# CVEs published 2025-03-10

83 CVEs were published on March 10, 2025: 7 critical, 31 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-1828](https://cve.now/CVE-2025-1828.md): Perl's Crypt::Random module after 1.05 and before 1.56 may use rand() function for cryptographic functions (CVSS 8.8, perl Crypt::Random)
- [CVE-2025-27610](https://cve.now/CVE-2025-27610.md): Local File Inclusion in Rack::Static (CVSS 7.5, rack)
- [CVE-2025-0660](https://cve.now/CVE-2025-0660.md): Stored XSS in Folder Function by Rogue Admin (CVSS 4.8, Concrete CMS · concrete5/concrete5)
- [CVE-2024-56192](https://cve.now/CVE-2024-56192.md): In wl\_notify\_gscan\_event of wl\_cfgscan.c, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, Google Android)
- [CVE-2024-56191](https://cve.now/CVE-2024-56191.md): In dhd\_process\_full\_gscan\_result of dhd\_pno.c, there is a possible EoP due to an integer overflow. (CVSS 8.4, Google Android)
- [CVE-2025-2137](https://cve.now/CVE-2025-2137.md): Out of bounds read in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to perform out of bounds memory access via a craf (CVSS 8.8, Google Chrome)
- [CVE-2025-2136](https://cve.now/CVE-2025-2136.md): Use after free in Inspector in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a c (CVSS 8.8, Google Chrome)
- [CVE-2025-2135](https://cve.now/CVE-2025-2135.md): Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2025-1920](https://cve.now/CVE-2025-1920.md): Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2022-48610](https://cve.now/CVE-2022-48610.md): This issue was addressed through improved state management. (CVSS 5.5, Apple macOS · Apple watchOS +1)
- [CVE-2022-43454](https://cve.now/CVE-2022-43454.md): A double free issue was addressed with improved memory management. (CVSS 7.8, Apple macOS · Apple watchOS +2)
- [CVE-2024-54558](https://cve.now/CVE-2024-54558.md): A clickjacking issue was addressed with improved out-of-process view handling. (CVSS 2.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-54467](https://cve.now/CVE-2024-54467.md): A cookie management issue was addressed with improved state management. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2024-44179](https://cve.now/CVE-2024-44179.md): This issue was addressed by restricting options offered on a locked device. (CVSS 2.4, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-44227](https://cve.now/CVE-2024-44227.md): The issue was addressed with improved memory handling. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-54546](https://cve.now/CVE-2024-54546.md): The issue was addressed with improved memory handling. (CVSS 7.5, Apple macOS)
- [CVE-2024-54463](https://cve.now/CVE-2024-54463.md): This issue was addressed with improved entitlements. (CVSS 5.5, Apple macOS)
- [CVE-2024-54560](https://cve.now/CVE-2024-54560.md): A logic issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-44192](https://cve.now/CVE-2024-44192.md): The issue was addressed with improved checks. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2024-54469](https://cve.now/CVE-2024-54469.md): The issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-54473](https://cve.now/CVE-2024-54473.md): This issue was addressed with improved redaction of sensitive information. (CVSS 5.5, Apple macOS)
- [CVE-2025-27616](https://cve.now/CVE-2025-27616.md): Vela Server has Insufficient Webhook Payload Data Verification (CVSS 8.6, go-vela server · github.com/go-vela/server)
- [CVE-2025-27615](https://cve.now/CVE-2025-27615.md): umatiGateway's UI publicly accessible in provided docker-compose file (CVSS 8.2, umatiGateway)
- [CVE-2025-26695](https://cve.now/CVE-2025-26695.md): Downloading of OpenPGP keys from WKD used incorrect padding (CVSS 5.3, Mozilla Thunderbird)
