CVEs published March 6, 2025
142 CVEs were published on March 6, 2025: 5 critical, 35 high.
- Published
- 142
- Critical
- 5
- High
- 35
- Medium
- 88
- Low
- 1
- Unrated
- 13
- Now in CISA KEV
- 0
- Fix available
- 42
Most affected products
- Linux
- 46
- Samsung Mobile Samsung Notes
- 19
- Samsung Mobile Devices
- 6
- code-projects Blood Bank Management System
- 5
- Apache Software Foundation Apache Traffic Server
- 4
- s-a-zhd Ecommerce-Website-using-PHP
- 3
- Smartwares CIP-37210AT · Smartwares C724IP
- 3
- ChestnutCMS
- 2
- Finder Fire Safety Finder ERP/CRM
- 2
- GitLab
- 2
Critical 5
- CVE-2025-27509SAML authentication vulnerability due to improper SAML response validationfleetdm fleet · github.com/fleetdm/fleet/v4
- CVE-2025-21829RDMA/rxe: Fix the warning "__rxe_cleanup+0x12c/0x170 [rdma_rxe]"Linux
- CVE-2024-12144SQLi in Finder Fire Safety's Finder ERP/CRM (Old System)Finder Fire Safety Finder ERP/CRM
- CVE-2025-25361An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to exe
- CVE-2025-25763crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php
High 35
- CVE-2025-27598Out-of-bounds Write in SixLabors ImageSharpSixLabors ImageSharp · SixLabors.ImageSharp
- CVE-2025-0337Authorization bypass in Now PlatformServiceNow Now Platform
- CVE-2024-58086drm/v3d: Stop active perfmon if it is being destroyedLinux
- CVE-2024-51476IBM Concert Software information disclosureIBM Concert Software
- CVE-2024-12742Deserialization of Untrusted Data Vulnerability in NI G Web Development SoftwareNI G Web Development Software
- CVE-2025-21832block: don't revert iter for -EIOCBQUEUEDLinux
- CVE-2024-58083KVM: Explicitly verify target vCPU is online in kvm_get_vcpu()Linux
- CVE-2024-58079media: uvcvideo: Fix crash during unbind if gpio unit is in useLinux
- CVE-2025-21830landlock: Handle weird filesLinux
- CVE-2025-21828wifi: mac80211: don't flush non-uploaded STAsLinux
- CVE-2025-21827Bluetooth: btusb: mediatek: Add locks for usb_driver_claim_interface()Linux
- CVE-2025-21826netfilter: nf_tables: reject mismatching sum of field_len with set key lengthLinux
- CVE-2025-21825bpf: Cancel the running bpf_timer through kworker for PREEMPT_RTLinux
- CVE-2024-58075crypto: tegra - do not transfer req when tegra init failsLinux
- CVE-2024-58070bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RTLinux
- CVE-2024-58069rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM readLinux
- CVE-2024-58060bpf: Reject struct_ops registration that uses module ptr and the module btf_id is missingLinux
- CVE-2024-58055usb: gadget: f_tcm: Don't free command immediatelyLinux
- CVE-2024-58053rxrpc: Fix handling of received connection abortLinux
- CVE-2024-12146SQLi in Finder Fire Safety's Finder ERP/CRM (New System)Finder Fire Safety Finder ERP/CRM
- CVE-2024-13893Shared credentials in Smartwares camerasSmartwares CIP-37210AT · Smartwares C724IP
- CVE-2024-13892Command Injection in Smartwares camerasSmartwares CIP-37210AT · Smartwares C724IP
- CVE-2024-7872Sensetive Data Exposure in ExtremePACS' Extreme XDSExtremePACS Extreme XDS
- CVE-2025-20931Out-of-bounds write in parsing bmp image in Samsung Notes prior to version 4.4.26.71 allows local attackers to execute arbitrary code.Samsung Mobile Samsung Notes
- CVE-2025-20929Out-of-bounds write in parsing jpeg image in Samsung Notes prior to version 4.4.26.71 allows local attackers to execute arbitrary code.Samsung Mobile Samsung Notes
- CVE-2025-20903Improper access control in SecSettingsIntelligence prior to SMR Mar-2025 Release 1 allows local attackers to launch privileged activities.Samsung Mobile Devices
- CVE-2025-22447Incorrect access permission of a specific service issue exists in RemoteView Agent (for Windows) versions prior to v8.1.5.2.RSUPPORT Co. RemoteView Agent
- CVE-2025-24864Incorrect access permission of a specific folder issue exists in RemoteView Agent (for Windows) versions prior to v8.1.5.2.RSUPPORT Co. RemoteView Agent
- CVE-2024-42844A SQL Injection vulnerability has been identified in EPICOR Prophet 21 (P21) up to 23.2.5232.
