CVEs published May 8, 2025
112 CVEs were published on May 8, 2025: 12 critical, 37 high. 1 is now in CISA KEV.
- Published
- 112
- Critical
- 12
- High
- 37
- Medium
- 36
- Low
- 4
- Unrated
- 23
- Now in CISA KEV
- 1
- Fix available
- 43
Most affected products
- Linux
- 33
- Arista Networks CloudVision Portal
- 3
- D-Link DIR-605L
- 3
- IBM CICS TX Standard · IBM CICS TX Advanced
- 3
- Pixmeo OsiriX MD
- 3
- RTI Connext Professional
- 3
- Dell PowerScale OneFS
- 2
- Netis Systems WF2220
- 2
- TeleMessage archiving backend
- 2
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- 2
Critical 12
- CVE-2025-27720Pixmeo OsiriX MD Cleartext Transmission of Sensitive InformationPixmeo OsiriX MD
- CVE-2025-47733Microsoft Power Apps Information Disclosure VulnerabilityMicrosoft Power Pages
- CVE-2025-29813Azure DevOps Elevation of Privilege VulnerabilityMicrosoft Azure DevOps
- CVE-2025-29827Azure Automation Elevation of Privilege VulnerabilityMicrosoft Azure Automation
- CVE-2025-29972Azure Storage Resource Provider Spoofing VulnerabilityMicrosoft Azure Storage Resource Provider
- CVE-2024-12378On affected platforms running Arista EOS with secure Vxlan configured, restarting the Tunnelsec agent will result in packets being sent…Arista Networks CloudVision Portal
- CVE-2024-11186On affected versions of the CloudVision Portal, improper access controls could enable a malicious authenticated user to take broader…Arista Networks CloudVision Portal
- CVE-2025-0505On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain admin privileges…Arista Networks CloudVision Portal
- CVE-2023-31585Grocery-CMS-PHP-Restful-API v1.3 is vulnerable to File Upload via /admin/add-category.php.
- CVE-2025-26844An issue was discovered in Znuny through 7.1.3.
- CVE-2025-26845An Eval Injection issue was discovered in Znuny through 7.1.3.
- CVE-2025-26847An issue was discovered in Znuny before 7.1.5.
High 37
- CVE-2025-4442D-Link DIR-605L formSetWAN_Wizard55 buffer overflowD-Link DIR-605L
- CVE-2025-4441D-Link DIR-605L formSetWAN_Wizard534 buffer overflowD-Link DIR-605L
- CVE-2025-4440H3C GR-1800AX aspForm EnableIpv6 buffer overflowH3C GR-1800AX
- CVE-2025-27578Pixmeo OsiriX MD Use After FreePixmeo OsiriX MD
- CVE-2025-47732Microsoft Dataverse Remote Code Execution VulnerabilityMicrosoft Dataverse
- CVE-2025-33072Microsoft msagsfeedback.azurewebsites.net Information Disclosure VulnerabilityMicrosoft msagsfeedback.azurewebsites.net
- CVE-2025-1331IBM CICS TX code executionIBM CICS TX Standard · IBM CICS TX Advanced
- CVE-2025-1330IBM CICS TX code executionIBM CICS TX Standard · IBM CICS TX Advanced
- CVE-2025-1329IBM CICS TX code executionIBM CICS TX Standard · IBM CICS TX Advanced
- CVE-2024-9448On affected platforms running Arista EOS with Traffic Policies configured the vulnerability will cause received untagged packets not to…Arista Networks EOS
- CVE-2024-8100On affected versions of the Arista CloudVision Portal (CVP on-prem), the time-bound device onboarding token can be used to gain admin…Arista Networks CloudVision
- CVE-2025-1948Eclipse Jetty HTTP clients can increase memory allocationEclipse Foundation Jetty · org.eclipse.jetty.http2:jetty-ht…
- CVE-2025-4098Out-of-bounds Read in Horner Automation CscapeHorner Automation Cscape
- CVE-2024-13009Eclipse Jetty GZIP buffer releaseEclipse Foundation Jetty · org.eclipse.jetty:jetty-server
- CVE-2024-6648Path Traversal in AP Page BuilderApollo Theme AP Page Builder
- CVE-2025-3759Missing Authentication for Changing Device Configuration in WF2220Netis Systems WF2220
- CVE-2025-3758Exposure of Device Configuration without Authentication in WF2220Netis Systems WF2220
- CVE-2025-41450Authentication bypass with privileged access in Danfoss AK-SM 8xxA Series prior to version 4.2Danfoss AK-SM 8xxA Series
- CVE-2025-1254Out-of-bounds Read, Out-of-bounds Write vulnerability in RTI Connext Professional (Recording Service) allows Overflow Buffers, Overread…RTI Connext Professional
- CVE-2025-40846HaloITSM open redirect via the returnUrlHaloITSM ITSM
- CVE-2025-37823net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() tooLinux
- CVE-2025-37822riscv: uprobes: Add missing fence.i after building the XOL bufferLinux
