CVEs published March 10, 2025
83 CVEs were published on March 10, 2025: 7 critical, 31 high. 1 is now in CISA KEV.
- Published
- 83
- Critical
- 7
- High
- 31
- Medium
- 37
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 44
Most affected products
- Google Android
- 7
- Google Chrome
- 4
- Apple iOS and iPadOS · Apple macOS
- 3
- Apple macOS
- 3
- GE Vernova EnerVista UR Setup
- 3
- Nintex Automation
- 3
- Apple Safari · Apple iOS and iPadOS +4
- 2
- GE Vernova N60 multilin · GE Vernova B30 Multilin +17
- 2
- Laravel Holdings Laravel Framework · laravel/framework
- 2
- mmaitre314 picklescan · picklescan
- 2
Critical 7
- CVE-2025-25306Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notesmisskey-dev misskey
- CVE-2025-24813Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUTApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2025-26916WordPress Massive Dynamic theme <= 8.2 - Unauthenticated Local File Inclusion vulnerabilityPixflow Massive Dynamic
- CVE-2025-26936WordPress Fresh Framework plugin <= 1.70.0 - Unauthenticated Remote Code Execution (RCE) vulnerabilityFRESHFACE Fresh Framework
- CVE-2025-1497Remote Code Execution in PlotAIMLJAR PlotAI · plotai
- CVE-2025-25940VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java.
- CVE-2025-25977An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement.canvg
High 31
- CVE-2025-1828Perl's Crypt::Random module after 1.05 and before 1.56 may use rand() function for cryptographic functionsperl Crypt::Random
- CVE-2025-27610Local File Inclusion in Rack::Staticrack
- CVE-2024-56192In wl_notify_gscan_event of wl_cfgscan.c, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2024-56191In dhd_process_full_gscan_result of dhd_pno.c, there is a possible EoP due to an integer overflow.Google Android
- CVE-2025-2137Out of bounds read in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to perform out of bounds memory access via a crafGoogle Chrome
- CVE-2025-2136Use after free in Inspector in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2025-2135Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2025-1920Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2022-43454A double free issue was addressed with improved memory management.Apple macOS · Apple watchOS +2
- CVE-2024-44227The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS
- CVE-2024-54546The issue was addressed with improved memory handling.Apple macOS
- CVE-2025-27616Vela Server has Insufficient Webhook Payload Data Verificationgo-vela server · github.com/go-vela/server
- CVE-2025-27615umatiGateway's UI publicly accessible in provided docker-compose fileumatiGateway
- CVE-2025-26696Crafted email message incorrectly shown as being encryptedMozilla Thunderbird
- CVE-2025-22603AutoGPT SSRF vulnerabilitySignificant-Gravitas AutoGPT
- CVE-2025-26910WordPress WPBookit plugin <= 1.0.1 - Cross Site Request Forgery (CSRF) VulnerabilityIqonic Design WPBookit
- CVE-2025-26933WordPress Place Order Without Payment for WooCommerce plugin <= 2.6.7 - Local File Inclusion vulnerabilityNitin Prakash WC Place Order Without Payment
- CVE-2024-13919Laravel Reflected XSS via Route Parameter in Debug-Mode Error PageLaravel Holdings Laravel Framework · laravel/framework
- CVE-2024-13918Laravel Reflected XSS via Request Parameter in Debug-Mode Error PageLaravel Holdings Laravel Framework · laravel/framework
- CVE-2025-27256Missing Authentication for Critical Function vulnerability in GE Vernova Enervista UR Setup application allows Authentication Bypass due to GE Vernova EnerVista UR Setup
- CVE-2025-27255Use of Hard-coded Credentials vulnerability in GE Vernova EnerVista UR Setup allows Privilege Escalation.GE Vernova EnerVista UR Setup
- CVE-2025-27254CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass.GE Vernova EnerVista UR Setup
- CVE-2024-11638Gtbabel < 6.6.9 - Unauthenticated Admin Account TakeoverGtbabel
- CVE-2024-41724Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server.Gallagher Command Centre Server
- CVE-2024-43107Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) permits unauthenticated messages (e.g.Gallagher Milestone Integration Plugin
- CVE-2025-25382An issue in the Property Tax Payment Portal in Information Kerala Mission SANCHAYA v3.0.4 allows attackers to arbitrarily modify payment amo
- CVE-2025-25614Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to update the personal data of fellow
- CVE-2025-25616Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams.
- CVE-2025-25907tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/save.
- CVE-2025-27910tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/upd/status.
