# CVEs published 2025-03-11

332 CVEs were published on March 11, 2025: 7 critical, 166 high. 10 are now in CISA KEV. Days are UTC.

- [CVE-2025-2215](https://cve.now/CVE-2025-2215.md): Doufox s=doudou path traversal (CVSS 5.1, Doufox)
- [CVE-2025-2214](https://cve.now/CVE-2025-2214.md): Microweber Settings index.php cross site scripting (CVSS 5.1, Microweber · microweber/microweber)
- [CVE-2025-2213](https://cve.now/CVE-2025-2213.md): Castlenet CBW383G2N Wireless Menu wlanPrimaryNetwork.asp cross site scripting (CVSS 4.8, Castlenet CBW383G2N)
- [CVE-2025-2212](https://cve.now/CVE-2025-2212.md): Castlenet CBW383G2N RgSwInfo.asp cross site scripting (CVSS 4.8, Castlenet CBW383G2N)
- [CVE-2025-2233](https://cve.now/CVE-2025-2233.md): Samsung SmartThings Improper Verification of Cryptographic Signature Authentication Bypass Vulnerability (CVSS 8.8, Samsung SmartThings)
- [CVE-2025-2211](https://cve.now/CVE-2025-2211.md): aitangbao springboot-manager add cross site scripting (CVSS 4.8, aitangbao springboot-manager)
- [CVE-2025-2210](https://cve.now/CVE-2025-2210.md): aitangbao springboot-manager add cross site scripting (CVSS 4.8, aitangbao springboot-manager)
- [CVE-2025-27792](https://cve.now/CVE-2025-27792.md): Opal vulnerable to CSRF protection bypass (CVSS 7.7, obiba opal)
- [CVE-2025-27101](https://cve.now/CVE-2025-27101.md): Broken Access Control in Opal filesystem's copy functionality exposes all user data (CVSS 7.3, obiba opal)
- [CVE-2025-2209](https://cve.now/CVE-2025-2209.md): aitangbao springboot-manager add cross site scripting (CVSS 4.8, aitangbao springboot-manager)
- [CVE-2025-1707](https://cve.now/CVE-2025-1707.md): Review Schema \<= 2.2.4 - Authenticated (Contributor+) Local File Inclusion via Post Meta (CVSS 8.8, techlabpro1 Review Schema – Review & Structure Data Schema…)
- [CVE-2025-28868](https://cve.now/CVE-2025-28868.md): WordPress ZipList Recipe plugin \<= 3.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, ZipList Recipe)
- [CVE-2025-28943](https://cve.now/CVE-2025-28943.md): WordPress DP ALTerminator - Missing ALT manager Plugin \<= 1.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, mylo2h2s DP ALTerminator - Missing ALT manager)
- [CVE-2025-28941](https://cve.now/CVE-2025-28941.md): WordPress SPAM-BYBYE Plugin \<= 2.2.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, ohtan Spam Byebye)
- [CVE-2025-28940](https://cve.now/CVE-2025-28940.md): WordPress Back To Top Plugin \<= 2.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, arkapravamajumder Back To Top)
- [CVE-2025-28938](https://cve.now/CVE-2025-28938.md): WordPress WP Performance Pack plugin \<= 2.5.3 - Broken Access Control vulnerability (CVSS 4.3, Bjoern WP Performance Pack)
- [CVE-2025-28937](https://cve.now/CVE-2025-28937.md): WordPress Lava Ajax Search plugin \<= 1.1.9 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, lavacode Lava Ajax Search)
- [CVE-2025-28936](https://cve.now/CVE-2025-28936.md): WordPress Lunar plugin \<= 1.3.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, sakurapixel Lunar)
- [CVE-2025-28933](https://cve.now/CVE-2025-28933.md): WordPress MaxA/B plugin \<= 2.2.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, maxfoundry MaxA/B)
- [CVE-2025-28932](https://cve.now/CVE-2025-28932.md): WordPress Insert Code plugin \<= 2.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, BCS Website Solutions Insert Code)
- [CVE-2025-28931](https://cve.now/CVE-2025-28931.md): WordPress WordPress Hashtags plugin \<= 0.3.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, DevriX Hashtags)
- [CVE-2025-28930](https://cve.now/CVE-2025-28930.md): WordPress List Mixcloud plugin \<= 1.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Rodolphe MOULIN List Mixcloud)
- [CVE-2025-28929](https://cve.now/CVE-2025-28929.md): WordPress Tabbed Login Widget plugin \<= 1.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Vivek Marakana Tabbed Login Widget)
- [CVE-2025-28927](https://cve.now/CVE-2025-28927.md): WordPress Display Template Name plugin \<= 1.7.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, A. Chappard Display Template Name)
- [CVE-2025-28926](https://cve.now/CVE-2025-28926.md): WordPress Post Read Time plugin \<= 1.2.6 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 5.9, popeating Post Read Time)
- [CVE-2025-28925](https://cve.now/CVE-2025-28925.md): WordPress WATI Chat and Notification plugin \<= 1.1.2 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Hieu Nguyen WATI Chat and Notification)
- [CVE-2025-28923](https://cve.now/CVE-2025-28923.md): WordPress No Disposable Email plugin \<= 2.5.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, philippe No Disposable Email)
- [CVE-2025-28922](https://cve.now/CVE-2025-28922.md): WordPress Go To Top plugin \<= 0.0.8 - CSRF to Stored XSS vulnerability (CVSS 7.1, Terence D. Go To Top)
