CVEs published April 7, 2025
169 CVEs were published on April 7, 2025: 10 critical, 60 high. 1 is now in CISA KEV.
- Published
- 169
- Critical
- 10
- High
- 60
- Medium
- 89
- Low
- 10
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 24
Most affected products
- Qualcomm Snapdragon
- 34
- codeprojects Online Restaurant Management System
- 16
- Huawei HarmonyOS
- 14
- PCMan FTP Server
- 11
- OpenHarmony
- 7
- Huawei HarmonyOS · Huawei EMUI
- 6
- MediaTek MT9972
- 4
- apollographql router · apollo-router
- 3
- PHPGurukul Old Age Home Management System
- 3
- AmauriC tarteaucitron.js · tarteaucitronjs
- 2
Critical 10
- CVE-2025-3248Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/codelangflow-ai langflow · langflow +1
- CVE-2025-20654In wlan service, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT6890, MT7622, MT7915, MT7916, MT7981, MT7986
- CVE-2025-28402An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobId parameter
- CVE-2025-28405An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the changeStatus method
- CVE-2025-28406An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the jobLogId parameter
- CVE-2025-28408An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the selectDeptTree method of the /selectDeptTree/{deptId}…
- CVE-2025-28410An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the cancelAuthUserAll method does not properly validate…
- CVE-2025-28411An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method in /tool/gen/editSave
- CVE-2025-28412An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the /editSave method in SysNoticeController
- CVE-2025-28413An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the SysDictTypeController component
High 60
- CVE-2025-0942Jalios JPlatform 10 SP6 < 10.0.6 Record Chooser SQL InjectionJalios JPlatform
- CVE-2025-32034Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansionapollographql router · apollo-router
- CVE-2025-32033Apollo Router Operation Limits Vulnerable to Bypass via Integer Overflowapollographql router · apollo-router
- CVE-2025-32032Apollo Router Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypassapollographql router · apollo-router
- CVE-2025-32031Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypassapollographql federation · @apollo/gateway
- CVE-2025-32030Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansionapollographql federation · @apollo/gateway
- CVE-2025-31496apollo-compiler Named Fragment Processing Vulnerabilityapollographql apollo-rs · apollo-compiler
- CVE-2025-29769libvips has a potential heap-based buffer overflow when attempting to convert multiband TIFF input to HEIF outputlibvips
- CVE-2025-3426Use of default hardcoded credentialsPhilips IntelliSpace Portal · Philips Advanced Visualizatio…
- CVE-2025-3425Unauthenticated Remote Code Execution via .NET DeserializationPhilips IntelliSpace Portal
- CVE-2025-34243.2.1 Arbitrary File Read in insecure .NET Remoting TCP ChannelPhilips IntelliSpace Portal
- CVE-2025-30195A crafted zone can lead to an illegal memory access in the PowerDNS RecursorPowerDNS Recursor
- CVE-2025-21448Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2025-21447Improper Validation of Array Index in Computer VisionQualcomm Snapdragon
- CVE-2025-21443Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Automotive Vehicle NetworksQualcomm Snapdragon
- CVE-2025-21442Integer Overflow to Buffer Overflow in Automotive Vehicle NetworksQualcomm Snapdragon
- CVE-2025-21441Out-of-bounds Read in Windows WLAN HostQualcomm Snapdragon
- CVE-2025-21440Out-of-bounds Read in Windows WLAN HostQualcomm Snapdragon
- CVE-2025-21439Out-of-bounds Read in Windows WLAN HostQualcomm Snapdragon
- CVE-2025-21438Out-of-bounds Read in Windows WLAN HostQualcomm Snapdragon
- CVE-2025-21437Use After Free in Automotive Linux OSQualcomm Snapdragon
- CVE-2025-21436Use After Free in DSP ServiceQualcomm Snapdragon