- [CVE-2025-26696](https://cve.now/CVE-2025-26696.md): Crafted email message incorrectly shown as being encrypted (CVSS 7.0, Mozilla Thunderbird)
- [CVE-2025-27136](https://cve.now/CVE-2025-27136.md): LocalS3 CreateBucketConfiguration Endpoint XML External Entity (XXE) Injection (CVSS 5.5, Robothy local-s3 · io.github.robothy:local-s3-rest)
- [CVE-2024-56188](https://cve.now/CVE-2024-56188.md): there is a possible way to crash the modem due to a missing null check. (CVSS 5.1, Google Android)
- [CVE-2024-56187](https://cve.now/CVE-2024-56187.md): In ppcfw\_deny\_sec\_dram\_access of ppcfw.c, there is a possible arbitrary read from TEE memory due to a logic error in the code. (CVSS 6.6, Google Android)
- [CVE-2024-56186](https://cve.now/CVE-2024-56186.md): In closeChannel of secureelementimpl.cpp, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 5.1, Google Android)
- [CVE-2024-56185](https://cve.now/CVE-2024-56185.md): In ProtocolUnsolOnSSAdapter::GetServiceClass() of protocolcalladapter.cpp, there is a possible out-of-bounds read due to a missing bounds ch (CVSS 5.1, Google Android)
- [CVE-2024-56184](https://cve.now/CVE-2024-56184.md): In static long dev\_send of tipc\_dev\_ql, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 5.1, Google Android)
- [CVE-2025-25306](https://cve.now/CVE-2025-25306.md): Misskey's Incomplete Patch of CVE-2024-52591 Leads to Forgery of Federated Notes (CVSS 9.3, misskey-dev misskey)
- [CVE-2025-22603](https://cve.now/CVE-2025-22603.md): AutoGPT SSRF vulnerability (CVSS 7.7, Significant-Gravitas AutoGPT)
- [CVE-2025-1296](https://cve.now/CVE-2025-1296.md): Nomad Exposes Sensitive Workload Identity and Client Secret Token in Audit Logs (CVSS 6.5, HashiCorp Nomad · github.com/hashicorp/nomad)
- [CVE-2024-52812](https://cve.now/CVE-2024-52812.md): LF Edge eKuiper has Stored XSS in Rules Functionality (CVSS 5.4, lf-edge ekuiper · github.com/lf-edge/ekuiper +1)
- [CVE-2025-24813](https://cve.now/CVE-2025-24813.md): Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVSS 10.0, KEV, Apache Software Foundation Apache Tomcat · org.apache.to… +1)
- [CVE-2024-52905](https://cve.now/CVE-2024-52905.md): IBM Sterling B2B Integrator information disclosure (CVSS 2.7, IBM Sterling B2B Integrator Standard Edition)
- [CVE-2024-47109](https://cve.now/CVE-2024-47109.md): IBM Sterling File Gateway information disclosure (CVSS 5.3, IBM Sterling File Gateway)
- [CVE-2025-26916](https://cve.now/CVE-2025-26916.md): WordPress Massive Dynamic theme \<= 8.2 - Unauthenticated Local File Inclusion vulnerability (CVSS 9.0, Pixflow Massive Dynamic)
- [CVE-2025-26910](https://cve.now/CVE-2025-26910.md): WordPress WPBookit plugin \<= 1.0.1 - Cross Site Request Forgery (CSRF) Vulnerability (CVSS 7.1, Iqonic Design WPBookit)
- [CVE-2025-26936](https://cve.now/CVE-2025-26936.md): WordPress Fresh Framework plugin \<= 1.70.0 - Unauthenticated Remote Code Execution (RCE) vulnerability (CVSS 10.0, FRESHFACE Fresh Framework)
- [CVE-2025-26933](https://cve.now/CVE-2025-26933.md): WordPress Place Order Without Payment for WooCommerce plugin \<= 2.6.7 - Local File Inclusion vulnerability (CVSS 7.5, Nitin Prakash WC Place Order Without Payment)
- [CVE-2024-12604](https://cve.now/CVE-2024-12604.md): Improper Authentication in Tapandsign Technologies Tap and Sign App (CVSS 6.5, Tapandsign Technologies Tap&Sign App)
- [CVE-2025-26865](https://cve.now/CVE-2025-26865.md): Apache OFBiz: Server-Side Template Injection affecting the ecommerce plugin leading to possible RCE (CVSS 3.5, Apache Software Foundation Apache OFBiz)