- [CVE-2025-28920](https://cve.now/CVE-2025-28920.md): WordPress Responsive Google Map plugin \<= 3.1.5 - Broken Access Control vulnerability (CVSS 5.3, Jogesh Responsive Google Map)
- [CVE-2025-28919](https://cve.now/CVE-2025-28919.md): WordPress Easy Image Display plugin \<= 1.2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Shellbot Easy Image Display)
- [CVE-2025-28918](https://cve.now/CVE-2025-28918.md): WordPress Featured Image Thumbnail Grid plugin \<= 6.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, A. Jones Featured Image Thumbnail Grid)
- [CVE-2025-28915](https://cve.now/CVE-2025-28915.md): WordPress ThemeEgg ToolKit plugin \<= 1.2.9 - Arbitrary File Upload vulnerability (CVSS 9.1, Theme Egg ThemeEgg ToolKit)
- [CVE-2025-28914](https://cve.now/CVE-2025-28914.md): WordPress wordpress login form to anywhere plugin \<= 0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Ajay Sharma wordpress login form to anywhere)
- [CVE-2025-28913](https://cve.now/CVE-2025-28913.md): WordPress WP Add Active Class To Menu Item plugin \<=1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Aftab Ali Muni WP Add Active Class To Menu Item)
- [CVE-2025-28912](https://cve.now/CVE-2025-28912.md): WordPress Custom Dashboard Page plugin \<= 1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Muntasir Rahman Custom Dashboard Page)
- [CVE-2025-28910](https://cve.now/CVE-2025-28910.md): WordPress WP Hide Admin Bar plugin \<= 2.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Ravinder Khurana WP Hide Admin Bar)
- [CVE-2025-28909](https://cve.now/CVE-2025-28909.md): WordPress WP No-Bot Question plugin \<= 0.1.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, edwardw WP No-Bot Question)
- [CVE-2025-28908](https://cve.now/CVE-2025-28908.md): WordPress pipDisqus plugin \<= 1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, pipdig pipDisqus)
- [CVE-2025-28907](https://cve.now/CVE-2025-28907.md): WordPress WP Last Modified plugin \<= 0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Rahul Arora WP Last Modified)
- [CVE-2025-28906](https://cve.now/CVE-2025-28906.md): WordPress Skitter Slideshow plugin \<= 2.5.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Thiago S.F. Skitter Slideshow)
- [CVE-2025-28905](https://cve.now/CVE-2025-28905.md): WordPress Featured Posts Grid plugin \<= 1.7 - CSRF to Stored XSS vulnerability (CVSS 7.1, Chaser324 Featured Posts Grid)
- [CVE-2025-28902](https://cve.now/CVE-2025-28902.md): WordPress Contact Form 7 Select Box Editor Button plugin \<= 0.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Benjamin Pick Contact Form 7 Select Box Editor Button)
- [CVE-2025-28901](https://cve.now/CVE-2025-28901.md): WordPress Members page only for logged in users plugin \<= 1.4.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, Naren Members page only for logged in users)
- [CVE-2025-28900](https://cve.now/CVE-2025-28900.md): WordPress TabGarb Pro plugin \<= 2.6 - CSRF to Stored XSS vulnerability (CVSS 7.1, webgarb TabGarb Pro)
- [CVE-2025-28897](https://cve.now/CVE-2025-28897.md): WordPress Domain Theme plugin \<= 1.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, Steveorevo Domain Theme)
- [CVE-2025-28896](https://cve.now/CVE-2025-28896.md): WordPress AS English Admin plugin \<= 1.0.0 - Open Redirection vulnerability (CVSS 4.7, Akshar Soft Solutions AS English Admin)
- [CVE-2025-28895](https://cve.now/CVE-2025-28895.md): WordPress Custom top bar plugin \<= 2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, Suman Biswas Custom top bar)
- [CVE-2025-28894](https://cve.now/CVE-2025-28894.md): WordPress List of Posts from each Category plugin for WordPress plugin \<= 2.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, frucomerci List of Posts from each Category plugin for Word…)
- [CVE-2025-28892](https://cve.now/CVE-2025-28892.md): WordPress FTP Sync plugin \<= 1.1.6 - CSRF to Stored XSS vulnerability (CVSS 7.1, a2rocklobster FTP Sync)
- [CVE-2025-28891](https://cve.now/CVE-2025-28891.md): WordPress price-calc plugin \<= 0.6.3 - CSRF to Stored XSS vulnerability (CVSS 7.1, jazzigor price-calc)
- [CVE-2025-28887](https://cve.now/CVE-2025-28887.md): WordPress Plugins Last Updated Column plugin \<= 0.1.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Fastmover Plugins Last Updated Column)
- [CVE-2025-28886](https://cve.now/CVE-2025-28886.md): WordPress REST API TO MiniProgram plugin \<= 5.1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, xjb REST API TO MiniProgram)
- [CVE-2025-28884](https://cve.now/CVE-2025-28884.md): WordPress WP Bulk Post Duplicator plugin \<= 1.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Rajesh Kumar WP Bulk Post Duplicator)
- [CVE-2025-28883](https://cve.now/CVE-2025-28883.md): WordPress WP Compare Tables plugin \<= 1.0.5 - CSRF to Stored XSS vulnerability (CVSS 7.1, Martin WP Compare Tables)