- CVE-2025-21435Buffer Over-read in WLAN Host CommunicationQualcomm Snapdragon
- CVE-2025-21434Buffer Over-read in WLAN HostQualcomm Snapdragon
- CVE-2025-21430Buffer Over-read in WLAN HostQualcomm Snapdragon
Show all 60 entriesShow fewer entries
- CVE-2025-21429Buffer Over-read in WLAN HostQualcomm Snapdragon
- CVE-2025-21428Buffer Over-read in WLAN HostQualcomm Snapdragon
- CVE-2025-21425Improper Access Control in Automotive Linux OSQualcomm Snapdragon
- CVE-2025-21423Improper Validation of Array Index in DisplayQualcomm Snapdragon
- CVE-2025-21421Buffer Over-read in DisplayQualcomm Snapdragon
- CVE-2024-45557Use of Out-of-range Pointer Offset in Trust Management EngineQualcomm Snapdragon
- CVE-2024-45552Buffer Over-read in Data Network Stack & ConnectivityQualcomm Snapdragon
- CVE-2024-45549Exposure of Sensitive System Information to an Unauthorized Control Sphere in KERNELQualcomm Snapdragon
- CVE-2024-43067Time-of-check Time-of-use (TOCTOU) Race Condition in CameraQualcomm Snapdragon
- CVE-2024-43066Use After Free in HLOSQualcomm Snapdragon
- CVE-2024-43065Exposed Dangerous Method or Function in HLOSQualcomm Snapdragon
- CVE-2024-43058Incorrect Type Conversion or Cast in Multimedia FrameworksQualcomm Snapdragon
- CVE-2024-33058Insufficient Granularity of Access Control in CoreQualcomm Snapdragon
- CVE-2025-3346Tenda AC7 SetPptpServerCfg formSetPPTPServer buffer overflowTenda AC7
- CVE-2025-30473Apache Airflow Common SQL Provider: Remote Code Execution via Sql InjectionApache Software Foundation apache-airflow-providers-common-…
- CVE-2024-11859DLL Search Order Hijacking in ESET products for WindowsESET, spol. s r.o. ESET NOD32 Antivirus · ESET, spol. s… +9
- CVE-2024-11071Improper Access Control In DestinyECMCyberdigm DestinyECM
- CVE-2025-31175Deserialization mismatch vulnerability in the DSoftBus module Impact: Successful exploitation of this vulnerability may affect service…Huawei HarmonyOS · Huawei EMUI
- CVE-2025-31173Memory write permission bypass vulnerability in the kernel futex module Impact: Successful exploitation of this vulnerability may affect…Huawei HarmonyOS
- CVE-2025-31172Memory write permission bypass vulnerability in the kernel futex module Impact: Successful exploitation of this vulnerability may affect…Huawei HarmonyOS
- CVE-2025-31170Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect…Huawei HarmonyOS · Huawei EMUI
- CVE-2024-58127Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect…Huawei HarmonyOS · Huawei EMUI
- CVE-2024-58126Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect…Huawei HarmonyOS · Huawei EMUI
- CVE-2024-58125Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect…Huawei HarmonyOS · Huawei EMUI
- CVE-2024-58124Access control vulnerability in the security verification module Impact: Successful exploitation of this vulnerability will affect…Huawei HarmonyOS · Huawei EMUI
- CVE-2024-58112Exception capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this…Huawei HarmonyOS
- CVE-2024-58111Exception capture failure vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this…Huawei HarmonyOS
- CVE-2024-58107Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability.Huawei HarmonyOS
- CVE-2025-20664In wlan AP driver, there is a possible information disclosure due to an uncaught exception.MediaTek MT7915, MT7916, MT7981, MT7986, MT7990, MT7992
- CVE-2025-20663In wlan AP driver, there is a possible information disclosure due to an uncaught exception.MediaTek MT7915, MT7916, MT7981, MT7986
- CVE-2025-3328Tenda AC1206 fast_setting_wifi_set form_fast_setting_wifi_set buffer overflowTenda AC1206
- CVE-2025-28403An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the editSave method does not properly validate whether the…
- CVE-2025-28407An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the edit method of the /edit/{dictId} endpoint does not…
- CVE-2025-28409An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the add method of the /add/{parentId} endpoint does not…
