poe command injection | 6.5CISA ADP v3.1 | 0.9% | 2025-05-01 | |
| CVE-2025-44847 | TOTOLINK Ca600-poe command injection | 6.3CISA ADP v3.1 | 0.9% | 2025-05-01 | |
| CVE-2025-44846 | TOTOLINK Ca600-poe command injection | 6.3CISA ADP v3.1 | 0.9% | 2025-05-01 | |
| CVE-2025-44845 | TOTOLINK Ca600-poe command injection | 6.5CISA ADP v3.1 | 0.9% | 2025-05-01 | |
| CVE-2025-44844 | TOTOLINK Ca600-poe command injection | 6.5CISA ADP v3.1 | 0.9% | 2025-05-01 | |
| CVE-2025-44843 | TOTOLINK Ca600-poe command injection | 6.5CISA ADP v3.1 | 1.0% | 2025-05-01 | |
| CVE-2025-44842 | TOTOLINK Ca600-poe command injection | 6.5CISA ADP v3.1 | 0.9% | 2025-05-01 | |
| CVE-2025-44841 | TOTOLINK Ca600-poe command injection | 6.5CISA ADP v3.1 | 0.9% | 2025-05-01 | |
| CVE-2025-44840 | TOTOLINK Ca600-poe command injection | 6.5CISA ADP v3.1 | 0.9% | 2025-05-01 | |
| CVE-2025-44839 | TOTOLINK Ca600-poe command injection | 6.5CISA ADP v3.1 | 0.9% | 2025-05-01 | |
| CVE-2025-44838 | TOTOLINK CP900 command injection | 6.3CISA ADP v3.1 | 0.9% | 2025-05-01 | |
| CVE-2025-44837 | TOTOLINK CP900 command injection | 6.3CISA ADP v3.1 | 0.9% | 2025-05-01 | |
| CVE-2025-44836 | TOTOLINK CP900 command injection | 6.3CISA ADP v3.1 | 0.9% | 2025-05-01 | |
| CVE-2025-44835 | D-Link DIR-816 A2 command injection | 6.3CISA ADP v3.1 | 1.1% | 2025-05-01 | |
| CVE-2025-43595 | MSP360 Backup (for Linux) insecure filesystem permissions | 9.8v3.1 | 0.4% | 2025-05-01 | Fix |
| CVE-2025-37796 | Linux kernel at76c50x Wi-Fi driver use-after-free | 7.8v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37794 | Linux kernel mac80211 virtual interface stop null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37793 | Linux kernel Intel AVS audio driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37792 | Linux kernel btrtl Bluetooth driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37791 | Linux kernel ethtool CMIS CDB polling vulnerability | 7.8CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37790 | Linux kernel MCTP socket bind lookup vulnerability | 8.8CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37789 | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix nested key length validation in the set() action It's not safe to access nla_len(ovs_key) if the data is smaller than the netlink header. Check that the attribute is OK first. | 7.8CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37788 | Linux kernel cxgb4 ethtool filters memory leak | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37787 | Linux kernel mv88e6xxx devlink regions null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37786 | Linux kernel DSA switch tree setup use-after-free | 7.8v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37784 | Linux kernel TI ICSS IEP PTP driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37783 | Linux kernel MSM DPU virtual plane driver null pointer dereference | 5.5v3.1 | 0.1% | 2025-05-01 | Fix |
| CVE-2025-37781 | Linux kernel cros-ec I2C tunnel driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37780 | Linux kernel isofs file handle lookup out-of-bounds read | 7.1v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37779 | Linux kernel iov_iter folio handling double free | 7.8CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37778 | Linux kernel ksmbd use-after-free | 9.8CNA v3.1 | 1.1% | 2025-05-01 | Fix |
| CVE-2025-37777 | Linux kernel ksmbd lease break notification use-after-free | 8.8CNA v3.1 | 0.4% | 2025-05-01 | Fix |
| CVE-2025-37776 | Linux kernel ksmbd oplock break handling use-after-free | 8.8CNA v3.1 | 0.4% | 2025-05-01 | Fix |
