# CVEs published 2025-03-06

142 CVEs were published on March 6, 2025: 5 critical, 35 high. Days are UTC.

- [CVE-2025-1121](https://cve.now/CVE-2025-1121.md): Privilege escalation in Installer and Recovery image handling in Google ChromeOS version 15786.48.2 on device allows an attacker with physic (CVSS 6.8, Google ChromeOS)
- [CVE-2025-2050](https://cve.now/CVE-2025-2050.md): PHPGurukul User Registration & Login and User Management System login.php sql injection (CVSS 6.9, PHPGurukul User Registration & Login and User Management Sy…)
- [CVE-2025-2049](https://cve.now/CVE-2025-2049.md): code-projects Blood Bank System AB+.php cross site scripting (CVSS 5.1, code-projects Blood Bank System)
- [CVE-2025-2047](https://cve.now/CVE-2025-2047.md): PHPGurukul Art Gallery Management System search.php cross site scripting (CVSS 5.1, PHPGurukul Art Gallery Management System)
- [CVE-2025-27598](https://cve.now/CVE-2025-27598.md): Out-of-bounds Write in SixLabors ImageSharp (CVSS 7.5, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2025-2046](https://cve.now/CVE-2025-2046.md): SourceCodester Best Employee Management System print1.php sql injection (CVSS 5.3, SourceCodester Best Employee Management System)
- [CVE-2025-2044](https://cve.now/CVE-2025-2044.md): code-projects Blood Bank Management System delete\_bloodGroup.php sql injection (CVSS 5.1, code-projects Blood Bank Management System)
- [CVE-2025-2043](https://cve.now/CVE-2025-2043.md): LinZhaoguan pb-cms Add New Topic admin#themes deserialization (CVSS 5.1, LinZhaoguan pb-cms)
- [CVE-2025-2042](https://cve.now/CVE-2025-2042.md): huang-yk student-manage cross-site request forgery (CVSS 5.3, huang-yk student-manage)
- [CVE-2025-2041](https://cve.now/CVE-2025-2041.md): s-a-zhd Ecommerce-Website-using-PHP shop.php sql injection (CVSS 5.3, s-a-zhd Ecommerce-Website-using-PHP)
- [CVE-2025-2040](https://cve.now/CVE-2025-2040.md): zhijiantianya ruoyi-vue-pro deploy special elements used in a template engine (CVSS 5.3, zhijiantianya ruoyi-vue-pro)
- [CVE-2025-2039](https://cve.now/CVE-2025-2039.md): code-projects Blood Bank Management System delete\_members.php sql injection (CVSS 5.1, code-projects Blood Bank Management System)
- [CVE-2025-2038](https://cve.now/CVE-2025-2038.md): code-projects Blood Bank Management System upload exposure of information through directory listing (CVSS 6.9, code-projects Blood Bank Management System)
- [CVE-2025-27600](https://cve.now/CVE-2025-27600.md): FastGPT SSRF (CVSS 6.9, labring FastGPT)
- [CVE-2025-27509](https://cve.now/CVE-2025-27509.md): SAML authentication vulnerability due to improper SAML response validation (CVSS 9.3, fleetdm fleet · github.com/fleetdm/fleet/v4)
- [CVE-2025-2037](https://cve.now/CVE-2025-2037.md): code-projects Blood Bank Management System delete\_requester.php sql injection (CVSS 5.3, code-projects Blood Bank Management System)
- [CVE-2025-27506](https://cve.now/CVE-2025-27506.md): NocoDB Vulnerable to Reflected Cross-Site Scripting on Reset Password Page (CVSS 5.4, nocodb)
- [CVE-2025-25294](https://cve.now/CVE-2025-25294.md): Envoy Gateway Log Injection Vulnerability (CVSS 5.3, envoyproxy gateway · github.com/envoyproxy/gateway)
- [CVE-2025-25191](https://cve.now/CVE-2025-25191.md): Group-Office has a Stored XSS Vulnerability via user's name field (CVSS 6.9, Intermesh groupoffice)
- [CVE-2025-24796](https://cve.now/CVE-2025-24796.md): Remote Code Execution within Collabora Online jail with Macros Enabled (CVSS 6.3, CollaboraOnline online)
