# CVEs published 2025-05-27

95 CVEs were published on May 27, 2025: 7 critical, 23 high. Days are UTC.

- [CVE-2024-45094](https://cve.now/CVE-2024-45094.md): IBM DS8900F and DS8A00 Hardware Management Console (HMC) cross-site scripting (CVSS 5.5, IBM Hardware Management Console)
- [CVE-2025-2826](https://cve.now/CVE-2025-2826.md): n affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL… (CVSS 2.6, Arista Networks EOS)
- [CVE-2025-2796](https://cve.now/CVE-2025-2796.md): On affected platforms with hardware IPSec support running Arista EOS with IPsec enabled and anti-replay protection configured, EOS may… (CVSS 5.3, Arista Networks EOS)
- [CVE-2024-11185](https://cve.now/CVE-2024-11185.md): On affected platforms running Arista EOS, ingress traffic on Layer 2 ports may, under certain conditions, be improperly forwarded to ports… (CVSS 6.5, Arista Networks EOS)
- [CVE-2025-32440](https://cve.now/CVE-2025-32440.md): NetAlertX Vulnerable to Authentication Bypass (CVSS 10.0, jokob-sk NetAlertX)
- [CVE-2025-40911](https://cve.now/CVE-2025-40911.md): Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly consider leading zero characters in IP CIDR address strings, which… (CVSS 6.5, RRWO Net::CIDR::Set)
- [CVE-2025-5278](https://cve.now/CVE-2025-5278.md): Coreutils: heap buffer under-read in gnu coreutils sort via key specification (CVSS 4.4, coreutils · Red Hat Enterprise Linux +8)
- [CVE-2025-5222](https://cve.now/CVE-2025-5222.md): Icu: stack buffer overflow in the srbroot::addtag function (CVSS 7.0, icu · Red Hat Enterprise Linux +1)
- [CVE-2025-5198](https://cve.now/CVE-2025-5198.md): Stackrox: xss in stackrox (CVSS 5.0, stackrox · Red Hat Advanced Cluster Security)
- [CVE-2025-5067](https://cve.now/CVE-2025-5067.md): Inappropriate implementation in Tab Strip in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a… (CVSS 5.4, Google Chrome)
- [CVE-2025-5283](https://cve.now/CVE-2025-5283.md): Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a… (CVSS 5.4, Google Chrome)
- [CVE-2025-5281](https://cve.now/CVE-2025-5281.md): Inappropriate implementation in BFCache in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially obtain user… (CVSS 5.4, Google Chrome)
- [CVE-2025-5066](https://cve.now/CVE-2025-5066.md): Inappropriate implementation in Messages in Google Chrome on Android prior to 137.0.7151.55 allowed a remote attacker who convinced a user… (CVSS 6.5, Google Chrome)
- [CVE-2025-5065](https://cve.now/CVE-2025-5065.md): Inappropriate implementation in FileSystemAccess API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI… (CVSS 6.5, Google Chrome)
- [CVE-2025-5064](https://cve.now/CVE-2025-5064.md): Inappropriate implementation in Background Fetch API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to leak… (CVSS 5.4, Google Chrome)
- [CVE-2025-5280](https://cve.now/CVE-2025-5280.md): Out of bounds write in V8 in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a… (CVSS 8.8, Google Chrome)
- [CVE-2025-5063](https://cve.now/CVE-2025-5063.md): Use after free in Compositing in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via… (CVSS 8.8, Google Chrome)
- [CVE-2025-5279](https://cve.now/CVE-2025-5279.md): Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider plugin (CVSS 7.0, Amazon Redshift · redshift-connector)
- [CVE-2024-13966](https://cve.now/CVE-2024-13966.md): ZKTeco BioTime default password (CVSS 7.3, ZKTeco BioTime)
- [CVE-2025-5252](https://cve.now/CVE-2025-5252.md): PHPGurukul News Portal Project edit-subadmin.php sql injection (CVSS 6.9, PHPGurukul News Portal Project)
- [CVE-2025-5251](https://cve.now/CVE-2025-5251.md): PHPGurukul News Portal Project edit-subcategory.php sql injection (CVSS 6.9, PHPGurukul News Portal Project)
- [CVE-2025-5250](https://cve.now/CVE-2025-5250.md): PHPGurukul News Portal Project edit-category.php sql injection (CVSS 6.9, PHPGurukul News Portal Project)
- [CVE-2025-23247](https://cve.now/CVE-2025-23247.md): NVIDIA CUDA Toolkit for all platforms contains a vulnerability in the cuobjdump binary, where a failure to check the length of a buffer… (CVSS 4.4, NVIDIA CUDA Toolkit)