- [CVE-2025-28881](https://cve.now/CVE-2025-28881.md): WordPress Mobile Themes plugin \<= 1.1.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, mg12 Mobile Themes)
- [CVE-2025-28879](https://cve.now/CVE-2025-28879.md): WordPress Bee Layer Slider plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, aumsrini Bee Layer Slider)
- [CVE-2025-28878](https://cve.now/CVE-2025-28878.md): WordPress Awesome Surveys plugin \<= 2.0.10 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Will Brubaker Awesome Surveys)
- [CVE-2025-28876](https://cve.now/CVE-2025-28876.md): WordPress Skrill Official plugin \<= 1.0.66 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Skrill\_Team Skrill Official)
- [CVE-2025-28875](https://cve.now/CVE-2025-28875.md): WordPress BP Email Assign Templates By shanebp plugin \<= 1.6 - Cross-Site Scripting vulnerability (CVSS 5.9, shanebp BP Email Assign Templates)
- [CVE-2025-28874](https://cve.now/CVE-2025-28874.md): WordPress BP Email Assign Templates By shanebp plugin \<= 1.7 - Arbitrary Content Deletion vulnerability (CVSS 6.5, shanebp BP Email Assign Templates)
- [CVE-2025-28872](https://cve.now/CVE-2025-28872.md): WordPress Block Spam By Math Reloaded plugin \<= 2.2.4 - Broken Access Control vulnerability (CVSS 5.3, jwpegram Block Spam By Math Reloaded)
- [CVE-2025-28871](https://cve.now/CVE-2025-28871.md): WordPress Block Spam By Math Reloaded plugin \<= 2.2.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, jwpegram Block Spam By Math Reloaded)
- [CVE-2025-28870](https://cve.now/CVE-2025-28870.md): WordPress amoCRM WebForm plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, amoCRM WebForm)
- [CVE-2025-28867](https://cve.now/CVE-2025-28867.md): WordPress Frontpage category filter plugin \<= 1.0.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, stesvis Frontpage category filter)
- [CVE-2025-28866](https://cve.now/CVE-2025-28866.md): WordPress Login Logger plugin \<= 1.2.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, smerriman Login Logger)
- [CVE-2025-28864](https://cve.now/CVE-2025-28864.md): WordPress Builder for Contact Form 7 by Webconstruct plugin \<= 1.2.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, planetstudio Builder for Contact Form 7 by Webconstruct)
- [CVE-2025-28863](https://cve.now/CVE-2025-28863.md): WordPress Delete Original Image plugin \<= 0.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Carlos Minatti Delete Original Image)
- [CVE-2025-28862](https://cve.now/CVE-2025-28862.md): WordPress Comment Date and Gravatar remover plugin \<= 1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Venugopal Comment Date and Gravatar remover)
- [CVE-2025-28861](https://cve.now/CVE-2025-28861.md): WordPress WP jQuery Persian Datepicker plugin \<= 0.1.0 - CSRF to Stored XSS vulnerability (CVSS 7.1, bhzad WP jQuery Persian Datepicker)
- [CVE-2025-28860](https://cve.now/CVE-2025-28860.md): WordPress Google News Editors Picks Feed Generator plugin \<= 2.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, PPDPurveyor Google News Editors Picks Feed Generator)
- [CVE-2025-28859](https://cve.now/CVE-2025-28859.md): WordPress Maintenance Notice plugin \<= 1.0.6 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, CodeVibrant Maintenance Notice)
- [CVE-2025-28857](https://cve.now/CVE-2025-28857.md): WordPress Rankchecker.io Integration plugin \<= 1.0.9 - CSRF to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Rankchecker.io Integration)
- [CVE-2025-28856](https://cve.now/CVE-2025-28856.md): WordPress W3Counter Free Real-Time Web Stats plugin \<= 4.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, dangrossman W3Counter Free Real-Time Web Stats)
- [CVE-2025-0900](https://cve.now/CVE-2025-0900.md): PDF-XChange Editor PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, PDF-XChange Editor)
- [CVE-2025-2023](https://cve.now/CVE-2025-2023.md): Ashlar-Vellum Cobalt LI File Parsing Integer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-2022](https://cve.now/CVE-2025-2022.md): Ashlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-2021](https://cve.now/CVE-2025-2021.md): Ashlar-Vellum Cobalt XE File Parsing Integer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-2020](https://cve.now/CVE-2025-2020.md): Ashlar-Vellum Cobalt VC6 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-2019](https://cve.now/CVE-2025-2019.md): Ashlar-Vellum Cobalt VC6 File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-2018](https://cve.now/CVE-2025-2018.md): Ashlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-2017](https://cve.now/CVE-2025-2017.md): Ashlar-Vellum Cobalt CO File Parsing Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-2016](https://cve.now/CVE-2025-2016.md): Ashlar-Vellum Cobalt VC6 File Parsing Type Confusion Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-2015](https://cve.now/CVE-2025-2015.md): Ashlar-Vellum Cobalt VS File Parsing Type Confusion Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-2014](https://cve.now/CVE-2025-2014.md): Ashlar-Vellum Cobalt VS File Parsing Use of Uninitialized Variable Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-2013](https://cve.now/CVE-2025-2013.md): Ashlar-Vellum Cobalt CO File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-2012](https://cve.now/CVE-2025-2012.md): Ashlar-Vellum Cobalt VS File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Ashlar-Vellum Cobalt)
