CVEs published May 27, 2025
95 CVEs were published on May 27, 2025: 7 critical, 23 high. Browse them by severity, product and exploitation status.
- Published
- 95
- Critical
- 7
- High
- 23
- Medium
- 60
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 42
Most affected products
- Mozilla Firefox · Mozilla Thunderbird
- 10
- Google Chrome
- 8
- FreeFloat FTP Server
- 5
- Weidmueller IE-SW-VL05M-5TX · Weidmueller IE-SW-VL05MT-… +11
- 5
- PHPGurukul News Portal Project
- 4
- Arista Networks EOS
- 3
- Campcodes Online Hospital Management System
- 3
- Google Android
- 3
- SIGB PMB
- 3
- gimp · Red Hat Enterprise Linux 7 Extended Lifecycle Sup… +1
- 2
Critical 7
- CVE-2025-32440NetAlertX Vulnerable to Authentication Bypassjokob-sk NetAlertX
- CVE-2025-48057Icinga 2 certificate renewal might incorrectly renew an invalid certificateicinga2
- CVE-2025-41652Weidmueller: Authentication Bypass Vulnerability in Industrial Ethernet SwitchesWeidmueller IE-SW-VL05M-5TX · Weidmueller IE-SW-VL05MT-… +11
- CVE-2025-41651Weidmueller: Missing Authentication Vulnerability in Industrial Ethernet SwitchesWeidmueller IE-SW-VL05M-5TX · Weidmueller IE-SW-VL05MT-… +11
- CVE-2025-2407Missing Authentication & Authorization in Web-API allows adversary unrestricted accessMobatime AMX MTAPI · Mobatime AMXGT-100
- CVE-2025-48827vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when…vBulletin
- CVE-2025-48828Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine.vBulletin
High 23
- CVE-2025-5222Icu: stack buffer overflow in the srbroot::addtag functionicu · Red Hat Enterprise Linux +1
- CVE-2025-5280Out of bounds write in V8 in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a…Google Chrome
- CVE-2025-5063Use after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via…Google Chrome
- CVE-2025-5279Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider pluginAmazon Redshift · redshift-connector
- CVE-2024-13966ZKTeco BioTime default passwordZKTeco BioTime
- CVE-2025-27700There is a possible bypass of carrier restrictions due to an unusual root cause.Google Android
- CVE-2025-48383Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leakingcodingjoe django-select2 · django-select2
- CVE-2025-48798Gimp: multiple use after free in xcf parsergimp · Red Hat Enterprise Linux 7 Extended Lifecycle Sup… +1
- CVE-2025-48797Gimp: multiple heap buffer overflows in tga parsergimp · Red Hat Enterprise Linux 7 Extended Lifecycle Sup… +1
- CVE-2025-48796Gimp: stack-based buffer overflows in file-icogimp · Red Hat Enterprise Linux
- CVE-2025-5272Memory safety bugs fixed in Firefox 139 and Thunderbird 139Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-5270SNI was sometimes unencryptedMozilla Firefox · Mozilla Thunderbird
- CVE-2025-5269Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird 128.11Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-5268Memory safety bugs fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11Mozilla Firefox · Mozilla Thunderbird
- CVE-2025-5262A double-free could have occurred in `vpx_codec_enc_init_multi` after a failed allocation when initializing the encoder for WebRTC.Mozilla Thunderbird
- CVE-2025-5117Property 1.0.5 - 1.0.6 - Missing Authorization to Authenticated (Author+) Privilege Escalation via property_package_user_role Metadata in…themeglow Property – Real Estate Directory Listing
- CVE-2025-41653Weidmueller: Denial-of-Service Vulnerability in the web server functionality of Industrial Ethernet SwitchesWeidmueller IE-SW-VL05M-5TX · Weidmueller IE-SW-VL05MT-… +11
- CVE-2025-41650Weidmueller: Denial-of-Service Vulnerability in Industrial Ethernet SwitchesWeidmueller IE-SW-VL05M-5TX · Weidmueller IE-SW-VL05MT-… +11
- CVE-2025-41649Weidmueller: Out-of-Bounds Write Vulnerability in Industrial Ethernet SwitchesWeidmueller IE-SW-VL05M-5TX · Weidmueller IE-SW-VL05MT-… +11
- CVE-2025-5228D-Link DI-8100 jhttpd login.cgi httpd_get_parm stack-based overflowD-Link DI-8100
- CVE-2025-5215D-Link DCS-5020L ptdc.cgi websReadEvent stack-based overflowD-Link DCS-5020L
- CVE-2024-49196An issue was discovered in the GPU in Samsung Mobile Processor Exynos 1480 and 2400.