- [CVE-2025-2153](https://cve.now/CVE-2025-2153.md): HDF5 h5 File H5SM.c H5SM\_delete heap-based overflow (CVSS 2.3, HDF5)
- [CVE-2025-1497](https://cve.now/CVE-2025-1497.md): Remote Code Execution in PlotAI (CVSS 9.3, MLJAR PlotAI · plotai)
- [CVE-2025-2152](https://cve.now/CVE-2025-2152.md): Open Asset Import Library Assimp File BaseImporter.cpp ConvertToUTF8 heap-based overflow (CVSS 5.3, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-2151](https://cve.now/CVE-2025-2151.md): Open Asset Import Library Assimp File ParsingUtils.h GetNextLine stack-based overflow (CVSS 5.3, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-2149](https://cve.now/CVE-2025-2149.md): PyTorch Quantized Sigmoid Module nnq\_Sigmoid initialization (CVSS 2.0, PyTorch · torch)
- [CVE-2025-2148](https://cve.now/CVE-2025-2148.md): PyTorch Tuple torch.ops.profiler.\_call\_end\_callbacks\_on\_jit\_fut memory corruption (CVSS 2.3, PyTorch · torch)
- [CVE-2025-1945](https://cve.now/CVE-2025-1945.md): picklescan - Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch (CVSS 5.3, mmaitre314 picklescan · picklescan)
- [CVE-2025-1944](https://cve.now/CVE-2025-1944.md): picklescan ZIP archive manipulation attack leads to crash (CVSS 5.3, mmaitre314 picklescan · picklescan)
- [CVE-2025-2147](https://cve.now/CVE-2025-2147.md): Beijing Zhide Intelligent Internet Technology Modern Farm Digital Integrated Management System file access (CVSS 6.9, Beijing Zhide Intelligent Internet Technology Modern Farm D…)
- [CVE-2024-13919](https://cve.now/CVE-2024-13919.md): Laravel Reflected XSS via Route Parameter in Debug-Mode Error Page (CVSS 8.0, Laravel Holdings Laravel Framework · laravel/framework)
- [CVE-2024-13918](https://cve.now/CVE-2024-13918.md): Laravel Reflected XSS via Request Parameter in Debug-Mode Error Page (CVSS 8.0, Laravel Holdings Laravel Framework · laravel/framework)
- [CVE-2025-24387](https://cve.now/CVE-2025-24387.md): Missing CSRF protection (CVSS 4.8, OTRS AG OTRS)
- [CVE-2025-27257](https://cve.now/CVE-2025-27257.md): Insufficient Verification of Data Authenticity vulnerability in GE Vernova UR IED family devices allows an authenticated user to install a m (CVSS 6.1, GE Vernova N60 multilin · GE Vernova B30 Multilin +17)
- [CVE-2025-27256](https://cve.now/CVE-2025-27256.md): Missing Authentication for Critical Function vulnerability in GE Vernova Enervista UR Setup application allows Authentication Bypass due to (CVSS 8.3, GE Vernova EnerVista UR Setup)
- [CVE-2025-27255](https://cve.now/CVE-2025-27255.md): Use of Hard-coded Credentials vulnerability in GE Vernova EnerVista UR Setup allows Privilege Escalation. (CVSS 8.0, GE Vernova EnerVista UR Setup)
- [CVE-2025-27254](https://cve.now/CVE-2025-27254.md): CWE-282 "Improper Ownership Management" in GE Vernova EnerVista UR Setup allows Authentication Bypass. (CVSS 8.0, GE Vernova EnerVista UR Setup)
- [CVE-2025-27253](https://cve.now/CVE-2025-27253.md): A CWE-15 "External Control of System or Configuration Setting" in GE Vernova UR IED family devices from version 7.0 up to 8.60 allows an att (CVSS 6.1, GE Vernova N60 multilin · GE Vernova B30 Multilin +17)
- [CVE-2025-2150](https://cve.now/CVE-2025-2150.md): HGiga C&Cm@il - Stored Cross-Site Scripting (CVSS 5.4, HGiga C&Cm@il)
- [CVE-2024-11638](https://cve.now/CVE-2024-11638.md): Gtbabel \< 6.6.9 - Unauthenticated Admin Account Takeover (CVSS 8.8, Gtbabel)
- [CVE-2025-1926](https://cve.now/CVE-2025-1926.md): Page Builder: Pagelayer – Drag and Drop website builder \<= 1.9.8 - Cross-Site Request Forgery (CSRF) To Post Contents Modification (CVSS 4.3, softaculous Page Builder: Pagelayer – Drag and Drop website…)