- CVE-2025-37820xen-netfront: handle NULL returned by xdp_convert_buff_to_frame()Linux
- CVE-2025-37814tty: Require CAP_SYS_ADMIN for all usages of TIOCL_SELMOUSEREPORTLinux
- CVE-2025-37813usb: xhci: Fix invalid pointer dereference in Etron workaroundLinux
Show all 37 entriesShow fewer entries
- CVE-2025-37803udmabuf: fix a buf size overflow issue during udmabuf creationLinux
- CVE-2025-37802ksmbd: fix WARNING "do not call blocking ops when !TASK_RUNNING"Linux
- CVE-2025-37801spi: spi-imx: Add check for spi_imx_setupxfer()Linux
- CVE-2025-37800driver core: fix potential NULL pointer dereference in dev_uevent()Linux
- CVE-2025-3419Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 - Unauthenticated Arbitrary File Readarraytics Eventin – Event Calendar, Event Registration, Tic…
- CVE-2024-13793Wolmart | Multi-Vendor Marketplace WooCommerce Theme <= 1.8.11 - Unauthenticated Arbitrary Shortcode Execution in wolmart_loadmoredon-themes Wolmart | Multi-Vendor Marketplace WooCommerce T…
- CVE-2025-26842An issue was discovered in Znuny through 7.1.3.
- CVE-2025-45842TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid5g parameter in the…
- CVE-2025-45843TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid parameter in the…
- CVE-2025-45844TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid parameter in the…
- CVE-2025-45845TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the ssid5g parameter in the…
- CVE-2025-45846ALFA AIP-W512 v3.2.2.2.3 was discovered to contain an authenticated stack overflow via the torrentsindex parameter in the…
Medium, low and unrated 63
- CVE-2025-4443D-Link DIR-605L sub_454F2C command injectionD-Link DIR-605L
- CVE-2025-31946Pixmeo OsiriX MD Use After FreePixmeo OsiriX MD
- CVE-2025-46833Programs/P73_SimplePythonEncryption.py has weak cryptographic keyShashikantSingh09 python-progrrames
- CVE-2025-46812Trix vulnerable to Cross-site Scripting on copy & pastebasecamp trix · trix
- CVE-2025-46712Erlang/OTP SSH Has Strict KEX Violationserlang otp
- CVE-2025-46336Rack session gets restored after deletionrack-session
- CVE-2025-27695Dell Wyse Management Suite, versions prior to WMS 5.1 contain an Authentication Bypass by Spoofing vulnerability.Dell Wyse Management Suite
- CVE-2025-30101Dell PowerScale OneFS, versions 9.8.0.0 through 9.10.1.0, contain a time-of-check time-of-use (TOCTOU) race condition vulnerability.Dell PowerScale OneFS
- CVE-2025-30102Dell PowerScale OneFS, versions 9.4.0.0 through 9.10.1.0, contains an out-of-bounds write vulnerability.Dell PowerScale OneFS
- CVE-2025-4207PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validationPostgreSQL
- CVE-2025-3506Potentially senitive path exposed via unauthenticated http routeCheckmk
- CVE-2025-2806tagDiv Composer <= 5.3 - Reflected Cross-Site Scripting via 'data'tagDiv Composer
- CVE-2025-3468NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Stored Cross-Site Scriptingwebaways NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2025-3862Contest Gallery <= 26.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parametercontest-gallery Contest Gallery – Upload & Vote Photos, Med…
- CVE-2025-4208NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.9.1 - Authenticated (Custom) Limited Code Execution via…webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2025-1253Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'), Stack-based Buffer Overflow vulnerability in RTI Connext…RTI Connext Professional
- CVE-2025-1252Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Variables and Tags.RTI Connext Professional
- CVE-2025-4127WP SEO Structured Data Schema <= 2.7.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin Settingskcseopro WP SEO Structured Data Schema
- CVE-2025-37834mm/vmscan: don't try to reclaim hwpoison folioLinux
- CVE-2025-37833net/niu: Niu requires MSIX ENTRY_DATA fields touch before entry readsLinux
- CVE-2025-37831cpufreq: apple-soc: Fix null-ptr-deref in apple_soc_cpufreq_get_rate()Linux
- CVE-2025-37830cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate()Linux
- CVE-2025-37829cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate()Linux
- CVE-2025-37828scsi: ufs: mcq: Add NULL check in ufshcd_mcq_abort()Linux
- CVE-2025-37827btrfs: zoned: return EIO on RAID1 block group write pointer mismatchLinux