- [CVE-2025-2036](https://cve.now/CVE-2025-2036.md): s-a-zhd Ecommerce-Website-using-PHP details.php sql injection (CVSS 5.3, s-a-zhd Ecommerce-Website-using-PHP)
- [CVE-2025-2035](https://cve.now/CVE-2025-2035.md): s-a-zhd Ecommerce-Website-using-PHP customer\_register.php unrestricted upload (CVSS 5.3, s-a-zhd Ecommerce-Website-using-PHP)
- [CVE-2025-2034](https://cve.now/CVE-2025-2034.md): PHPGurukul Pre-School Enrollment System edit-class.php sql injection (CVSS 6.9, PHPGurukul Pre-School Enrollment System)
- [CVE-2025-2033](https://cve.now/CVE-2025-2033.md): code-projects Blood Bank Management System view\_donor.php sql injection (CVSS 5.3, code-projects Blood Bank Management System)
- [CVE-2025-2032](https://cve.now/CVE-2025-2032.md): ChestnutCMS rename renameFile path traversal (CVSS 5.1, ChestnutCMS)
- [CVE-2025-0337](https://cve.now/CVE-2025-0337.md): Authorization bypass in Now Platform (CVSS 7.1, ServiceNow Now Platform)
- [CVE-2024-58086](https://cve.now/CVE-2024-58086.md): drm/v3d: Stop active perfmon if it is being destroyed (CVSS 7.8, Linux)
- [CVE-2024-51476](https://cve.now/CVE-2024-51476.md): IBM Concert Software information disclosure (CVSS 7.5, IBM Concert Software)
- [CVE-2024-12742](https://cve.now/CVE-2024-12742.md): Deserialization of Untrusted Data Vulnerability in NI G Web Development Software (CVSS 7.8, NI G Web Development Software)
- [CVE-2025-21834](https://cve.now/CVE-2025-21834.md): seccomp: passthrough uretprobe systemcall without filtering (no CVSS, Linux)
- [CVE-2025-21833](https://cve.now/CVE-2025-21833.md): iommu/vt-d: Avoid use of NULL after WARN\_ON\_ONCE (CVSS 5.5, Linux)
- [CVE-2025-21832](https://cve.now/CVE-2025-21832.md): block: don't revert iter for -EIOCBQUEUED (CVSS 7.8, Linux)
- [CVE-2025-21831](https://cve.now/CVE-2025-21831.md): PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 (no CVSS, Linux)
- [CVE-2024-58085](https://cve.now/CVE-2024-58085.md): tomoyo: don't emit warning in tomoyo\_write\_control() (no CVSS, Linux)
- [CVE-2024-58084](https://cve.now/CVE-2024-58084.md): firmware: qcom: scm: Fix missing read barrier in qcom\_scm\_get\_tzmem\_pool() (CVSS 5.5, Linux)
- [CVE-2024-58083](https://cve.now/CVE-2024-58083.md): KVM: Explicitly verify target vCPU is online in kvm\_get\_vcpu() (CVSS 7.8, Linux)
- [CVE-2024-58082](https://cve.now/CVE-2024-58082.md): media: nuvoton: Fix an error check in npcm\_video\_ece\_init() (no CVSS, Linux)
- [CVE-2024-58081](https://cve.now/CVE-2024-58081.md): clk: mmp2: call pm\_genpd\_init() only after genpd.name is set (CVSS 5.5, Linux)
- [CVE-2024-58080](https://cve.now/CVE-2024-58080.md): clk: qcom: dispcc-sm6350: Add missing parent\_map for a clock (CVSS 5.5, Linux)
- [CVE-2024-58079](https://cve.now/CVE-2024-58079.md): media: uvcvideo: Fix crash during unbind if gpio unit is in use (CVSS 7.8, Linux)
- [CVE-2024-58078](https://cve.now/CVE-2024-58078.md): misc: misc\_minor\_alloc to use ida for all dynamic/misc dynamic minors (no CVSS, Linux)
- [CVE-2024-58077](https://cve.now/CVE-2024-58077.md): ASoC: soc-pcm: don't use soc\_pcm\_ret() on .prepare callback (no CVSS, Linux)
- [CVE-2024-58076](https://cve.now/CVE-2024-58076.md): clk: qcom: gcc-sm6350: Add missing parent\_map for two clocks (CVSS 5.5, Linux)
- [CVE-2025-21830](https://cve.now/CVE-2025-21830.md): landlock: Handle weird files (CVSS 7.3, Linux)
- [CVE-2025-21829](https://cve.now/CVE-2025-21829.md): RDMA/rxe: Fix the warning "\_\_rxe\_cleanup+0x12c/0x170 \[rdma\_rxe\]" (CVSS 9.8, Linux)