- [CVE-2025-48057](https://cve.now/CVE-2025-48057.md): Icinga 2 certificate renewal might incorrectly renew an invalid certificate (CVSS 9.3, icinga2)
- [CVE-2025-5249](https://cve.now/CVE-2025-5249.md): PHPGurukul News Portal Project add-category.php sql injection (CVSS 6.9, PHPGurukul News Portal Project)
- [CVE-2025-5248](https://cve.now/CVE-2025-5248.md): PHPGurukul Company Visitor Management System bwdates-reports-details.php sql injection (CVSS 6.9, PHPGurukul Company Visitor Management System)
- [CVE-2025-27701](https://cve.now/CVE-2025-27701.md): In the function process\_crypto\_cmd, the values of ptrs\[i\] can be potentially equal to NULL which is valid value after calling… (CVSS 5.5, Google Android)
- [CVE-2025-27700](https://cve.now/CVE-2025-27700.md): There is a possible bypass of carrier restrictions due to an unusual root cause. (CVSS 8.4, Google Android)
- [CVE-2024-56193](https://cve.now/CVE-2024-56193.md): There is a possible disclosure of Bluetooth adapter details due to a permissions bypass. (CVSS 5.1, Google Android)
- [CVE-2025-48370](https://cve.now/CVE-2025-48370.md): auth-js Vulnerable to Insecure Path Routing from Malformed User Input (CVSS 2.7, supabase auth-js · @supabase/auth-js)
- [CVE-2025-48383](https://cve.now/CVE-2025-48383.md): Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking (CVSS 8.2, codingjoe django-select2 · django-select2)
- [CVE-2025-2236](https://cve.now/CVE-2025-2236.md): Exposure of Sensitive System Information vulnerability during configuration affecting OpenText Advanced Authentication. (CVSS 2.1, OpenText Advanced Authentication)
- [CVE-2025-5247](https://cve.now/CVE-2025-5247.md): Gowabby HFish url.go LoadUrl improper authentication (CVSS 6.9, Gowabby HFish)
- [CVE-2025-3704](https://cve.now/CVE-2025-3704.md): WordPress Volunteer Sign Up Sheets plugin \< 5.5.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, DBAR Productions Volunteer Sign Up Sheets)
- [CVE-2025-5246](https://cve.now/CVE-2025-5246.md): Campcodes Online Hospital Management System query-details.php sql injection (CVSS 6.9, Campcodes Online Hospital Management System)
- [CVE-2025-5245](https://cve.now/CVE-2025-5245.md): GNU Binutils objdump debug.c debug\_type\_samep memory corruption (CVSS 4.8, GNU Binutils)
- [CVE-2025-48798](https://cve.now/CVE-2025-48798.md): Gimp: multiple use after free in xcf parser (CVSS 7.3, gimp · Red Hat Enterprise Linux 7 Extended Lifecycle Sup… +1)
- [CVE-2025-48797](https://cve.now/CVE-2025-48797.md): Gimp: multiple heap buffer overflows in tga parser (CVSS 7.3, gimp · Red Hat Enterprise Linux 7 Extended Lifecycle Sup… +1)
- [CVE-2025-48796](https://cve.now/CVE-2025-48796.md): Gimp: stack-based buffer overflows in file-ico (CVSS 7.3, gimp · Red Hat Enterprise Linux)
- [CVE-2025-5244](https://cve.now/CVE-2025-5244.md): GNU Binutils ld elflink.c elf\_gc\_sweep memory corruption (CVSS 4.8, GNU Binutils)
- [CVE-2025-5272](https://cve.now/CVE-2025-5272.md): Memory safety bugs fixed in Firefox 139 and Thunderbird 139 (CVSS 7.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-5271](https://cve.now/CVE-2025-5271.md): Devtools' preview ignored CSP headers (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-5270](https://cve.now/CVE-2025-5270.md): SNI was sometimes unencrypted (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-5269](https://cve.now/CVE-2025-5269.md): Memory safety bug fixed in Firefox ESR 128.11 and Thunderbird 128.11 (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-5268](https://cve.now/CVE-2025-5268.md): Memory safety bugs fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11 (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-5267](https://cve.now/CVE-2025-5267.md): Clickjacking vulnerability could have led to leaking saved payment card details (CVSS 5.4, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-5266](https://cve.now/CVE-2025-5266.md): Script element events leaked cross-origin resource status (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-5265](https://cve.now/CVE-2025-5265.md): Potential local code execution in “Copy as cURL” command (CVSS 4.