| CVE-2025-37775 | Linux kernel ksmbd file write handling vulnerability | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37774 | Linux kernel slab allocator memory-tagging extensions null pointer dereference | 7.8CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37773 | Linux kernel virtiofs filesystem context vulnerability | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37772 | Linux kernel RDMA/cma crash | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37771 | Linux kernel drm/amd/pm divide by zero | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37770 | Linux kernel drm/amd/pm divide by zero | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37769 | Linux kernel AMD GPU SMU11 fan speed control divide by zero | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37768 | Linux kernel drm/amd/pm divide by zero | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37767 | Linux kernel drm/amd/pm divide by zero | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37766 | Linux kernel drm/amd/pm divide by zero | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37765 | Linux kernel Nouveau PRIME buffer delayed deletion use-after-free | 7.8CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37764 | Linux kernel Imagination GPU firmware image processing memory leak | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37763 | Linux kernel Imagination GPU scheduler paired job handling use-after-free | 7.8CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37762 | In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix missed dmabuf unpinning in error path of prepare_fb() Correct error handling in prepare_fb() to fix leaking resources when error happens. | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37761 | Linux kernel Xe TLB invalidation range calculation out-of-bounds read | 7.8CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37760 | In the Linux kernel, the following vulnerability has been resolved: mm/vma: add give_up_on_oom option on modify/merge, use in uffd release Currently, if a VMA merge fails due to an OOM condition arising on commit merge or a failure to duplicate anon_vma's, we report this so the caller can handle i | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37759 | Linux kernel ublk queue abort handling null pointer dereference | 5.5NVD v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37758 | Linux kernel pata_pxa driver probe null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37757 | Linux kernel TIPC link transmit memory leak | 7.5CNA v3.1 | 0.4% | 2025-05-01 | Fix |
| CVE-2025-37756 | Linux kernel TLS socket disconnect handling vulnerability | 7.8CNA v3.1 | 0.3% | 2025-05-01 | Fix |
| CVE-2025-37755 | Linux kernel libwx page pool allocation null pointer dereference | 7.5CNA v3.1 | 0.4% | 2025-05-01 | Fix |
| CVE-2025-37754 | Linux kernel i915 HuC load fence handling memory leak | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37752 | Linux kernel sch_sfq crash | 7.8CNA v3.1 | 0.3% | 2025-05-01 | Fix |
| CVE-2025-37751 | Linux kernel x86 CPU erratum table lookup vulnerability | 7.1CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37750 | Linux kernel SMB client multichannel decryption use-after-free | 9.8CNA v3.1 | 0.4% | 2025-05-01 | Fix |
| CVE-2025-37749 | Linux kernel PPP synchronous transmit out-of-bounds read | 8.2CNA v3.1 | 0.4% | 2025-05-01 | Fix |
| CVE-2025-37748 | Linux kernel MediaTek IOMMU driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37747 | Linux kernel perf sigtrap event handling denial of service | 5.5NVD v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37746 | Linux kernel dwc_pcie performance monitor driver incorrect type conversion | 5.5NVD v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37745 | Linux kernel hibernate compressor parameter handling deadlock | 5.5v3.1 | 0.1% | 2025-05-01 | Fix |
| CVE-2025-37744 | Linux kernel ath12k Wi-Fi driver PCI removal memory leak | 5.5v3.1 | 0.1% | 2025-05-01 | Fix |