- [CVE-2025-21828](https://cve.now/CVE-2025-21828.md): wifi: mac80211: don't flush non-uploaded STAs (CVSS 8.8, Linux)
- [CVE-2025-21827](https://cve.now/CVE-2025-21827.md): Bluetooth: btusb: mediatek: Add locks for usb\_driver\_claim\_interface() (CVSS 7.8, Linux)
- [CVE-2025-21826](https://cve.now/CVE-2025-21826.md): netfilter: nf\_tables: reject mismatching sum of field\_len with set key length (CVSS 7.8, Linux)
- [CVE-2025-21825](https://cve.now/CVE-2025-21825.md): bpf: Cancel the running bpf\_timer through kworker for PREEMPT\_RT (CVSS 7.8, Linux)
- [CVE-2024-58075](https://cve.now/CVE-2024-58075.md): crypto: tegra - do not transfer req when tegra init fails (CVSS 7.8, Linux)
- [CVE-2024-58074](https://cve.now/CVE-2024-58074.md): drm/i915: Grab intel\_display from the encoder to avoid potential oopsies (no CVSS, Linux)
- [CVE-2025-2031](https://cve.now/CVE-2025-2031.md): ChestnutCMS upload uploadFile unrestricted upload (CVSS 5.3, ChestnutCMS)
- [CVE-2024-58073](https://cve.now/CVE-2024-58073.md): drm/msm/dpu: check dpu\_plane\_atomic\_print\_state() for valid sspp (CVSS 5.5, Linux)
- [CVE-2024-58072](https://cve.now/CVE-2024-58072.md): wifi: rtlwifi: remove unused check\_buddy\_priv (no CVSS, Linux)
- [CVE-2024-58071](https://cve.now/CVE-2024-58071.md): team: prevent adding a device which is already a team device lower (CVSS 5.5, Linux)
- [CVE-2024-58070](https://cve.now/CVE-2024-58070.md): bpf: bpf\_local\_storage: Always use bpf\_mem\_alloc in PREEMPT\_RT (CVSS 7.8, Linux)
- [CVE-2024-58069](https://cve.now/CVE-2024-58069.md): rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read (CVSS 7.8, Linux)
- [CVE-2024-58068](https://cve.now/CVE-2024-58068.md): OPP: fix dev\_pm\_opp\_find\_bw\_\*() when bandwidth table not initialized (CVSS 5.5, Linux)
- [CVE-2024-58067](https://cve.now/CVE-2024-58067.md): clk: mmp: pxa1908-mpmu: Fix a NULL vs IS\_ERR() check (CVSS 5.5, Linux)
- [CVE-2024-58066](https://cve.now/CVE-2024-58066.md): clk: mmp: pxa1908-apbcp: Fix a NULL vs IS\_ERR() check (CVSS 5.5, Linux)
- [CVE-2024-58065](https://cve.now/CVE-2024-58065.md): clk: mmp: pxa1908-apbc: Fix NULL vs IS\_ERR() check (CVSS 5.5, Linux)
- [CVE-2024-58064](https://cve.now/CVE-2024-58064.md): wifi: cfg80211: tests: Fix potential NULL dereference in test\_cfg80211\_parse\_colocated\_ap() (CVSS 5.5, Linux)
- [CVE-2024-58063](https://cve.now/CVE-2024-58063.md): wifi: rtlwifi: fix memory leaks and invalid access at probe error path (CVSS 5.5, Linux)
- [CVE-2024-58062](https://cve.now/CVE-2024-58062.md): wifi: iwlwifi: mvm: avoid NULL pointer dereference (CVSS 5.5, Linux)
- [CVE-2024-58061](https://cve.now/CVE-2024-58061.md): wifi: mac80211: prohibit deactivating all links (no CVSS, Linux)
- [CVE-2024-58060](https://cve.now/CVE-2024-58060.md): bpf: Reject struct\_ops registration that uses module ptr and the module btf\_id is missing (CVSS 7.8, Linux)
- [CVE-2024-58059](https://cve.now/CVE-2024-58059.md): media: uvcvideo: Fix deadlock during uvc\_probe (CVSS 5.5, Linux)
- [CVE-2024-58058](https://cve.now/CVE-2024-58058.md): ubifs: skip dumping tnc tree when zroot is null (CVSS 5.5, Linux)
- [CVE-2024-58057](https://cve.now/CVE-2024-58057.md): idpf: convert workqueues to unbound (no CVSS, Linux)
- [CVE-2024-58056](https://cve.now/CVE-2024-58056.md): remoteproc: core: Fix ida\_free call while not allocated (no CVSS, Linux)