- [CVE-2025-2208](https://cve.now/CVE-2025-2208.md): aitangbao springboot-manager Filename upload cross site scripting (CVSS 4.8, aitangbao springboot-manager)
- [CVE-2025-21170](https://cve.now/CVE-2025-21170.md): Substance3D - Modeler | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe Substance3D - Modeler)
- [CVE-2025-27181](https://cve.now/CVE-2025-27181.md): Substance3D - Modeler | Use After Free (CWE-416) (CVSS 7.8, Adobe Substance3D - Modeler)
- [CVE-2025-27180](https://cve.now/CVE-2025-27180.md): Substance3D - Modeler | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Substance3D - Modeler)
- [CVE-2025-27173](https://cve.now/CVE-2025-27173.md): Substance3D - Modeler | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Substance3D - Modeler)
- [CVE-2025-2207](https://cve.now/CVE-2025-2207.md): aitangbao springboot-manager dept cross site scripting (CVSS 4.8, aitangbao springboot-manager)
- [CVE-2025-2206](https://cve.now/CVE-2025-2206.md): aitangbao springboot-manager permission cross site scripting (CVSS 4.8, aitangbao springboot-manager)
- [CVE-2025-23360](https://cve.now/CVE-2025-23360.md): NVIDIA Nemo Framework contains a vulnerability where a user could cause a relative path traversal issue by arbitrary file write. (CVSS 7.1, NVIDIA NeMo Framework)
- [CVE-2025-23243](https://cve.now/CVE-2025-23243.md): NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. (CVSS 6.5, NVIDIA Riva)
- [CVE-2025-23242](https://cve.now/CVE-2025-23242.md): NVIDIA Riva contains a vulnerability where a user could cause an improper access control issue. (CVSS 7.3, NVIDIA Riva)
- [CVE-2025-27789](https://cve.now/CVE-2025-27789.md): Inefficient RexExp complexity in generated code with .replace when transpiling named capturing groups (CVSS 6.2, babel · @babel/helpers +3)
- [CVE-2025-27773](https://cve.now/CVE-2025-27773.md): SimpleSAMLphp SAML2 library has incorrect signature verification for HTTP-Redirect binding (CVSS 8.6, simplesamlphp saml2 · simplesamlphp/saml2 +1)
- [CVE-2025-27591](https://cve.now/CVE-2025-27591.md): A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/ (CVSS 6.8, Meta Platforms below · below)
- [CVE-2025-24431](https://cve.now/CVE-2025-24431.md): Acrobat Reader | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2025-27158](https://cve.now/CVE-2025-27158.md): Acrobat Reader | Access of Uninitialized Pointer (CWE-824) (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2025-27161](https://cve.now/CVE-2025-27161.md): Acrobat Reader | Out-of-bounds Read (CWE-125) (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2025-27164](https://cve.now/CVE-2025-27164.md): Acrobat Reader | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2025-27174](https://cve.now/CVE-2025-27174.md): Acrobat Reader | Use After Free (CWE-416) (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2025-27162](https://cve.now/CVE-2025-27162.md): Acrobat Reader | Access of Uninitialized Pointer (CWE-824) (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2025-27160](https://cve.now/CVE-2025-27160.md): Acrobat Reader | Use After Free (CWE-416) (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2025-27159](https://cve.now/CVE-2025-27159.md): Acrobat Reader | Use After Free (CWE-416) (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2025-27163](https://cve.now/CVE-2025-27163.md): Acrobat Reader | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2025-24201](https://cve.now/CVE-2025-24201.md): An out-of-bounds write issue was addressed with improved checks to prevent unauthorized actions. (CVSS 10.0, KEV, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2025-27169](https://cve.now/CVE-2025-27169.md): Illustrator | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Illustrator)
- [CVE-2025-27167](https://cve.now/CVE-2025-27167.md): Illustrator | Untrusted Search Path (CWE-426) (CVSS 7.8, Adobe Illustrator)
- [CVE-2025-27170](https://cve.now/CVE-2025-27170.md): Illustrator | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe Illustrator)
- [CVE-2025-27168](https://cve.now/CVE-2025-27168.md): Illustrator | Stack-based Buffer Overflow (CWE-121) (CVSS 7.8, Adobe Illustrator)