| CVE-2025-37743 | Linux kernel ath12k Wi-Fi driver statistics memory leak | 5.5NVD v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37742 | Linux kernel JFS inode map (diMount) vulnerability | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37741 | Linux kernel JFS inode deallocation (diFree) deadlock | 7.8CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37740 | Linux kernel JFS dbMount block allocation divide by zero | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37739 | Linux kernel f2fs inode truncation out-of-bounds read | 7.1v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-37738 | Linux kernel ext4 extended attributes use-after-free | 7.8CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-36558 | KUNBUS Revolution Pi improper neutralization of server-side includes (SSI) within a web page | 5.1CNA v4.0 | 19.9% | 2025-05-01 | Fix |
| CVE-2025-36521 | MicroDicom DICOM Viewer out-of-bounds read | 8.6CNA v4.0 | 0.5% | 2025-05-01 | Fix |
| CVE-2025-35996 | KUNBUS Revolution Pi improper neutralization of server-side includes (SSI) within a web page | 8.5CNA v4.0 | 19.5% | 2025-05-01 | Fix |
| CVE-2025-35975 | MicroDicom DICOM Viewer out-of-bounds write | 8.6CNA v4.0 | 0.6% | 2025-05-01 | Fix |
| CVE-2025-32890 | Gotenna missing integrity check | 6.5v3.1 | 0.1% | 2025-05-01 | |
| CVE-2025-32889 | Gotenna hard-coded credentials | 8.8v3.1 | 0.2% | 2025-05-01 | |
| CVE-2025-32888 | Gotenna hard-coded credentials | 8.8v3.1 | 0.2% | 2025-05-01 | |
| CVE-2025-32887 | Gotenna cleartext transmission of sensitive information | 6.5NVD v3.1 | 0.2% | 2025-05-01 | |
| CVE-2025-32886 | Gotenna improper channel restriction | 5.5v3.1 | 0.1% | 2025-05-01 | |
| CVE-2025-32885 | Gotenna weak authentication | 6.5v3.1 | 0.2% | 2025-05-01 | |
| CVE-2025-32884 | Gotenna cleartext transmission of sensitive information | 6.5v3.1 | 0.2% | 2025-05-01 | |
| CVE-2025-32882 | Gotenna missing integrity check | 6.5v3.1 | 0.1% | 2025-05-01 | |
| CVE-2025-32881 | Gotenna cleartext transmission of sensitive information | 6.5v3.1 | 0.2% | 2025-05-01 | |
| CVE-2025-32011 | KUNBUS Revolution Pi authentication bypass by primary weakness | 9.3CNA v4.0 | 28.7% | 2025-05-01 | Fix |
| CVE-2025-27365 | IBM MQ Operator denial of service | 6.5CNA v3.1 | 0.4% | 2025-05-01 | Fix |
| CVE-2025-27007 | Brainstorm Force OttoKit incorrect privilege assignment | 9.8CNA v3.1 | 53.9% | 2025-05-01 | Reported exploitedNucleiMetasploitExploit codeFix |
| CVE-2025-25016 | Kibana unrestricted upload of file | 4.3CNA v3.1 | 0.3% | 2025-05-01 | Fix |
| CVE-2025-24522 | KUNBUS Revolution Pi authentication bypass by primary weakness | 9.3CNA v4.0 | 0.8% | 2025-05-01 | Fix |
| CVE-2025-23254 | NVIDIA TensorRT-LLM deserialization of untrusted data | 8.8CNA v3.1 | 0.3% | 2025-05-01 | Fix |
| CVE-2025-23246 | NVIDIA vGPU Software, Cloud Gaming denial of service | 5.5CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-23245 | NVIDIA vGPU Software, Cloud Gaming incorrect permission assignment | 5.5CNA v3.1 | 0.1% | 2025-05-01 | Fix |
| CVE-2025-23244 | NVIDIA GPU Display Driver incorrect authorization | 7.8CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-23163 | Linux kernel VLAN device open flag propagation deadlock | 5.5v3.1 | 0.1% | 2025-05-01 | Fix |
| CVE-2025-23162 | Linux kernel Xe GPU virtual function GT reset vulnerability | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-23161 | Linux kernel VMD PCI config space lock improper locking | 5.5v3.1 | 0.1% | 2025-05-01 | Fix |
| CVE-2025-23160 | Linux kernel MediaTek vcodec firmware initialization memory leak | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-23159 | Linux kernel Venus HFI subsystem failure region out-of-bounds write | 8.4CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-23158 | Linux kernel Venus HFI shared queue handling out-of-bounds write | 7.8CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-23157 | Linux kernel Venus HFI codec table parser out-of-bounds read | 7.8CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-23156 | Linux kernel Venus HFI packet parser out-of-bounds read | 7.8CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-23155 | Linux kernel stmmac IRQ affinity hint vulnerability | 7.1CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-23154 | Linux kernel io_uring send bundle completion handling vulnerability | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-23153 | In the Linux kernel, the following vulnerability has been resolved: arm/crc-t10dif: fix use of out-of-scope array in crc_t10dif_arch() Fix a silly bug where an array was used outside of its scope. | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-23152 | In the Linux kernel, the following vulnerability has been resolved: arm64/crc-t10dif: fix use of out-of-scope array in crc_t10dif_arch() Fix a silly bug where an array was used outside of its scope. | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-23151 | Linux kernel MHI host transfer descriptor generation race condition | 7.8CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-23150 | Linux kernel ext4 directory entry splitting off-by-one error | 7.8CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-23149 | Linux kernel TPM chip driver vulnerability | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-23148 | Linux kernel Exynos ChipID driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-23147 | Linux kernel I3C master IBI handling null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-23146 | Linux kernel ene-kb3930 MFD driver null pointer dereference | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-23145 | Linux kernel MPTCP subflow acceptance null pointer dereference | 7.5CNA v3.1 | 0.6% | 2025-05-01 | Fix |
| CVE-2025-23144 | Linux kernel led_bl backlight driver vulnerability | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-23143 | Linux kernel socket lock class initialization null pointer dereference | 5.5NVD v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-23142 | Linux kernel SCTP sendmsg transport handling use-after-free | 7.8CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-23141 | Linux kernel KVM x86 MP state handling vulnerability | 7.8CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-23140 | Linux kernel pci_endpoint_test IRQ handling vulnerability | 5.5v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-4183 | PCMan FTP Server RECV command buffer overflow | 9.8v3.1 | 0.8% | 2025-05-01 | |
| CVE-2025-4182 | PCMan FTP Server BELL command buffer overflow | 9.8v3.1 | 0.8% | 2025-05-01 | |
| CVE-2025-4181 | PCMan FTP Server SEND command buffer overflow | 9.8v3.1 | 0.8% | 2025-05-01 | |
| CVE-2025-4180 | PCMan FTP Server TRACE command buffer overflow | 9.8v3.1 | 0.8% | 2025-05-01 | |
| CVE-2025-4178 | xiaowei1118 java_server file upload API FoodController.java path traversal | 5.4v3.1 | 0.7% | 2025-05-01 | |
| CVE-2025-4176 | PHPGurukul Blood Bank and Donor Management System request-received-bydonar.php SQL injection | 9.8v3.1 | 0.6% | 2025-05-01 | |
| CVE-2025-4175 | AlanBinu007 Spring-Boot-Advanced-Projects upload profile API endpoint path traversal | 5.3CNA v4.0 | 0.6% | 2025-05-01 | |
| CVE-2025-4174 | PHPGurukul COVID19 Testing Management System login.php SQL injection | 9.8v3.1 | 0.6% | 2025-05-01 | |
| CVE-2025-4173 | SourceCodester Online Eyewear Shop Master.php delete_cart SQL injection | 8.8v3.1 | 0.5% | 2025-05-01 | |
| CVE-2025-4164 | PHPGurukul Employee Record Management System changepassword.php SQL injection | 9.8v3.1 | 0.6% | 2025-05-01 | |
| CVE-2025-4163 | PHPGurukul Land Record System aboutus.php SQL injection | 9.8v3.1 | 0.5% | 2025-05-01 | |
| CVE-2025-4162 | PCMan FTP Server ASCII command buffer overflow | 9.8v3.1 | 0.8% | 2025-05-01 | |
| CVE-2025-4161 | PCMan FTP Server VERBOSE command buffer overflow | 9.8v3.1 | 0.8% | 2025-05-01 | |
| CVE-2025-4160 | PCMan FTP Server LS command buffer overflow | 9.8v3.1 | 0.8% | 2025-05-01 | |
| CVE-2025-4159 | PCMan FTP Server GLOB command buffer overflow | 9.8v3.1 | 0.8% | 2025-05-01 | |