- [CVE-2024-58055](https://cve.now/CVE-2024-58055.md): usb: gadget: f\_tcm: Don't free command immediately (CVSS 7.8, Linux)
- [CVE-2024-58054](https://cve.now/CVE-2024-58054.md): staging: media: max96712: fix kernel oops when removing module (no CVSS, Linux)
- [CVE-2024-58053](https://cve.now/CVE-2024-58053.md): rxrpc: Fix handling of received connection abort (CVSS 7.5, Linux)
- [CVE-2024-58052](https://cve.now/CVE-2024-58052.md): drm/amdgpu: Fix potential NULL pointer dereference in atomctrl\_get\_smc\_sclk\_range\_table (CVSS 5.5, Linux)
- [CVE-2024-58051](https://cve.now/CVE-2024-58051.md): ipmi: ipmb: Add check devm\_kasprintf() returned value (no CVSS, Linux)
- [CVE-2025-2030](https://cve.now/CVE-2025-2030.md): Seeyon Zhiyuan Interconnect FE Collaborative Office Platform addUser.jsp sql injection (CVSS 6.9, Seeyon Zhiyuan Interconnect FE Collaborative Office Platform)
- [CVE-2025-2029](https://cve.now/CVE-2025-2029.md): MicroDicom DICOM Viewer mDicom.exe memory corruption (CVSS 4.8, MicroDicom DICOM Viewer)
- [CVE-2024-12146](https://cve.now/CVE-2024-12146.md): SQLi in Finder Fire Safety's Finder ERP/CRM (New System) (CVSS 7.5, Finder Fire Safety Finder ERP/CRM)
- [CVE-2024-12144](https://cve.now/CVE-2024-12144.md): SQLi in Finder Fire Safety's Finder ERP/CRM (Old System) (CVSS 9.8, Finder Fire Safety Finder ERP/CRM)
- [CVE-2024-13894](https://cve.now/CVE-2024-13894.md): Path traversal in Smartwares cameras (CVSS 5.9, Smartwares CIP-37210AT · Smartwares C724IP)
- [CVE-2024-13893](https://cve.now/CVE-2024-13893.md): Shared credentials in Smartwares cameras (CVSS 7.5, Smartwares CIP-37210AT · Smartwares C724IP)
- [CVE-2024-13892](https://cve.now/CVE-2024-13892.md): Command Injection in Smartwares cameras (CVSS 7.7, Smartwares CIP-37210AT · Smartwares C724IP)
- [CVE-2025-0877](https://cve.now/CVE-2025-0877.md): XSS in AtaksAPP's Reservation Management System (CVSS 4.7, AtaksAPP Reservation Management System)
- [CVE-2025-2045](https://cve.now/CVE-2025-2045.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2025-1696](https://cve.now/CVE-2025-1696.md): Exposure of Proxy Credentials in Docker Desktop Logs (CVSS 5.2, Docker Desktop)
- [CVE-2024-38311](https://cve.now/CVE-2024-38311.md): Apache Traffic Server: Request smuggling via pipelining after a chunked message body (CVSS 6.3, Apache Software Foundation Apache Traffic Server)
- [CVE-2024-56195](https://cve.now/CVE-2024-56195.md): Apache Traffic Server: Intercept plugins are not access controlled (CVSS 6.3, Apache Software Foundation Apache Traffic Server)
- [CVE-2024-56196](https://cve.now/CVE-2024-56196.md): Apache Traffic Server: ACL is not fully compatible with older versions (CVSS 6.3, Apache Software Foundation Apache Traffic Server)
- [CVE-2024-7872](https://cve.now/CVE-2024-7872.md): Sensetive Data Exposure in ExtremePACS' Extreme XDS (CVSS 7.6, ExtremePACS Extreme XDS)
- [CVE-2025-1666](https://cve.now/CVE-2025-1666.md): Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics \<= 4.4.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission (CVSS 4.3, Cookiebot by Usercentrics – Automatic Cookie Banner for GDP…)
- [CVE-2025-1383](https://cve.now/CVE-2025-1383.md): Podlove Podcast Publisher \<= 4.2.2 - Cross-Site Request Forgery via ajax\_transcript\_delete Function (CVSS 4.3, eteubert Podlove Podcast Publisher)
- [CVE-2024-56202](https://cve.now/CVE-2024-56202.md): Apache Traffic Server: Expect header field can unreasonably retain resource (CVSS 4.3, Apache Software Foundation Apache Traffic Server)