- CVE-2025-32409Ratta SuperNote A6 X2 Nomad before December 2024 allows remote code execution because an arbitrary firmware image (signed with debug keys)…Ratta SuperNote A6 X2 Nomad
Medium, low and unrated 99
- CVE-2025-3389hailey888 oa_system Backend InformManageController.java testMess cross site scriptinghailey888 oa_system
- CVE-2025-3388hailey888 oa_system Frontend LoginsController.java loginCheck cross site scriptinghailey888 oa_system
- CVE-2025-3387renrenio renren-security JSON cross site scriptingrenrenio renren-security
- CVE-2025-3386LinZhaoguan pb-cms Friendship Link admin#links cross site scriptingLinZhaoguan pb-cms
- CVE-2025-3385LinZhaoguan pb-cms Classification Management Page cross site scriptingLinZhaoguan pb-cms
- CVE-2025-33841000 Projects Human Resource Management System employee.php sql injection1000 Projects Human Resource Management System
- CVE-2025-3383SourceCodester Web-based Pharmacy Product Management System search_sales.php sql injectionSourceCodester Web-based Pharmacy Product Management System
- CVE-2025-32029ts-asn1-der has Incorrect DER Encoding of Numbers Leading to Denial of Service and Incorrect Value RepresentationApelegHQ ts-asn1-der · @apeleghq/asn1-der
- CVE-2025-3382joey-zhou xiaozhi-esp32-server-java update sql injectionjoey-zhou xiaozhi-esp32-server-java
- CVE-2025-3381zhangyanbo2007 youkefu File Upload WebIMController.java path traversalzhangyanbo2007 youkefu
- CVE-2025-3380PCMan FTP Server FEAT Command buffer overflowPCMan FTP Server
- CVE-2025-3379PCMan FTP Server EPSV Command buffer overflowPCMan FTP Server
- CVE-2025-3378PCMan FTP Server EPRT Command buffer overflowPCMan FTP Server
- CVE-2025-3377PCMan FTP Server ENC Command buffer overflowPCMan FTP Server
- CVE-2024-38797Out-of-bounds Read in HashPeImageByType()TianoCore EDK2
- CVE-2025-3376PCMan FTP Server CONF Command buffer overflowPCMan FTP Server
- CVE-2025-3375PCMan FTP Server CDUP Command buffer overflowPCMan FTP Server
- CVE-2025-3374PCMan FTP Server CCC Command buffer overflowPCMan FTP Server
- CVE-2025-3373PCMan FTP Server SITE CHMOD Command buffer overflowPCMan FTP Server
- CVE-2025-3372PCMan FTP Server MKDIR Command buffer overflowPCMan FTP Server
- CVE-2025-32014estree-util-value-to-estree allows prototype pollution in generated ESTreeremcohaszing estree-util-value-to-estree · estree-util-valu…
- CVE-2025-31476tarteaucitron.js allows url scheme injection via unfiltered inputsAmauriC tarteaucitron.js · tarteaucitronjs +1
- CVE-2025-31475tarteaucitron.js allows prototype pollution via custom text injectionAmauriC tarteaucitron.js · tarteaucitronjs
- CVE-2025-31138tarteaucitron.js allows UI manipulation via unrestricted CSS injectionAmauriC tarteaucitron.js · tarteaucitronjs
- CVE-2025-30373Graylog Authenticated HTTP inputs do ingest message even if Authorization header is missing or has wrong valuegraylog2-server · org.graylog2:graylog2-server
Show all 99 entriesShow fewer entries
- CVE-2025-3371PCMan FTP Server DELETE Command buffer overflowPCMan FTP Server
- CVE-2025-2251Org.jboss.eap:wildfly-ejb3: improper deserialization in jboss marshalling allows remote code executionwildfly · Red Hat JBoss Enterprise Application Platform
- CVE-2025-3370PHPGurukul Men Salon Management System admin-profile.php sql injectionPHPGurukul Men Salon Management System
- CVE-2025-3369xxyopen Novel-Plus list sql injectionxxyopen Novel-Plus
- CVE-2025-27686Dell Unisphere for PowerMax, version(s) prior to 10.2.0.9 and PowerMax version(s) prior to PowerMax 9.2.4.15, contain an Improper…Dell Unisphere for PowerMax
- CVE-2025-3353PHPGurukul Men Salon Management System add-services.php sql injectionPHPGurukul Men Salon Management System
- CVE-2025-3360Glibc: glib prior to 2.82.5 is vulnerable to integer overflow and buffer under-read when parsing a very long invalid iso 8601 timestamp…glib · Red Hat Enterprise Linux +1