- CVE-2025-45529An arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to read arbitrary files via…
Medium, low and unrated 65
- CVE-2024-45094IBM DS8900F and DS8A00 Hardware Management Console (HMC) cross-site scriptingIBM Hardware Management Console
- CVE-2025-2826n affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL…Arista Networks EOS
- CVE-2025-2796On affected platforms with hardware IPSec support running Arista EOS with IPsec enabled and anti-replay protection configured, EOS may…Arista Networks EOS
- CVE-2024-11185On affected platforms running Arista EOS, ingress traffic on Layer 2 ports may, under certain conditions, be improperly forwarded to ports…Arista Networks EOS
- CVE-2025-40911Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly consider leading zero characters in IP CIDR address strings, which…RRWO Net::CIDR::Set
- CVE-2025-5278Coreutils: heap buffer under-read in gnu coreutils sort via key specificationcoreutils · Red Hat Enterprise Linux +8
- CVE-2025-5198Stackrox: xss in stackroxstackrox · Red Hat Advanced Cluster Security
- CVE-2025-5067Inappropriate implementation in Tab Strip in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a…Google Chrome
- CVE-2025-5283Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a…Google Chrome
- CVE-2025-5281Inappropriate implementation in BFCache in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially obtain user…Google Chrome
- CVE-2025-5066Inappropriate implementation in Messages in Google Chrome on Android prior to 137.0.7151.55 allowed a remote attacker who convinced a user…Google Chrome
- CVE-2025-5065Inappropriate implementation in FileSystemAccess API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI…Google Chrome
- CVE-2025-5064Inappropriate implementation in Background Fetch API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to leak…Google Chrome
- CVE-2025-5252PHPGurukul News Portal Project edit-subadmin.php sql injectionPHPGurukul News Portal Project
- CVE-2025-5251PHPGurukul News Portal Project edit-subcategory.php sql injectionPHPGurukul News Portal Project
- CVE-2025-5250PHPGurukul News Portal Project edit-category.php sql injectionPHPGurukul News Portal Project
- CVE-2025-23247NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a failure to check the length of a buffer…NVIDIA CUDA Toolkit
- CVE-2025-5249PHPGurukul News Portal Project add-category.php sql injectionPHPGurukul News Portal Project
- CVE-2025-5248PHPGurukul Company Visitor Management System bwdates-reports-details.php sql injectionPHPGurukul Company Visitor Management System
- CVE-2025-27701In the function process_crypto_cmd, the values of ptrs[i] can be potentially equal to NULL which is valid value after calling…Google Android
- CVE-2024-56193There is a possible disclosure of Bluetooth adapter details due to a permissions bypass.Google Android
- CVE-2025-48370auth-js Vulnerable to Insecure Path Routing from Malformed User Inputsupabase auth-js · @supabase/auth-js
- CVE-2025-2236Exposure of Sensitive System Information vulnerability during configuration affecting OpenText Advanced Authentication.OpenText Advanced Authentication
- CVE-2025-5247Gowabby HFish url.go LoadUrl improper authenticationGowabby HFish
- CVE-2025-3704WordPress Volunteer Sign Up Sheets plugin < 5.5.5 - Cross Site Scripting (XSS) vulnerabilityDBAR Productions Volunteer Sign Up Sheets
Show all 65 entriesShow fewer entries
- CVE-2025-5246Campcodes Online Hospital Management System query-details.php sql injectionCampcodes Online Hospital Management System
- CVE-2025-5245GNU Binutils objdump debug.c debug_type_samep memory corruptionGNU Binutils
- CVE-2025-5244GNU Binutils ld elflink.c elf_gc_sweep memory corruptionGNU Binutils
- CVE-2025-5271Devtools' preview ignored CSP headersMozilla Firefox · Mozilla Thunderbird