- [CVE-2025-24449](https://cve.now/CVE-2025-24449.md): Illustrator | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Illustrator)
- [CVE-2025-24448](https://cve.now/CVE-2025-24448.md): Illustrator | Out-of-bounds Read (CWE-125) (CVSS 5.5, Adobe Illustrator)
- [CVE-2025-27166](https://cve.now/CVE-2025-27166.md): InDesign Desktop | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2025-27175](https://cve.now/CVE-2025-27175.md): InDesign Desktop | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2025-27177](https://cve.now/CVE-2025-27177.md): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2025-27178](https://cve.now/CVE-2025-27178.md): InDesign Desktop | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2025-27176](https://cve.now/CVE-2025-27176.md): InDesign Desktop | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2025-24453](https://cve.now/CVE-2025-24453.md): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2025-24452](https://cve.now/CVE-2025-24452.md): InDesign Desktop | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2025-27171](https://cve.now/CVE-2025-27171.md): InDesign Desktop | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe InDesign Desktop)
- [CVE-2025-27179](https://cve.now/CVE-2025-27179.md): InDesign Desktop | NULL Pointer Dereference (CWE-476) (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2025-24444](https://cve.now/CVE-2025-24444.md): Substance3D - Sampler | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Sampler)
- [CVE-2025-24443](https://cve.now/CVE-2025-24443.md): Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Substance3D - Sampler)
- [CVE-2025-24441](https://cve.now/CVE-2025-24441.md): Substance3D - Sampler | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Sampler)
- [CVE-2025-24445](https://cve.now/CVE-2025-24445.md): Substance3D - Sampler | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Sampler)
- [CVE-2025-24442](https://cve.now/CVE-2025-24442.md): Substance3D - Sampler | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Sampler)
- [CVE-2025-24439](https://cve.now/CVE-2025-24439.md): Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Substance3D - Sampler)
- [CVE-2025-24440](https://cve.now/CVE-2025-24440.md): Substance3D - Sampler | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Sampler)
- [CVE-2025-24451](https://cve.now/CVE-2025-24451.md): Substance3D - Painter | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2025-24450](https://cve.now/CVE-2025-24450.md): Substance3D - Painter | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2025-27440](https://cve.now/CVE-2025-27440.md): Zoom Apps - Heap-based Buffer Overflow (CVSS 8.5, Zoom Communications Zoom Workplace Apps)
- [CVE-2025-27439](https://cve.now/CVE-2025-27439.md): Zoom Apps - Buffer Underflow (CVSS 8.5, Zoom Communications Zoom Workplace Apps)
- [CVE-2025-0151](https://cve.now/CVE-2025-0151.md): Zoom Apps - Use After Free (CVSS 8.5, Zoom Communications Zoom Workplace Apps)
- [CVE-2025-0150](https://cve.now/CVE-2025-0150.md): Zoom Workplace Apps for iOS - Incorrect Behavior Order (CVSS 7.1, Zoom Communications Zoom Workplace Apps for iOS)
- [CVE-2025-0149](https://cve.now/CVE-2025-0149.md): Zoom Apps - Insufficient Verification of Data Authenticity (CVSS 6.5, Zoom Communications Zoom Apps)
- [CVE-2025-26645](https://cve.now/CVE-2025-26645.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Remote Desktop client for Windows Desktop · Micro…)
- [CVE-2025-26633](https://cve.now/CVE-2025-26633.md): Microsoft Management Console Security Feature Bypass Vulnerability (CVSS 7.0, KEV, Microsoft Windows)
- [CVE-2025-26631](https://cve.now/CVE-2025-26631.md): Visual Studio Code Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Visual Studio Code)
- [CVE-2025-26630](https://cve.now/CVE-2025-26630.md): Microsoft Access Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Access +1)
- [CVE-2025-26629](https://cve.now/CVE-2025-26629.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office LTSC)
- [CVE-2025-26627](https://cve.now/CVE-2025-26627.md): Azure Arc Installer Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Azure ARC)
- [CVE-2025-24049](https://cve.now/CVE-2025-24049.md): Azure Command Line Integration (CLI) Elevation of Privilege Vulnerability (CVSS 8.4, Microsoft Azure CLI)
- [CVE-2025-24994](https://cve.now/CVE-2025-24994.md): Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2025-24993](https://cve.now/CVE-2025-24993.md): Windows NTFS Remote Code Execution Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2025-24992](https://cve.now/CVE-2025-24992.md): Windows NTFS Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2025-24991](https://cve.now/CVE-2025-24991.md): Windows NTFS Information Disclosure Vulnerability (CVSS 5.5, KEV, Microsoft Windows)