- CVE-2025-3359Gnuplot: segmentation fault via io_str_init_static_internal functiongnuplot · Red Hat Enterprise Linux
- CVE-2025-3352PHPGurukul Old Age Home Management System edit-scdetails.php sql injectionPHPGurukul Old Age Home Management System
- CVE-2025-0050Mali GPU Userspace Driver allows an Out-of-Bounds accessArm Valhall GPU Userspace Driver · Arm 5th Gen GPU Arch… +1
- CVE-2025-3351PHPGurukul Old Age Home Management System login.php sql injectionPHPGurukul Old Age Home Management System
- CVE-2025-3350PHPGurukul Old Age Home Management System view-enquiry.php sql injectionPHPGurukul Old Age Home Management System
- CVE-2025-3349PCMan FTP Server SYST Command buffer overflowPCMan FTP Server
- CVE-2025-3348code-projects Patient Record Management System edit_dpatient.php sql injectioncode-projects Patient Record Management System
- CVE-2025-21431Time-of-check Time-of-use (TOCTOU) Race Condition in Automotive OS PlatformQualcomm Snapdragon
- CVE-2024-49848Use After Free in DSP ServiceQualcomm Snapdragon
- CVE-2024-45556Improper Access Control for Register Interface in TZ FirmwareQualcomm Snapdragon
- CVE-2024-45551Weak Authentication in HLOSQualcomm Snapdragon
- CVE-2024-45544Use After Free in Data Network Stack & ConnectivityQualcomm Snapdragon
- CVE-2024-45543Out-of-bounds Write in AudioQualcomm Snapdragon
- CVE-2024-45540Use After Free in HLOSQualcomm Snapdragon
- CVE-2024-43046Information Exposure in TZ Secure OSQualcomm Snapdragon
- CVE-2025-3347code-projects Patient Record Management System dental_pending.php sql injectioncode-projects Patient Record Management System
- CVE-2025-3345codeprojects Online Restaurant Management System combo.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3344codeprojects Online Restaurant Management System assign_save.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3343codeprojects Online Restaurant Management System reservation_update.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3342codeprojects Online Restaurant Management System payment_save.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3341codeprojects Online Restaurant Management System reservation_view.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3340codeprojects Online Restaurant Management System combo_update.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3339codeprojects Online Restaurant Management System user_update.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3338codeprojects Online Restaurant Management System user_save.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3337codeprojects Online Restaurant Management System member_update.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3336codeprojects Online Restaurant Management System member_save.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3335codeprojects Online Restaurant Management System category_update.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-31174Path traversal vulnerability in the DFS module Impact: Successful exploitation of this vulnerability may affect service confidentiality.Huawei HarmonyOS
- CVE-2025-31171File read permission bypass vulnerability in the kernel file system module Impact: Successful exploitation of this vulnerability may…Huawei HarmonyOS
- CVE-2024-58116Buffer overflow vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may…Huawei HarmonyOS
- CVE-2024-58115Buffer overflow vulnerability in the SVG parsing module of the ArkUI framework Impact: Successful exploitation of this vulnerability may…Huawei HarmonyOS
- CVE-2024-58113Vulnerability of improper resource management in the memory management module Impact: Successful exploitation of this vulnerability may…Huawei HarmonyOS
- CVE-2024-58110Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability.Huawei HarmonyOS
- CVE-2024-58109Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability.Huawei HarmonyOS
- CVE-2024-58108Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability.Huawei HarmonyOS