Show all 63 entriesShow fewer entries
- CVE-2025-37826scsi: ufs: core: Add NULL check in ufshcd_mcq_compl_pending_transfer()Linux
- CVE-2025-37825nvmet: fix out-of-bounds access in nvmet_enable_portLinux
- CVE-2025-37824tipc: fix NULL pointer dereference in tipc_mon_reinit_self()Linux
- CVE-2025-37821sched/eevdf: Fix se->slice being set to U64_MAX and resulting crashLinux
- CVE-2025-37819irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode()Linux
- CVE-2025-37818LoongArch: Return NULL from huge_pte_offset() for invalid PMDLinux
- CVE-2025-37817mcb: fix a double free bug in chameleon_parse_gdd()Linux
- CVE-2025-37816mei: vsc: Fix fortify-panic caused by invalid counted_by() useLinux
- CVE-2025-37815misc: microchip: pci1xxxx: Fix Kernel panic during IRQ handler registrationLinux
- CVE-2025-37812usb: cdns3: Fix deadlock when using NCM gadgetLinux
- CVE-2025-37811usb: chipidea: ci_hdrc_imx: fix usbmisc handlingLinux
- CVE-2025-37810usb: dwc3: gadget: check that event count does not exceed event buffer lengthLinux
- CVE-2025-37809usb: typec: class: Fix NULL pointer accessLinux
- CVE-2025-37808crypto: null - Use spin lock instead of mutexLinux
- CVE-2025-37807bpf: Fix kmemleak warning for percpu hashmapLinux
- CVE-2025-37806fs/ntfs3: Keep write operations atomicLinux
- CVE-2025-37805sound/virtio: Fix cancel_sync warnings on uninitialized work_structsLinux
- CVE-2023-51295PHPJabbers Event Booking Calendar v4.0 is vulnerable to Multiple HTML Injection in the "name, plugin_sms_api_key, plugin_sms_country_code…
- CVE-2023-51328PHPJabbers Cleaning Business Software v1.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) in the "c_name, name" parameters.
- CVE-2025-28073phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting (XSS) via the /lists/dl.php endpoint.
- CVE-2025-28074phpList before 3.6.15 is vulnerable to Cross-Site Scripting (XSS) due to improper input sanitization in lt.php.
- CVE-2025-32873An issue was discovered in Django 4.2 before 4.2.21, 5.1 before 5.1.9, and 5.2 before 5.2.1.djangoproject Django · django
- CVE-2025-43926An issue was discovered in Znuny through 6.5.14 and 7.x through 7.1.6.
- CVE-2025-44021OpenStack Ironic before 29.0.1 can write unintended files to a target node disk during image handling (if a deployment was performed via…OpenStack Ironic · ironic
- CVE-2025-44023An issue in dlink DNS-320 v.1.00 and DNS-320LW v.1.01.0914.20212 allows an attacker to execute arbitrary via the…
- CVE-2025-45787TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow viathe comment parameter in setIpPortFilterRules.
- CVE-2025-45788TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow via the comment parameter in setMacFilterRules.
- CVE-2025-45789TOTOLINK A3100R V5.9c.1527 is vulnerable to buffer overflow via the urlKeyword parameter in setParentalRules.
- CVE-2025-45790TOTOLINK A3100R V5.9c.1527 is vulnerable to Buffer Overflow via the priority parameter in the setMacQos interface of…
- CVE-2025-45797TOTOlink A950RG V4.1.2cu.5204_B20210112 contains a buffer overflow vulnerability.
- CVE-2025-45798A command execution vulnerability exists in the TOTOLINK A950RG V4.1.2cu.5204_B20210112.
- CVE-2025-45818Slims (Senayan Library Management Systems) 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/item_status.php.
- CVE-2025-45819Slims (Senayan Library Management Systems) 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/master_file/author.php.
- CVE-2025-45820Slims (Senayan Library Management Systems) 9 Bulian 9.6.1 is vulnerable to SQL Injection in admin/modules/bibliography/pop_author_edit.php.
- CVE-2025-45841TOTOLINK NR1800X V9.1.0u.6681_B20230703 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg…
- CVE-2025-45847ALFA AIP-W512 v3.2.2.2.3 was discovered to contain an authenticated stack overflow via the targetAPMac parameter in the formWsc function.
- CVE-2025-47729The TeleMessage archiving backend through 2025-05-05 holds cleartext copies of messages from TM SGNL (aka Archive Signal) app users, which iTeleMessage archiving backend
- CVE-2025-47730The TeleMessage archiving backend through 2025-05-05 accepts API calls (to request an authentication token) from the TM SGNL (aka Archive…TeleMessage archiving backend