- [CVE-2025-24985](https://cve.now/CVE-2025-24985.md): Windows Fast FAT File System Driver Remote Code Execution Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2025-24984](https://cve.now/CVE-2025-24984.md): Windows NTFS Information Disclosure Vulnerability (CVSS 4.6, KEV, Microsoft Windows)
- [CVE-2025-24983](https://cve.now/CVE-2025-24983.md): Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability (CVSS 7.0, KEV, Microsoft Windows)
- [CVE-2025-24084](https://cve.now/CVE-2025-24084.md): Windows Subsystem for Linux (WSL2) Kernel Remote Code Execution Vulnerability (CVSS 8.4, Microsoft Windows)
- [CVE-2025-24076](https://cve.now/CVE-2025-24076.md): Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2025-24075](https://cve.now/CVE-2025-24075.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-24072](https://cve.now/CVE-2025-24072.md): Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-24071](https://cve.now/CVE-2025-24071.md): Microsoft Windows File Explorer Spoofing Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-24067](https://cve.now/CVE-2025-24067.md): Kernel Streaming Service Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-24066](https://cve.now/CVE-2025-24066.md): Kernel Streaming Service Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-24064](https://cve.now/CVE-2025-24064.md): Windows Domain Name Service Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows Server 2008 R2 Service Pack · Microsof… +1)
- [CVE-2025-24061](https://cve.now/CVE-2025-24061.md): Windows Mark of the Web Security Feature Bypass Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-24059](https://cve.now/CVE-2025-24059.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-24056](https://cve.now/CVE-2025-24056.md): Windows Telephony Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-24055](https://cve.now/CVE-2025-24055.md): Windows USB Video Class System Driver Information Disclosure Vulnerability (CVSS 4.3, Microsoft Windows)
- [CVE-2025-24054](https://cve.now/CVE-2025-24054.md): NTLM Hash Disclosure Spoofing Vulnerability (CVSS 6.5, KEV, Microsoft Windows)
- [CVE-2025-24051](https://cve.now/CVE-2025-24051.md): Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2025-24050](https://cve.now/CVE-2025-24050.md): Windows Hyper-V Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-24048](https://cve.now/CVE-2025-24048.md): Windows Hyper-V Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-24046](https://cve.now/CVE-2025-24046.md): Kernel Streaming Service Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-24045](https://cve.now/CVE-2025-24045.md): Windows Remote Desktop Services Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows Server)
- [CVE-2025-21199](https://cve.now/CVE-2025-21199.md): Azure Agent Installer for Backup and Site Recovery Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Azure Agent for Backup · Microsoft Azure Agent fo…)
- [CVE-2025-21247](https://cve.now/CVE-2025-21247.md): MapUrlToZone Security Feature Bypass Vulnerability (CVSS 4.3, Microsoft Windows)
- [CVE-2025-25008](https://cve.now/CVE-2025-25008.md): Windows Server Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Windows Server)
- [CVE-2025-25003](https://cve.now/CVE-2025-25003.md): Visual Studio Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Visual Studio)
- [CVE-2025-24998](https://cve.now/CVE-2025-24998.md): Visual Studio Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Visual Studio)
- [CVE-2025-24997](https://cve.now/CVE-2025-24997.md): DirectX Graphics Kernel File Denial of Service Vulnerability (CVSS 4.4, Microsoft Windows)
- [CVE-2025-24996](https://cve.now/CVE-2025-24996.md): NTLM Hash Disclosure Spoofing Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2025-24995](https://cve.now/CVE-2025-24995.md): Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-21180](https://cve.now/CVE-2025-21180.md): Windows exFAT File System Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-24988](https://cve.now/CVE-2025-24988.md): Windows USB Video Class System Driver Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows)
- [CVE-2025-24987](https://cve.now/CVE-2025-24987.md): Windows USB Video Class System Driver Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Windows)
- [CVE-2025-24986](https://cve.now/CVE-2025-24986.md): Azure Promptflow Remote Code Execution Vulnerability (CVSS 6.5, Microsoft Azure promptflow-core · Microsoft Azure prompt… +2)
- [CVE-2025-24083](https://cve.now/CVE-2025-24083.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-24082](https://cve.now/CVE-2025-24082.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-24081](https://cve.now/CVE-2025-24081.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Excel +1)