- CVE-2024-50600An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, W920, W930, and W1
- CVE-2024-52923An issue was discovered in NRMM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 128
- CVE-2024-52924An issue was discovered in NRMM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 128
- CVE-2025-25381Incorrect access control in the KSRTC AWATAR app of Karnataka State Road Transport Corporation v1.3.0 allows to view sensitive information s
- CVE-2025-25497An issue in account management interface in Netsweeper Server v.8.2.6 and earlier (fixed in v.8.2.7) allows unauthorized changes to the "Acc
- CVE-2025-26167Buffalo LS520D 4.53 is vulnerable to Arbitrary file read, which allows unauthenticated attackers to access the NAS web UI and read arbitrary
Medium, low and unrated 102
- CVE-2025-1121Privilege escalation in Installer and Recovery image handling in Google ChromeOS version 15786.48.2 on device allows an attacker with physicGoogle ChromeOS
- CVE-2025-2050PHPGurukul User Registration & Login and User Management System login.php sql injectionPHPGurukul User Registration & Login and User Management Sy…
- CVE-2025-2049code-projects Blood Bank System AB+.php cross site scriptingcode-projects Blood Bank System
- CVE-2025-2047PHPGurukul Art Gallery Management System search.php cross site scriptingPHPGurukul Art Gallery Management System
- CVE-2025-2046SourceCodester Best Employee Management System print1.php sql injectionSourceCodester Best Employee Management System
- CVE-2025-2044code-projects Blood Bank Management System delete_bloodGroup.php sql injectioncode-projects Blood Bank Management System
- CVE-2025-2043LinZhaoguan pb-cms Add New Topic admin#themes deserializationLinZhaoguan pb-cms
- CVE-2025-2042huang-yk student-manage cross-site request forgeryhuang-yk student-manage
- CVE-2025-2041s-a-zhd Ecommerce-Website-using-PHP shop.php sql injections-a-zhd Ecommerce-Website-using-PHP
- CVE-2025-2040zhijiantianya ruoyi-vue-pro deploy special elements used in a template enginezhijiantianya ruoyi-vue-pro
- CVE-2025-2039code-projects Blood Bank Management System delete_members.php sql injectioncode-projects Blood Bank Management System
- CVE-2025-2038code-projects Blood Bank Management System upload exposure of information through directory listingcode-projects Blood Bank Management System
- CVE-2025-27600FastGPT SSRFlabring FastGPT
- CVE-2025-2037code-projects Blood Bank Management System delete_requester.php sql injectioncode-projects Blood Bank Management System
- CVE-2025-27506NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Pagenocodb
- CVE-2025-25294Envoy Gateway Log Injection Vulnerabilityenvoyproxy gateway · github.com/envoyproxy/gateway
- CVE-2025-25191Group-Office has a Stored XSS Vulnerability via user's name fieldIntermesh groupoffice
- CVE-2025-24796Remote Code Execution within Collabora Online jail with Macros EnabledCollaboraOnline online
- CVE-2025-2036s-a-zhd Ecommerce-Website-using-PHP details.php sql injections-a-zhd Ecommerce-Website-using-PHP
- CVE-2025-2035s-a-zhd Ecommerce-Website-using-PHP customer_register.php unrestricted uploads-a-zhd Ecommerce-Website-using-PHP
- CVE-2025-2034PHPGurukul Pre-School Enrollment System edit-class.php sql injectionPHPGurukul Pre-School Enrollment System
- CVE-2025-2033code-projects Blood Bank Management System view_donor.php sql injectioncode-projects Blood Bank Management System
- CVE-2025-2032ChestnutCMS rename renameFile path traversalChestnutCMS
- CVE-2025-21834seccomp: passthrough uretprobe systemcall without filteringLinux
- CVE-2025-21833iommu/vt-d: Avoid use of NULL after WARN_ON_ONCELinux
- CVE-2025-21831PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1Linux
- CVE-2024-58085tomoyo: don't emit warning in tomoyo_write_control()Linux
- CVE-2024-58084firmware: qcom: scm: Fix missing read barrier in qcom_scm_get_tzmem_pool()Linux
- CVE-2024-58082media: nuvoton: Fix an error check in npcm_video_ece_init()Linux
- CVE-2024-58081clk: mmp2: call pm_genpd_init() only after genpd.name is setLinux
- CVE-2024-58080clk: qcom: dispcc-sm6350: Add missing parent_map for a clockLinux
- CVE-2024-58078misc: misc_minor_alloc to use ida for all dynamic/misc dynamic minorsLinux
- CVE-2024-58077ASoC: soc-pcm: don't use soc_pcm_ret() on .prepare callbackLinux