- CVE-2024-58106Buffer overflow vulnerability in the codec module Impact: Successful exploitation of this vulnerability may affect availability.Huawei HarmonyOS
- CVE-2025-3334codeprojects Online Restaurant Management System category_save.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-20662In PlayReady TA, there is a possible out of bounds read due to a missing bounds check.MediaTek MT9972
- CVE-2025-20661In PlayReady TA, there is a possible out of bounds read due to a missing bounds check.MediaTek MT9972
- CVE-2025-20660In PlayReady TA, there is a possible out of bounds read due to a missing bounds check.MediaTek MT9972
- CVE-2025-20659In Modem, there is a possible system crash due to improper input validation.MediaTek MT2735, MT2737, MT6739, MT6761, MT6762, MT6762D, M…
- CVE-2025-20658In DA, there is a possible permission bypass due to a logic error.MediaTek MT2718, MT6781, MT6789, MT6835, MT6855, MT6878, MT…
- CVE-2025-20657In vdec, there is a possible permission bypass due to improper input validation.MediaTek MT6765, MT6768, MT6781, MT6789, MT6833, MT6853, MT…
- CVE-2025-20656In DA, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6781, MT6789, MT6835, MT6855, MT6878, MT6879, MT…
- CVE-2025-20655In keymaster, there is a possible out of bounds read due to a missing bounds check.MediaTek MT9972
- CVE-2025-3333codeprojects Online Restaurant Management System menu_update.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-27534arkcompiler_ets_runtime has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2025-25057third_party_NuttX has a memory leak vulnerabilityOpenHarmony
- CVE-2025-24304arkcompiler_ets_runtime has an out-of-bounds write vulnerabilityOpenHarmony
- CVE-2025-22851Liteos_A has an integer overflow vulnerabilityOpenHarmony
- CVE-2025-22842arkcompiler_ets_runtime has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2025-22452arkcompiler_ets_runtime has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2025-20102arkcompiler_ets_runtime has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2025-3332codeprojects Online Restaurant Management System menu_save.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3331codeprojects Online Restaurant Management System payment_save.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3330codeprojects Online Restaurant Management System reservation_save.php sql injectioncodeprojects Online Restaurant Management System
- CVE-2025-3329Consumer Comanda Mobile Restaurant Order cleartext transmissionConsumer Comanda Mobile
- CVE-2025-3327iteaj iboot 物联网网关 File Upload batch cross site scriptingiteaj iboot 物联网网关
- CVE-2024-46494A cross-site scripting (XSS) vulnerability in Typecho v1.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted…
- CVE-2025-28400An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the postID parameter in the edit method
- CVE-2025-28401An issue in RUoYi v.4.8.0 allows a remote attacker to escalate privileges via the menuId parameter
- CVE-2025-29087In SQLite 3.44.0 through 3.49.0 before 3.49.1, the concat_ws() SQL function can cause memory to be written beyond the end of a malloc-allocaSQLite
- CVE-2025-29478An issue in fluent-bit v.3.7.2 allows a local attacker to cause a denial of service via the cfl_list_size in cfl_list.h:165.
- CVE-2025-29480Buffer Overflow vulnerability in gdal 3.10.2 allows a local attacker to cause a denial of service via the OGRSpatialReference::Release…gdal
- CVE-2025-29481Buffer Overflow vulnerability in libbpf 1.5.0 allows a local attacker to execute arbitrary code via the bpf_object__init_prog` function of…
- CVE-2025-29482Buffer Overflow vulnerability in libheif 1.19.7 allows a local attacker to execute arbitrary code via the SAO (Sample Adaptive Offset)…
- CVE-2025-29594A vulnerability exists in the errorpage.php file of the CS2-WeaponPaints-Website v2.1.7 where user-controlled input is not adequately…