- [CVE-2025-24080](https://cve.now/CVE-2025-24080.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-24079](https://cve.now/CVE-2025-24079.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2025-24078](https://cve.now/CVE-2025-24078.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.0, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2025-24077](https://cve.now/CVE-2025-24077.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office LTSC)
- [CVE-2025-24070](https://cve.now/CVE-2025-24070.md): ASP.NET Core and Visual Studio Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft ASP.NET Core · Microsoft Visual Studio +13)
- [CVE-2025-24057](https://cve.now/CVE-2025-24057.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2025-24043](https://cve.now/CVE-2025-24043.md): WinDbg Remote Code Execution Vulnerability (CVSS 7.5, Microsoft WinDbg · dotnet-sos +2)
- [CVE-2025-24044](https://cve.now/CVE-2025-24044.md): Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2025-24035](https://cve.now/CVE-2025-24035.md): Windows Remote Desktop Services Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2025-26634](https://cve.now/CVE-2025-26634.md): Windows Core Messaging Elevation of Privileges Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-9157](https://cve.now/CVE-2024-9157.md): Privilege Escalation Vulnerability in CxUIUSvc service (CVSS 7.8, Synaptics Audio Driver)
- [CVE-2024-56338](https://cve.now/CVE-2024-56338.md): IBM Sterling B2B Integrator cross-site scripting (CVSS 4.8, IBM Sterling B2B Integrator Standard Edition)
- [CVE-2025-21169](https://cve.now/CVE-2025-21169.md): Substance3D - Designer | Heap-based Buffer Overflow (CWE-122) (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2025-27172](https://cve.now/CVE-2025-27172.md): Substance3D - Designer | Out-of-bounds Write (CWE-787) (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2025-22213](https://cve.now/CVE-2025-22213.md): \[20250301\] - Core - Malicious file uploads via Media Manager (CVSS 7.1, Joomla! Project Joomla! CMS)
- [CVE-2025-27617](https://cve.now/CVE-2025-27617.md): Pimcore Vulnerable to SQL Injection in getRelationFilterCondition (CVSS 6.3, pimcore · pimcore/pimcore)
- [CVE-2025-27602](https://cve.now/CVE-2025-27602.md): Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content (CVSS 4.9, Umbraco-CMS · Umbraco.Cms.Web.Backoffice)
- [CVE-2025-27601](https://cve.now/CVE-2025-27601.md): Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality (CVSS 4.3, Umbraco-CMS · Umbraco.Cms.Api.Management)
- [CVE-2024-33501](https://cve.now/CVE-2024-33501.md): Two improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability \[CWE-89\] in Fortinet FortiAnalyzer ve (CVSS 4.0, Fortinet FortiManager)
- [CVE-2024-54026](https://cve.now/CVE-2024-54026.md): An improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiSandbox 4.4.0 through 4.4.6, FortiS (CVSS 4.1, Fortinet FortiSandbox)
- [CVE-2024-32123](https://cve.now/CVE-2024-32123.md): Multiple improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager, FortiAnalyzer (CVSS 6.5, Fortinet FortiManager · Fortinet FortiAnalyzer)
- [CVE-2024-54018](https://cve.now/CVE-2024-54018.md): Multiple improper neutralization of special elements used in an OS Command vulnerabilities \[CWE-78\] in FortiSandbox before 4.4.5 allows a pr (CVSS 6.5, Fortinet FortiSandbox)
- [CVE-2023-37933](https://cve.now/CVE-2023-37933.md): An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability \[CWE-79\] in FortiADC GUI version 7.4.0 (CVSS 8.6, Fortinet FortiADC)
- [CVE-2024-52960](https://cve.now/CVE-2024-52960.md): A client-side enforcement of server-side security vulnerability \[CWE-602\] in Fortinet FortiSandbox version 5.0.0, 4.4.0 through 4.4.6 and be (CVSS 4.2, Fortinet FortiSandbox)
- [CVE-2024-55590](https://cve.now/CVE-2024-55590.md): Multiple improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerabilities \[CWE-78\] in Fortinet For (CVSS 8.6, Fortinet FortiIsolator)
- [CVE-2024-45324](https://cve.now/CVE-2024-45324.md): A use of externally-controlled format string vulnerability \[CWE-134\] in FortiOS version 7.4.0 through 7.4.4, version 7.2.0 through 7.2.9, ve (CVSS 7.0, Fortinet FortiPAM · Fortinet FortiWeb +3)
- [CVE-2024-46663](https://cve.now/CVE-2024-46663.md): A stack-buffer overflow vulnerability \[CWE-121\] in Fortinet FortiMail CLI version 7.6.0 through 7.6.1 and before 7.4.3 allows a privileged a (CVSS 6.5, Fortinet FortiMail)
- [CVE-2023-48790](https://cve.now/CVE-2023-48790.md): A cross site request forgery vulnerability \[CWE-352\] in Fortinet FortiNDR version 7.4.0, 7.2.0 through 7.2.1 and 7.1.0 through 7.1.1 and bef (CVSS 7.1, Fortinet FortiNDR)
- [CVE-2024-52961](https://cve.now/CVE-2024-52961.md): An improper neutralization of special elements used in an OS Command vulnerability \[CWE-78\] vulnerability in Fortinet FortiSandbox 5.0.0, Fo (CVSS 8.6, Fortinet FortiSandbox)
- [CVE-2024-55592](https://cve.now/CVE-2024-55592.md): An incorrect authorization vulnerability \[CWE-863\] in FortiSIEM 7.2 all versions, 7.1 all versions, 7.0 all versions, 6.7 all versions, 6.6 (CVSS 3.6, Fortinet FortiSIEM)