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-5264](https://cve.now/CVE-2025-5264.md): Potential local code execution in “Copy as cURL” command (CVSS 4.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-5263](https://cve.now/CVE-2025-5263.md): Error handling for script execution was incorrectly isolated from web content (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2025-5262](https://cve.now/CVE-2025-5262.md): A double-free could have occurred in \`vpx\_codec\_enc\_init\_multi\` after a failed allocation when initializing the encoder for WebRTC. (CVSS 7.5, Mozilla Thunderbird)
- [CVE-2025-5117](https://cve.now/CVE-2025-5117.md): Property 1.0.5 - 1.0.6 - Missing Authorization to Authenticated (Author+) Privilege Escalation via property\_package\_user\_role Metadata in… (CVSS 8.8, themeglow Property – Real Estate Directory Listing)
- [CVE-2025-4412](https://cve.now/CVE-2025-4412.md): TCC Bypass via Dylib Loading in Viscosity.app (CVSS 4.8, SparkLabs Viscosity)
- [CVE-2025-41653](https://cve.now/CVE-2025-41653.md): Weidmueller: Denial-of-Service Vulnerability in the web server functionality of Industrial Ethernet Switches (CVSS 7.5, Weidmueller IE-SW-VL05M-5TX · Weidmueller IE-SW-VL05MT-… +11)
- [CVE-2025-41652](https://cve.now/CVE-2025-41652.md): Weidmueller: Authentication Bypass Vulnerability in Industrial Ethernet Switches (CVSS 9.8, Weidmueller IE-SW-VL05M-5TX · Weidmueller IE-SW-VL05MT-… +11)
- [CVE-2025-41651](https://cve.now/CVE-2025-41651.md): Weidmueller: Missing Authentication Vulnerability in Industrial Ethernet Switches (CVSS 9.8, Weidmueller IE-SW-VL05M-5TX · Weidmueller IE-SW-VL05MT-… +11)
- [CVE-2025-41650](https://cve.now/CVE-2025-41650.md): Weidmueller: Denial-of-Service Vulnerability in Industrial Ethernet Switches (CVSS 7.5, Weidmueller IE-SW-VL05M-5TX · Weidmueller IE-SW-VL05MT-… +11)
- [CVE-2025-41649](https://cve.now/CVE-2025-41649.md): Weidmueller: Out-of-Bounds Write Vulnerability in Industrial Ethernet Switches (CVSS 7.5, Weidmueller IE-SW-VL05M-5TX · Weidmueller IE-SW-VL05MT-… +11)
- [CVE-2025-2407](https://cve.now/CVE-2025-2407.md): Missing Authentication & Authorization in Web-API allows adversary unrestricted access (CVSS 9.3, Mobatime AMX MTAPI · Mobatime AMXGT-100)
- [CVE-2025-23393](https://cve.now/CVE-2025-23393.md): Reflected XSS in spacewalk-java (CVSS 5.2, Container suse/manager/5.0/x86\_64/server:5.0.4.7.19.1 · SUS…)
- [CVE-2024-47090](https://cve.now/CVE-2024-47090.md): XSS via WYSIWYG editor (CVSS 5.1, Nagvis)
- [CVE-2024-38866](https://cve.now/CVE-2024-38866.md): Livestatus Injection in dynmaps (CVSS 5.3, Nagvis)
- [CVE-2025-5232](https://cve.now/CVE-2025-5232.md): PHPGurukul Student Study Center Management System report.php sql injection (CVSS 5.1, PHPGurukul Student Study Center Management System)
- [CVE-2025-48382](https://cve.now/CVE-2025-48382.md): Fess has Insecure Temporary File Permissions (CVSS 1.2, codelibs fess · org.codelibs.fess:fess)
- [CVE-2025-5231](https://cve.now/CVE-2025-5231.md): PHPGurukul Company Visitor Management System forgot-password.php sql injection (CVSS 6.9, PHPGurukul Company Visitor Management System)
- [CVE-2025-48054](https://cve.now/CVE-2025-48054.md): Radashi Vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (CVSS 6.8, radashi-org radashi · radashi)
- [CVE-2025-5230](https://cve.now/CVE-2025-5230.md): PHPGurukul Online Nurse Hiring System bwdates-report-details.php sql injection (CVSS 6.9, PHPGurukul Online Nurse Hiring System)
- [CVE-2025-5229](https://cve.now/CVE-2025-5229.md): Campcodes Online Hospital Management System view-patient.php sql injection (CVSS 6.9, Campcodes Online Hospital Management System)
- [CVE-2025-5228](https://cve.now/CVE-2025-5228.md): D-Link DI-8100 jhttpd login.cgi httpd\_get\_parm stack-based overflow (CVSS 8.7, D-Link DI-8100)
- [CVE-2025-5227](https://cve.now/CVE-2025-5227.md): PHPGurukul Small CRM manage-tickets.php sql injection (CVSS 6.9, PHPGurukul Small CRM)