- [CVE-2024-13902](https://cve.now/CVE-2024-13902.md): huang-yk student-manage Edit a Student Information Page cross site scripting (CVSS 4.8, huang-yk student-manage)
- [CVE-2025-1672](https://cve.now/CVE-2025-1672.md): Notibar \<= 2.1.5 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, ninjateam Notibar – Notification Bar for WordPress)
- [CVE-2025-1540](https://cve.now/CVE-2025-1540.md): Incorrect Authorization in GitLab (CVSS 3.1, GitLab)
- [CVE-2024-13897](https://cve.now/CVE-2024-13897.md): Moving Media Library \<= 1.22 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Deletion (CVSS 6.5, katsushi-kawamori Moving Media Library)
- [CVE-2024-13868](https://cve.now/CVE-2024-13868.md): Easy Broken Link Checker \<= 9.0.2 - Reflected XSS (CVSS 6.1, URL Shortener | Conversion Tracking | AB Testing | WooCom…)
- [CVE-2025-22623](https://cve.now/CVE-2025-22623.md): Ad Inserter - Reflected cross-site scripting (XSS) (CVSS 5.1, Ad Inserter)
- [CVE-2025-20933](https://cve.now/CVE-2025-20933.md): Out-of-bounds read in parsing bmp image in Samsung Notes prior to version 4.4.26.71 allows local attackers to read out-of-bounds memory. (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2025-20932](https://cve.now/CVE-2025-20932.md): Out-of-bounds read in parsing rle of bmp image in Samsung Notes prior to version 4.4.26.71 allows local attackers to혻read out-of-bounds memo (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2025-20931](https://cve.now/CVE-2025-20931.md): Out-of-bounds write in parsing bmp image in Samsung Notes prior to version 4.4.26.71 allows local attackers to execute arbitrary code. (CVSS 7.3, Samsung Mobile Samsung Notes)
- [CVE-2025-20930](https://cve.now/CVE-2025-20930.md): Out-of-bounds read in parsing jpeg image in Samsung Notes prior to version 4.4.26.71 allows local attackers to read out-of-bounds memory. (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2025-20929](https://cve.now/CVE-2025-20929.md): Out-of-bounds write in parsing jpeg image in Samsung Notes prior to version 4.4.26.71 allows local attackers to execute arbitrary code. (CVSS 7.3, Samsung Mobile Samsung Notes)
- [CVE-2025-20928](https://cve.now/CVE-2025-20928.md): Out-of-bounds read in parsing wbmp image in Samsung Notes prior to vaersion 4.4.26.71 allows local attackers to access out-of-bounds memory. (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2025-20927](https://cve.now/CVE-2025-20927.md): Out-of-bounds read in parsing image data in Samsung Notes prior to vaersion 4.4.26.71 allows local attackers to access out-of-bounds memory. (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2025-20926](https://cve.now/CVE-2025-20926.md): Improper export of Android application components in My Files prior to version 15.0.07.5 in Android 14 allows local attackers to access file (CVSS 5.5, Samsung Mobile Samsung My Files)
- [CVE-2025-20925](https://cve.now/CVE-2025-20925.md): Out-of-bounds read in applying binary of text data in Samsung Notes prior to version 4.4.26.71 allows local attackers to potentially read me (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2025-20924](https://cve.now/CVE-2025-20924.md): Improper access control in Samsung Notes prior to version 4.4.26.71 allows physical attackers to access data across multiple user profiles. (CVSS 4.6, Samsung Mobile Samsung Notes)
- [CVE-2025-20923](https://cve.now/CVE-2025-20923.md): Improper access control in Galaxy Wearable prior to version 2.2.61.24112961 allows local attackers to launch arbitrary activity with Galaxy (CVSS 4.0, Samsung Mobile Galaxy Wearable)