- CVE-2025-5267Clickjacking vulnerability could have led to leaking saved payment card detailsMozilla Firefox · Mozilla Thunderbird
- CVE-2025-5266Script element events leaked cross-origin resource statusMozilla Firefox · Mozilla Thunderbird
- CVE-2025-5265Potential local code execution in “Copy as cURL” commandMozilla Firefox · Mozilla Thunderbird
- CVE-2025-5264Potential local code execution in “Copy as cURL” commandMozilla Firefox · Mozilla Thunderbird
- CVE-2025-5263Error handling for script execution was incorrectly isolated from web contentMozilla Firefox · Mozilla Thunderbird
- CVE-2025-4412TCC Bypass via Dylib Loading in Viscosity.appSparkLabs Viscosity
- CVE-2025-23393Reflected XSS in spacewalk-javaContainer suse/manager/5.0/x86_64/server:5.0.4.7.19.1 · SUS…
- CVE-2024-47090XSS via WYSIWYG editorNagvis
- CVE-2024-38866Livestatus Injection in dynmapsNagvis
- CVE-2025-5232PHPGurukul Student Study Center Management System report.php sql injectionPHPGurukul Student Study Center Management System
- CVE-2025-48382Fess has Insecure Temporary File Permissionscodelibs fess · org.codelibs.fess:fess
- CVE-2025-5231PHPGurukul Company Visitor Management System forgot-password.php sql injectionPHPGurukul Company Visitor Management System
- CVE-2025-48054Radashi Vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')radashi-org radashi · radashi
- CVE-2025-5230PHPGurukul Online Nurse Hiring System bwdates-report-details.php sql injectionPHPGurukul Online Nurse Hiring System
- CVE-2025-5229Campcodes Online Hospital Management System view-patient.php sql injectionCampcodes Online Hospital Management System
- CVE-2025-5227PHPGurukul Small CRM manage-tickets.php sql injectionPHPGurukul Small CRM
- CVE-2025-5226PHPGurukul Small CRM change-password.php sql injectionPHPGurukul Small CRM
- CVE-2025-5225Campcodes Advanced Online Voting System index.php sql injectionCampcodes Advanced Online Voting System
- CVE-2025-5224Campcodes Online Hospital Management System add-doctor.php sql injectionCampcodes Online Hospital Management System
- CVE-2025-5221FreeFloat FTP Server QUOTE Command buffer overflowFreeFloat FTP Server
- CVE-2025-4682Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting…wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…
- CVE-2025-4683MStore API – Create Native Android & iOS Apps On The Cloud <= 4.17.5 - Missing Authorization to Authenticated (Subscriber+) Posts Creationinspireui MStore API – Create Native Android & iOS Apps On…
- CVE-2025-5220FreeFloat FTP Server GET Command buffer overflowFreeFloat FTP Server
- CVE-2025-33079IBM Controller information disclosureIBM Controller · IBM Cognos Controller
- CVE-2025-5219FreeFloat FTP Server ASCII Command buffer overflowFreeFloat FTP Server
- CVE-2025-5218FreeFloat FTP Server LITERAL Command buffer overflowFreeFloat FTP Server
- CVE-2025-5217FreeFloat FTP Server RMDIR Command buffer overflowFreeFloat FTP Server
- CVE-2025-5216PHPGurukul Student Record System login.php sql injectionPHPGurukul Student Record System
- CVE-2024-49197An issue was discovered in Wi-Fi in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, W920…
- CVE-2025-22377An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330…
- CVE-2025-26211Gibbon before 29.0.00 allows CSRF.GibbonEdu Gibbon
- CVE-2025-45475maccms10 v2025.1000.4047 is vulnerable to Server-Side request forgery (SSRF) in Friend Link Management.
- CVE-2025-46173code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) via the name field in the feedback form.
- CVE-2025-48742The installer in SIGB PMB before and fixed in v.8.0.1.2 allows remote code execution.SIGB PMB
- CVE-2025-48743SIGB PMB before 8.0.1.2 allows SQL injection.SIGB PMB
- CVE-2025-48744In SIGB PMB before 8.0.1.2, attackers can achieve Local File Inclusion and remote code execution.SIGB PMB