| CVE-2025-4158 | PCMan FTP Server PROMPT command buffer overflow | 9.8v3.1 | 0.8% | 2025-05-01 | |
| CVE-2025-4157 | PHPGurukul Boat Booking System booking-details.php SQL injection | 8.8v3.1 | 0.5% | 2025-05-01 | |
| CVE-2025-4156 | PHPGurukul Boat Booking System change-image.php SQL injection | 8.8v3.1 | 0.5% | 2025-05-01 | |
| CVE-2025-4155 | PHPGurukul Boat Booking System edit-boat.php SQL injection | 8.8v3.1 | 0.5% | 2025-05-01 | |
| CVE-2025-4154 | PHPGurukul Pre-School Enrollment System enrollment-details.php SQL injection | 8.8v3.1 | 0.5% | 2025-05-01 | |
| CVE-2025-4153 | PHPGurukul Park Ticketing Management System profile.php SQL injection | 9.8v3.1 | 0.6% | 2025-05-01 | |
| CVE-2025-4152 | PHPGurukul Online Birth Certificate System bwdates-reports-details.php SQL injection | 9.8v3.1 | 0.4% | 2025-05-01 | |
| CVE-2025-4151 | PHPGurukul Curfew e-Pass Management System pass-bwdates-reports-details.php SQL injection | 9.8v3.1 | 0.6% | 2025-05-01 | |
| CVE-2025-4150 | Netgear EX6200 sub_54340 buffer overflow | 9.8v3.1 | 1.6% | 2025-05-01 | |
| CVE-2025-4149 | Netgear EX6200 sub_54014 buffer overflow | 9.8v3.1 | 1.7% | 2025-05-01 | |
| CVE-2025-4148 | Netgear EX6200 sub_503FC buffer overflow | 9.8v3.1 | 1.7% | 2025-05-01 | |
| CVE-2025-4147 | Netgear EX6200 sub_47F7C buffer overflow | 9.8v3.1 | 1.2% | 2025-05-01 | |
| CVE-2025-4146 | Netgear EX6200 sub_41940 buffer overflow | 9.8v3.1 | 1.5% | 2025-05-01 | |
| CVE-2025-4145 | Netgear EX6200 sub_3D0BC buffer overflow | 9.8v3.1 | 1.2% | 2025-05-01 | |
| CVE-2025-4144 | Cloudflare Workers-oauth-provider PKCE bypass via downgrade attack | 9.8NVD v3.1 | 0.6% | 2025-05-01 | Fix |
| CVE-2025-4143 | Cloudflare Workers-oauth-provider missing validation of redirect_uri on authorize endpoint | 6.1NVD v3.1 | 0.3% | 2025-05-01 | Fix |
| CVE-2025-4100 | Nautic Pages WordPress plugin authenticated (Contributor+) stored cross-site scripting via shortcode | 6.4CNA v3.1 | 0.2% | 2025-05-01 | |
| CVE-2025-4099 | List Children WordPress plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-05-01 | Fix |
| CVE-2025-3952 | Projectopia WordPress plugin unauthorized access | 8.1CNA v3.1 | 0.4% | 2025-05-01 | Fix |
| CVE-2025-3890 | WordPress Simple PayPal Shopping Cart plugin stored cross-site scripting | 5.4v3.1 | 0.3% | 2025-05-01 | Fix |
| CVE-2025-3889 | WordPress Simple PayPal Shopping Cart plugin insecure direct object reference via quantity | 5.3v3.1 | 0.3% | 2025-05-01 | Fix |
| CVE-2025-3874 | WordPress Simple PayPal Shopping Cart plugin insecure direct object reference | 6.5v3.1 | 0.4% | 2025-05-01 | Fix |
| CVE-2025-3521 | Team Members WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.3% | 2025-05-01 | Fix |
| CVE-2025-3517 | Devolutions Server PAM JIT elevation feature incorrect privilege assignment | 6.3CISA ADP v3.1 | 0.3% | 2025-05-01 | Fix |
| CVE-2025-3504 | WP Maps WordPress plugin Admin+ stored XSS | 4.8NVD v3.1 | 0.3% | 2025-05-01 | Fix |
| CVE-2025-3503 | WP Maps WordPress plugin Admin+ stored XSS | 4.8NVD v3.1 | 0.3% | 2025-05-01 | Fix |
| CVE-2025-3502 | WP Maps WordPress plugin Admin+ stored XSS | 4.8NVD v3.1 | 0.3% | 2025-05-01 | Fix |
| CVE-2025-2816 | Page View Count - missing authorization to Authenticated (Subscriber+) Limited Options Update | 8.1CNA v3.1 | 0.4% | 2025-05-01 | Fix |
| CVE-2025-2168 | Ultimate Store Kit Elementor Addons WordPress plugin cross-site request forgery | 4.3CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-1529 | AM LottiePlayer WordPress plugin stored cross-site scripting | 6.4CNA v3.1 | 0.2% | 2025-05-01 | Fix |
| CVE-2025-1333 | IBM MQ Operator information disclosure | 6.0CNA v3.1 | 0.3% | 2025-05-01 | Fix |
| CVE-2025-1305 | NewsBlogger WordPress theme cross-site request forgery to arbitrary plugin installation | 8.8v3.1 | 0.4% | 2025-05-01 | Fix |
| CVE-2025-1304 | NewsBlogger WordPress theme authenticated (Subscriber+) arbitrary file upload | 8.8v3.1 | 1.1% | 2025-05-01 | Exploit codeFix |