- CVE-2024-58076clk: qcom: gcc-sm6350: Add missing parent_map for two clocksLinux
- CVE-2024-58074drm/i915: Grab intel_display from the encoder to avoid potential oopsiesLinux
- CVE-2025-2031ChestnutCMS upload uploadFile unrestricted uploadChestnutCMS
- CVE-2024-58073drm/msm/dpu: check dpu_plane_atomic_print_state() for valid ssppLinux
- CVE-2024-58072wifi: rtlwifi: remove unused check_buddy_privLinux
- CVE-2024-58071team: prevent adding a device which is already a team device lowerLinux
- CVE-2024-58068OPP: fix dev_pm_opp_find_bw_*() when bandwidth table not initializedLinux
- CVE-2024-58067clk: mmp: pxa1908-mpmu: Fix a NULL vs IS_ERR() checkLinux
- CVE-2024-58066clk: mmp: pxa1908-apbcp: Fix a NULL vs IS_ERR() checkLinux
- CVE-2024-58065clk: mmp: pxa1908-apbc: Fix NULL vs IS_ERR() checkLinux
- CVE-2024-58064wifi: cfg80211: tests: Fix potential NULL dereference in test_cfg80211_parse_colocated_ap()Linux
- CVE-2024-58063wifi: rtlwifi: fix memory leaks and invalid access at probe error pathLinux
- CVE-2024-58062wifi: iwlwifi: mvm: avoid NULL pointer dereferenceLinux
- CVE-2024-58061wifi: mac80211: prohibit deactivating all linksLinux
- CVE-2024-58059media: uvcvideo: Fix deadlock during uvc_probeLinux
- CVE-2024-58058ubifs: skip dumping tnc tree when zroot is nullLinux
- CVE-2024-58057idpf: convert workqueues to unboundLinux
- CVE-2024-58056remoteproc: core: Fix ida_free call while not allocatedLinux
- CVE-2024-58054staging: media: max96712: fix kernel oops when removing moduleLinux
- CVE-2024-58052drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_tableLinux
- CVE-2024-58051ipmi: ipmb: Add check devm_kasprintf() returned valueLinux
- CVE-2025-2030Seeyon Zhiyuan Interconnect FE Collaborative Office Platform addUser.jsp sql injectionSeeyon Zhiyuan Interconnect FE Collaborative Office Platform
- CVE-2025-2029MicroDicom DICOM Viewer mDicom.exe memory corruptionMicroDicom DICOM Viewer
- CVE-2024-13894Path traversal in Smartwares camerasSmartwares CIP-37210AT · Smartwares C724IP
- CVE-2025-0877XSS in AtaksAPP's Reservation Management SystemAtaksAPP Reservation Management System
- CVE-2025-2045Incorrect Authorization in GitLabGitLab
- CVE-2025-1696Exposure of Proxy Credentials in Docker Desktop LogsDocker Desktop
- CVE-2024-38311Apache Traffic Server: Request smuggling via pipelining after a chunked message bodyApache Software Foundation Apache Traffic Server
- CVE-2024-56195Apache Traffic Server: Intercept plugins are not access controlledApache Software Foundation Apache Traffic Server
- CVE-2024-56196Apache Traffic Server: ACL is not fully compatible with older versionsApache Software Foundation Apache Traffic Server
- CVE-2025-1666Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics <= 4.4.1 - Missing Authorization to Authenticated (Subscriber+) Survey SubmissionCookiebot by Usercentrics – Automatic Cookie Banner for GDP…
- CVE-2025-1383Podlove Podcast Publisher <= 4.2.2 - Cross-Site Request Forgery via ajax_transcript_delete Functioneteubert Podlove Podcast Publisher
- CVE-2024-56202Apache Traffic Server: Expect header field can unreasonably retain resourceApache Software Foundation Apache Traffic Server
- CVE-2024-13902huang-yk student-manage Edit a Student Information Page cross site scriptinghuang-yk student-manage
- CVE-2025-1672Notibar <= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scriptingninjateam Notibar – Notification Bar for WordPress
- CVE-2025-1540Incorrect Authorization in GitLabGitLab
- CVE-2024-13897Moving Media Library <= 1.22 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Deletionkatsushi-kawamori Moving Media Library
- CVE-2024-13868Easy Broken Link Checker <= 9.0.2 - Reflected XSSURL Shortener | Conversion Tracking | AB Testing | WooCom…
- CVE-2025-22623Ad Inserter - Reflected cross-site scripting (XSS)Ad Inserter
- CVE-2025-20933Out-of-bounds read in parsing bmp image in Samsung Notes prior to version 4.4.26.71 allows local attackers to read out-of-bounds memory.Samsung Mobile Samsung Notes
- CVE-2025-20932Out-of-bounds read in parsing rle of bmp image in Samsung Notes prior to version 4.4.26.71 allows local attackers to혻read out-of-bounds memoSamsung Mobile Samsung Notes
- CVE-2025-20930Out-of-bounds read in parsing jpeg image in Samsung Notes prior to version 4.4.26.71 allows local attackers to read out-of-bounds memory.Samsung Mobile Samsung Notes