- [CVE-2025-5226](https://cve.now/CVE-2025-5226.md): PHPGurukul Small CRM change-password.php sql injection (CVSS 6.9, PHPGurukul Small CRM)
- [CVE-2025-5225](https://cve.now/CVE-2025-5225.md): Campcodes Advanced Online Voting System index.php sql injection (CVSS 6.9, Campcodes Advanced Online Voting System)
- [CVE-2025-5224](https://cve.now/CVE-2025-5224.md): Campcodes Online Hospital Management System add-doctor.php sql injection (CVSS 6.9, Campcodes Online Hospital Management System)
- [CVE-2025-5221](https://cve.now/CVE-2025-5221.md): FreeFloat FTP Server QUOTE Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-4682](https://cve.now/CVE-2025-4682.md): Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates \<= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting… (CVSS 6.4, wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…)
- [CVE-2025-4683](https://cve.now/CVE-2025-4683.md): MStore API – Create Native Android & iOS Apps On The Cloud \<= 4.17.5 - Missing Authorization to Authenticated (Subscriber+) Posts Creation (CVSS 4.3, inspireui MStore API – Create Native Android & iOS Apps On…)
- [CVE-2025-5220](https://cve.now/CVE-2025-5220.md): FreeFloat FTP Server GET Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-33079](https://cve.now/CVE-2025-33079.md): IBM Controller information disclosure (CVSS 6.5, IBM Controller · IBM Cognos Controller)
- [CVE-2025-5219](https://cve.now/CVE-2025-5219.md): FreeFloat FTP Server ASCII Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-5218](https://cve.now/CVE-2025-5218.md): FreeFloat FTP Server LITERAL Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-5217](https://cve.now/CVE-2025-5217.md): FreeFloat FTP Server RMDIR Command buffer overflow (CVSS 6.9, FreeFloat FTP Server)
- [CVE-2025-5216](https://cve.now/CVE-2025-5216.md): PHPGurukul Student Record System login.php sql injection (CVSS 6.9, PHPGurukul Student Record System)
- [CVE-2025-5215](https://cve.now/CVE-2025-5215.md): D-Link DCS-5020L ptdc.cgi websReadEvent stack-based overflow (CVSS 8.7, D-Link DCS-5020L)
- [CVE-2024-49196](https://cve.now/CVE-2024-49196.md): An issue was discovered in the GPU in Samsung Mobile Processor Exynos 1480 and 2400. (CVSS 7.5)
- [CVE-2024-49197](https://cve.now/CVE-2024-49197.md): An issue was discovered in Wi-Fi in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, W920… (CVSS 6.5)
- [CVE-2025-22377](https://cve.now/CVE-2025-22377.md): An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330… (CVSS 6.5)
- [CVE-2025-26211](https://cve.now/CVE-2025-26211.md): Gibbon before 29.0.00 allows CSRF. (CVSS 3.7, GibbonEdu Gibbon)
- [CVE-2025-45475](https://cve.now/CVE-2025-45475.md): maccms10 v2025.1000.4047 is vulnerable to Server-Side request forgery (SSRF) in Friend Link Management. (CVSS 5.4)
- [CVE-2025-45529](https://cve.now/CVE-2025-45529.md): An arbitrary file read vulnerability in the ReadTextAsynchronous function of SSCMS v7.3.1 allows attackers to read arbitrary files via… (CVSS 7.1)
- [CVE-2025-46173](https://cve.now/CVE-2025-46173.md): code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) via the name field in the feedback form. (CVSS 6.1)
- [CVE-2025-48742](https://cve.now/CVE-2025-48742.md): The installer in SIGB PMB before and fixed in v.8.0.1.2 allows remote code execution. (CVSS 5.4, SIGB PMB)
- [CVE-2025-48743](https://cve.now/CVE-2025-48743.md): SIGB PMB before 8.0.1.2 allows SQL injection. (CVSS 5.3, SIGB PMB)
- [CVE-2025-48744](https://cve.now/CVE-2025-48744.md): In SIGB PMB before 8.0.1.2, attackers can achieve Local File Inclusion and remote code execution. (CVSS 6.4, SIGB PMB)
- [CVE-2025-48827](https://cve.now/CVE-2025-48827.md): vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when… (CVSS 10.0, vBulletin)
- [CVE-2025-48828](https://cve.now/CVE-2025-48828.md): Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. (CVSS 9.0, vBulletin)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2025-05-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.