- CVE-2025-27925Nintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input.Nintex Automation
Medium, low and unrated 45
- CVE-2025-0660Stored XSS in Folder Function by Rogue AdminConcrete CMS · concrete5/concrete5
- CVE-2022-48610This issue was addressed through improved state management.Apple macOS · Apple watchOS +1
- CVE-2024-54558A clickjacking issue was addressed with improved out-of-process view handling.Apple iOS and iPadOS · Apple macOS
- CVE-2024-54467A cookie management issue was addressed with improved state management.Apple Safari · Apple iOS and iPadOS +4
- CVE-2024-44179This issue was addressed by restricting options offered on a locked device.Apple iOS and iPadOS · Apple macOS
- CVE-2024-54463This issue was addressed with improved entitlements.Apple macOS
- CVE-2024-54560A logic issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-44192The issue was addressed with improved checks.Apple Safari · Apple iOS and iPadOS +4
- CVE-2024-54469The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +1
- CVE-2024-54473This issue was addressed with improved redaction of sensitive information.Apple macOS
- CVE-2025-26695Downloading of OpenPGP keys from WKD used incorrect paddingMozilla Thunderbird
- CVE-2025-27136LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) InjectionRobothy local-s3 · io.github.robothy:local-s3-rest
- CVE-2024-56188there is a possible way to crash the modem due to a missing null check.Google Android
- CVE-2024-56187In ppcfw_deny_sec_dram_access of ppcfw.c, there is a possible arbitrary read from TEE memory due to a logic error in the code.Google Android
- CVE-2024-56186In closeChannel of secureelementimpl.cpp, there is a possible out of bounds read due to an incorrect bounds check.Google Android
- CVE-2024-56185In ProtocolUnsolOnSSAdapter::GetServiceClass() of protocolcalladapter.cpp, there is a possible out-of-bounds read due to a missing bounds chGoogle Android
- CVE-2024-56184In static long dev_send of tipc_dev_ql, there is a possible out of bounds read due to an incorrect bounds check.Google Android
- CVE-2025-1296Nomad Exposes Sensitive Workload Identity and Client Secret Token in Audit LogsHashiCorp Nomad · github.com/hashicorp/nomad
- CVE-2024-52812LF Edge eKuiper has Stored XSS in Rules Functionalitylf-edge ekuiper · github.com/lf-edge/ekuiper +1
- CVE-2024-52905IBM Sterling B2B Integrator information disclosureIBM Sterling B2B Integrator Standard Edition
- CVE-2024-47109IBM Sterling File Gateway information disclosureIBM Sterling File Gateway
- CVE-2024-12604Improper Authentication in Tapandsign Technologies Tap and Sign AppTapandsign Technologies Tap&Sign App
- CVE-2025-26865Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCEApache Software Foundation Apache OFBiz
- CVE-2025-2153HDF5 h5 File H5SM.c H5SM_delete heap-based overflowHDF5
- CVE-2025-2152Open Asset Import Library Assimp File BaseImporter.cpp ConvertToUTF8 heap-based overflowOpen Asset Import Library Assimp · pyassimp
- CVE-2025-2151Open Asset Import Library Assimp File ParsingUtils.h GetNextLine stack-based overflowOpen Asset Import Library Assimp · pyassimp
- CVE-2025-2149PyTorch Quantized Sigmoid Module nnq_Sigmoid initializationPyTorch · torch
- CVE-2025-2148PyTorch Tuple torch.ops.profiler._call_end_callbacks_on_jit_fut memory corruptionPyTorch · torch
- CVE-2025-1945picklescan - Zip Flag Bit Exploit Crashes Picklescan But Not PyTorchmmaitre314 picklescan · picklescan
- CVE-2025-1944picklescan ZIP archive manipulation attack leads to crashmmaitre314 picklescan · picklescan
- CVE-2025-2147Beijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System file accessBeijing Zhide Intelligent Internet Technology Modern Farm D…
- CVE-2025-24387Missing CSRF protectionOTRS AG OTRS
- CVE-2025-27257Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a mGE Vernova N60 multilin · GE Vernova B30 Multilin +17
- CVE-2025-27253A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an attGE Vernova N60 multilin · GE Vernova B30 Multilin +17
- CVE-2025-2150HGiga C&Cm@il - Stored Cross-Site ScriptingHGiga C&Cm@il
- CVE-2025-1926Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Cross-Site Request Forgery (CSRF) To Post Contents Modificationsoftaculous Page Builder: Pagelayer – Drag and Drop website…
- CVE-2024-53307A reflected cross-site scripting (XSS) vulnerability in the /mw/ endpoint of Evisions MAPS v6.10.2.267 allows attackers to execute arbitrary
- CVE-2024-55199A Stored Cross Site Scripting (XSS) vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to store JavaScript code
- CVE-2024-57492An issue in redoxOS relibc before commit 98aa4ea5 allows a local attacker to cause a denial of service via the round_up_to_page funciton.
- CVE-2025-25615Unifiedtransform 2.0 is vulnerable to Incorrect Access Control which allows viewing attendance list for all class sections.
- CVE-2025-25620Unifiedtransform 2.0 is vulnerable to Cross Site Scripting (XSS) in the Create assignment function.
- CVE-2025-25908A stored cross-site scripting (XSS) vulnerability in tianti v2.3 allows attackers to execute arbitrary web scripts or HTML via injecting a c
- CVE-2025-27913Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), canPassbolt API
- CVE-2025-27924Nintex Automation 5.6 and 5.7 before 5.8 has a stored XSS issue associated with the "Navigate to a URL" action.Nintex Automation
- CVE-2025-27926In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) containing passwords thaNintex Automation