- CVE-2025-20928Out-of-bounds read in parsing wbmp image in Samsung Notes prior to vaersion 4.4.26.71 allows local attackers to access out-of-bounds memory.Samsung Mobile Samsung Notes
- CVE-2025-20927Out-of-bounds read in parsing image data in Samsung Notes prior to vaersion 4.4.26.71 allows local attackers to access out-of-bounds memory.Samsung Mobile Samsung Notes
- CVE-2025-20926Improper export of Android application components in My Files prior to version 15.0.07.5 in Android 14 allows local attackers to access fileSamsung Mobile Samsung My Files
- CVE-2025-20925Out-of-bounds read in applying binary of text data in Samsung Notes prior to version 4.4.26.71 allows local attackers to potentially read meSamsung Mobile Samsung Notes
- CVE-2025-20924Improper access control in Samsung Notes prior to version 4.4.26.71 allows physical attackers to access data across multiple user profiles.Samsung Mobile Samsung Notes
- CVE-2025-20923Improper access control in Galaxy Wearable prior to version 2.2.61.24112961 allows local attackers to launch arbitrary activity with Galaxy Samsung Mobile Galaxy Wearable
- CVE-2025-20922Out-of-bounds read in appending text paragraph in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory.Samsung Mobile Samsung Notes
- CVE-2025-20921Out-of-bounds read in applying binary of text content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memSamsung Mobile Samsung Notes
- CVE-2025-20920Out-of-bounds read in action link data in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory.Samsung Mobile Samsung Notes
- CVE-2025-20919Out-of-bounds read in applying binary of video content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds meSamsung Mobile Samsung Notes
- CVE-2025-20918Out-of-bounds read in applying extra data of base content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-boundsSamsung Mobile Samsung Notes
- CVE-2025-20917Out-of-bounds read in applying binary of pdf content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memoSamsung Mobile Samsung Notes
- CVE-2025-20916Out-of-bounds read in reading string of SPen in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory.Samsung Mobile Samsung Notes
- CVE-2025-20915Out-of-bounds read in applying binary of voice content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds meSamsung Mobile Samsung Notes
- CVE-2025-20914Out-of-bounds read in applying binary of hand writing content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-boSamsung Mobile Samsung Notes
- CVE-2025-20913Out-of-bounds read in applying binary of drawing content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds Samsung Mobile Samsung Notes
- CVE-2025-20912Incorrect default permission in DiagMonAgent prior to SMR Mar-2025 Release 1 allows local attackers to access data within Galaxy Watch.Samsung Mobile Devices
- CVE-2025-20911Improper access control in sem_wifi service prior to SMR Mar-2025 Release 1 allows privileged local attackers to update MAC address of GalaxSamsung Mobile Devices
- CVE-2025-20910Incorrect default permission in Galaxy Watch Gallery prior to SMR Mar-2025 Release 1 allows local attackers to access data in Galaxy Watch GSamsung Mobile Devices
- CVE-2025-20909Use of implicit intent for sensitive communication in Settings prior to SMR Mar-2025 Release 1 allows local attackers to access sensitive inSamsung Mobile Devices
- CVE-2025-20908Use of insufficiently random values in Auracast prior to SMR Mar-2025 Release 1 allows adjacent attackers to access Auracast broadcasting.Samsung Mobile Devices
- CVE-2025-1979Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is beiray
- CVE-2024-57972The pairing API request handler in Microsoft HoloLens 1 (Windows Holographic) through 10.0.17763.3046 and HoloLens 2 (Windows Holographic) tMicrosoft HoloLens
- CVE-2025-25450An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a remote attacker to escalate privileges via the deactivation of the ac
- CVE-2025-25451An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a physically proximate attacker to escalate privileges via the "2fa_aut
- CVE-2025-25452An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a remote attacker to escalate privileges via the "/user" endpoint
- CVE-2025-26699An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20.djangoproject Django · django