- [CVE-2025-20922](https://cve.now/CVE-2025-20922.md): Out-of-bounds read in appending text paragraph in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2025-20921](https://cve.now/CVE-2025-20921.md): Out-of-bounds read in applying binary of text content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds mem (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2025-20920](https://cve.now/CVE-2025-20920.md): Out-of-bounds read in action link data in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2025-20919](https://cve.now/CVE-2025-20919.md): Out-of-bounds read in applying binary of video content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds me (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2025-20918](https://cve.now/CVE-2025-20918.md): Out-of-bounds read in applying extra data of base content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2025-20917](https://cve.now/CVE-2025-20917.md): Out-of-bounds read in applying binary of pdf content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memo (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2025-20916](https://cve.now/CVE-2025-20916.md): Out-of-bounds read in reading string of SPen in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds memory. (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2025-20915](https://cve.now/CVE-2025-20915.md): Out-of-bounds read in applying binary of voice content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds me (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2025-20914](https://cve.now/CVE-2025-20914.md): Out-of-bounds read in applying binary of hand writing content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bo (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2025-20913](https://cve.now/CVE-2025-20913.md): Out-of-bounds read in applying binary of drawing content in Samsung Notes prior to version 4.4.26.71 allows attackers to read out-of-bounds (CVSS 5.5, Samsung Mobile Samsung Notes)
- [CVE-2025-20912](https://cve.now/CVE-2025-20912.md): Incorrect default permission in DiagMonAgent prior to SMR Mar-2025 Release 1 allows local attackers to access data within Galaxy Watch. (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2025-20911](https://cve.now/CVE-2025-20911.md): Improper access control in sem\_wifi service prior to SMR Mar-2025 Release 1 allows privileged local attackers to update MAC address of Galax (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2025-20910](https://cve.now/CVE-2025-20910.md): Incorrect default permission in Galaxy Watch Gallery prior to SMR Mar-2025 Release 1 allows local attackers to access data in Galaxy Watch G (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2025-20909](https://cve.now/CVE-2025-20909.md): Use of implicit intent for sensitive communication in Settings prior to SMR Mar-2025 Release 1 allows local attackers to access sensitive in (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2025-20908](https://cve.now/CVE-2025-20908.md): Use of insufficiently random values in Auracast prior to SMR Mar-2025 Release 1 allows adjacent attackers to access Auracast broadcasting. (CVSS 6.5, Samsung Mobile Devices)
- [CVE-2025-20903](https://cve.now/CVE-2025-20903.md): Improper access control in SecSettingsIntelligence prior to SMR Mar-2025 Release 1 allows local attackers to launch privileged activities. (CVSS 7.3, Samsung Mobile Devices)