- [CVE-2024-41724](https://cve.now/CVE-2024-41724.md): Improper Certificate Validation (CWE-295) in the Gallagher Command Centre SALTO integration allowed an attacker to spoof the SALTO server. (CVSS 8.7, Gallagher Command Centre Server)
- [CVE-2024-43107](https://cve.now/CVE-2024-43107.md): Improper Certificate Validation (CWE-295) in the Gallagher Milestone Integration Plugin (MIP) permits unauthenticated messages (e.g. (CVSS 7.2, Gallagher Milestone Integration Plugin)
- [CVE-2024-53307](https://cve.now/CVE-2024-53307.md): A reflected cross-site scripting (XSS) vulnerability in the /mw/ endpoint of Evisions MAPS v6.10.2.267 allows attackers to execute arbitrary (CVSS 5.4)
- [CVE-2024-55199](https://cve.now/CVE-2024-55199.md): A Stored Cross Site Scripting (XSS) vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to store JavaScript code (CVSS 5.4)
- [CVE-2024-57492](https://cve.now/CVE-2024-57492.md): An issue in redoxOS relibc before commit 98aa4ea5 allows a local attacker to cause a denial of service via the round\_up\_to\_page funciton. (CVSS 6.0)
- [CVE-2025-25382](https://cve.now/CVE-2025-25382.md): An issue in the Property Tax Payment Portal in Information Kerala Mission SANCHAYA v3.0.4 allows attackers to arbitrarily modify payment amo (CVSS 7.5)
- [CVE-2025-25614](https://cve.now/CVE-2025-25614.md): Incorrect Access Control in Unifiedtransform 2.0 leads to Privilege Escalation, which allows teachers to update the personal data of fellow (CVSS 8.8)
- [CVE-2025-25615](https://cve.now/CVE-2025-25615.md): Unifiedtransform 2.0 is vulnerable to Incorrect Access Control which allows viewing attendance list for all class sections. (CVSS 6.0)
- [CVE-2025-25616](https://cve.now/CVE-2025-25616.md): Unifiedtransform 2.0 is vulnerable to Incorrect Access Control, which allows students to modify rules for exams. (CVSS 7.6)
- [CVE-2025-25620](https://cve.now/CVE-2025-25620.md): Unifiedtransform 2.0 is vulnerable to Cross Site Scripting (XSS) in the Create assignment function. (CVSS 5.4)
- [CVE-2025-25907](https://cve.now/CVE-2025-25907.md): tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/save. (CVSS 8.8)
- [CVE-2025-25908](https://cve.now/CVE-2025-25908.md): A stored cross-site scripting (XSS) vulnerability in tianti v2.3 allows attackers to execute arbitrary web scripts or HTML via injecting a c (CVSS 5.4)
- [CVE-2025-25940](https://cve.now/CVE-2025-25940.md): VisiCut 2.1 allows code execution via Insecure XML Deserialization in the loadPlfFile method of VisicutModel.java. (CVSS 9.8)
- [CVE-2025-25977](https://cve.now/CVE-2025-25977.md): An issue in canvg v.4.0.2 allows an attacker to execute arbitrary code via the Constructor of the class StyleElement. (CVSS 9.8, canvg)
- [CVE-2025-27910](https://cve.now/CVE-2025-27910.md): tianti v2.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /user/ajax/upd/status. (CVSS 8.0)
- [CVE-2025-27913](https://cve.now/CVE-2025-27913.md): Passbolt API before 5, if the server is misconfigured (with an incorrect installation process and disregarding of Health Check results), can (CVSS 2.1, Passbolt API)
- [CVE-2025-27924](https://cve.now/CVE-2025-27924.md): Nintex Automation 5.6 and 5.7 before 5.8 has a stored XSS issue associated with the "Navigate to a URL" action. (CVSS 5.4, Nintex Automation)
- [CVE-2025-27925](https://cve.now/CVE-2025-27925.md): Nintex Automation 5.6 and 5.7 before 5.8 has insecure deserialization of user input. (CVSS 8.5, Nintex Automation)
- [CVE-2025-27926](https://cve.now/CVE-2025-27926.md): In Nintex Automation 5.6 and 5.7 before 5.8, the K2 SmartForms Designer folder has configuration files (web.config) containing passwords tha (CVSS 4.3, Nintex Automation)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.