- [CVE-2025-1979](https://cve.now/CVE-2025-1979.md): Versions of the package ray before 2.43.0 are vulnerable to Insertion of Sensitive Information into Log File where the redis password is bei (CVSS 5.7, ray)
- [CVE-2025-22447](https://cve.now/CVE-2025-22447.md): Incorrect access permission of a specific service issue exists in RemoteView Agent (for Windows) versions prior to v8.1.5.2. (CVSS 7.8, RSUPPORT Co. RemoteView Agent)
- [CVE-2025-24864](https://cve.now/CVE-2025-24864.md): Incorrect access permission of a specific folder issue exists in RemoteView Agent (for Windows) versions prior to v8.1.5.2. (CVSS 7.8, RSUPPORT Co. RemoteView Agent)
- [CVE-2024-42844](https://cve.now/CVE-2024-42844.md): A SQL Injection vulnerability has been identified in EPICOR Prophet 21 (P21) up to 23.2.5232. (CVSS 8.1)
- [CVE-2024-50600](https://cve.now/CVE-2024-50600.md): An issue was discovered in Samsung Mobile Processor and Wearable Processor Exynos 980, 850, 1080, 1280, 1330, 1380, 1480, W920, W930, and W1 (CVSS 7.5)
- [CVE-2024-52923](https://cve.now/CVE-2024-52923.md): An issue was discovered in NRMM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 128 (CVSS 7.5)
- [CVE-2024-52924](https://cve.now/CVE-2024-52924.md): An issue was discovered in NRMM in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 9820, 9825, 980, 990, 850, 1080, 2100, 128 (CVSS 7.5)
- [CVE-2024-57972](https://cve.now/CVE-2024-57972.md): The pairing API request handler in Microsoft HoloLens 1 (Windows Holographic) through 10.0.17763.3046 and HoloLens 2 (Windows Holographic) t (CVSS 6.5, Microsoft HoloLens)
- [CVE-2025-25361](https://cve.now/CVE-2025-25361.md): An arbitrary file upload vulnerability in the component /cms/CmsWebFileAdminController.java of PublicCMS v4.0.202406 allows attackers to exe (CVSS 9.8)
- [CVE-2025-25381](https://cve.now/CVE-2025-25381.md): Incorrect access control in the KSRTC AWATAR app of Karnataka State Road Transport Corporation v1.3.0 allows to view sensitive information s (CVSS 7.5)
- [CVE-2025-25450](https://cve.now/CVE-2025-25450.md): An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a remote attacker to escalate privileges via the deactivation of the ac (CVSS 5.1)
- [CVE-2025-25451](https://cve.now/CVE-2025-25451.md): An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a physically proximate attacker to escalate privileges via the "2fa\_aut (CVSS 5.1)
- [CVE-2025-25452](https://cve.now/CVE-2025-25452.md): An issue in TAAGSOLUTIONS GmbH MyTaag v.2024-11-24 and before allows a remote attacker to escalate privileges via the "/user" endpoint (CVSS 5.1)
- [CVE-2025-25497](https://cve.now/CVE-2025-25497.md): An issue in account management interface in Netsweeper Server v.8.2.6 and earlier (fixed in v.8.2.7) allows unauthorized changes to the "Acc (CVSS 8.1)
- [CVE-2025-25763](https://cve.now/CVE-2025-25763.md): crmeb CRMEB-KY v5.4.0 and before has a SQL Injection vulnerability at getRead() in /system/SystemDatabackupServices.php (CVSS 9.8)
- [CVE-2025-26167](https://cve.now/CVE-2025-26167.md): Buffalo LS520D 4.53 is vulnerable to Arbitrary file read, which allows unauthenticated attackers to access the NAS web UI and read arbitrary (CVSS 7.5)
- [CVE-2025-26699](https://cve.now/CVE-2025-26699.md): An issue was discovered in Django 5.1 before 5.1.7, 5.0 before 5.0.13, and 4.2 before 4.2.20. (CVSS 5.0, djangoproject Django · django)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.