- [CVE-2023-42784](https://cve.now/CVE-2023-42784.md): An improper handling of syntactically invalid structure in Fortinet FortiWeb at least verions 7.4.0 through 7.4.6 and 7.2.0 through 7.2.10 a (CVSS 5.5, Fortinet FortiWeb)
- [CVE-2024-45328](https://cve.now/CVE-2024-45328.md): An incorrect authorization vulnerability \[CWE-863\] in FortiSandbox 4.4.0 through 4.4.6 may allow a low priviledged administrator to execute (CVSS 7.1, Fortinet FortiSandbox)
- [CVE-2023-40723](https://cve.now/CVE-2023-40723.md): An exposure of sensitive information to an unauthorized actor in Fortinet FortiSIEM version 6.7.0 through 6.7.4 and 6.6.0 through 6.6.3 and (CVSS 7.7, Fortinet FortiSIEM)
- [CVE-2024-55597](https://cve.now/CVE-2024-55597.md): A improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet FortiWeb versions 7.0.0 through 7.6.0 allows at (CVSS 5.2, Fortinet FortiWeb)
- [CVE-2025-27403](https://cve.now/CVE-2025-27403.md): Ratify Azure authentication providers can leak authentication tokens to non-Azure container registries (CVSS 7.2, ratify-project ratify · github.com/ratify-project/ratify +1)
- [CVE-2025-22454](https://cve.now/CVE-2025-22454.md): Insufficiently restrictive permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their (CVSS 7.8, Ivanti Secure Access Client)
- [CVE-2024-54084](https://cve.now/CVE-2024-54084.md): SMM Arbitrary Write via TOCTOU Vulnerability (CVSS 7.5, AMI AptioV)
- [CVE-2024-54085](https://cve.now/CVE-2024-54085.md): Redfish Authentication Bypass (CVSS 10.0, KEV, AMI MegaRAC-SPx)
- [CVE-2025-2196](https://cve.now/CVE-2025-2196.md): MRCMS org.marker.mushroom.controller.FileController upload.do upload cross site scripting (CVSS 5.1, MRCMS)
- [CVE-2025-22369](https://cve.now/CVE-2025-22369.md): Mennekes smart/premium charges systems, Arbitrary file download using ReadFile endpoint (CVSS 7.1, Mennekes Smart / Premium charging stations)
- [CVE-2025-22366](https://cve.now/CVE-2025-22366.md): Mennekes smart/premium charges systems, Command injection in firmware upgrade (CVSS 8.7, Mennekes Smart / Premium charging stations)
- [CVE-2025-22370](https://cve.now/CVE-2025-22370.md): Mennekes smart/premium charges systems, SQL Injection in web configuration interface (CVSS 5.3, Mennekes Smart / Premium charging stations)
- [CVE-2025-22368](https://cve.now/CVE-2025-22368.md): Mennekes smart/premium charges systems, Command injection in sCU firmware update (CVSS 8.7, Mennekes Smart / Premium charging stations)
- [CVE-2025-22367](https://cve.now/CVE-2025-22367.md): Mennekes smart/premium charges systems, Command injection in time setting (CVSS 8.7, Mennekes Smart / Premium charging stations)
- [CVE-2025-2195](https://cve.now/CVE-2025-2195.md): MRCMS org.marker.mushroom.controller.FileController rename.do rename cross site scripting (CVSS 5.1, MRCMS)
- [CVE-2025-2194](https://cve.now/CVE-2025-2194.md): MRCMS org.marker.mushroom.controller.FileController list.do list cross site scripting (CVSS 5.1, MRCMS)
- [CVE-2025-27363](https://cve.now/CVE-2025-27363.md): An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse (CVSS 8.1, KEV, FreeType)
- [CVE-2025-2193](https://cve.now/CVE-2025-2193.md): MRCMS org.marker.mushroom.controller.FileController delete.do delete path traversal (CVSS 5.3, MRCMS)
- [CVE-2025-2192](https://cve.now/CVE-2025-2192.md): Stoque Zeev.it Login Page server-side request forgery (CVSS 5.3, Stoque Zeev.it)
- [CVE-2025-2191](https://cve.now/CVE-2025-2191.md): Claro A7600-A1 Ping6 Diagnóstico form2pingv6.cgi cross site scripting (CVSS 4.8, Claro A7600-A1)
- [CVE-2025-2189](https://cve.now/CVE-2025-2189.md): Information Disclosure Vulnerability in Tinxy Smart Devices (CVSS 5.1, Mogify Infotech Tinxy Wi-Fi Lock Controller v1 RF · Mogi… +4)
- [CVE-2025-27494](https://cve.now/CVE-2025-27494.md): A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions \< V6.4.9), SiPass integrated ACC-AP (All versions \< V (CVSS 9.1, Siemens SiPass integrated AC5102 · Siemens SiPass integrate…)
- [CVE-2025-27493](https://cve.now/CVE-2025-27493.md): A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions \< V6.4.9), SiPass integrated ACC-AP (All versions \< V (CVSS 8.2, Siemens SiPass integrated AC5102 · Siemens SiPass integrate…)
- [CVE-2025-27438](https://cve.now/CVE-2025-27438.md): A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions \< V14.3.0.13), Teamcenter Visualization V2312 (All versi (CVSS 7.8, Siemens Teamcenter Visualization · Siemens Tecnomatix Plant…)
- [CVE-2025-27398](https://cve.now/CVE-2025-27398.md): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions \< V4.0). (CVSS 2.7, Siemens SCALANCE LPE9403)
- [CVE-2025-27397](https://cve.now/CVE-2025-27397.md): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions \< V4.0). (CVSS 3.8, Siemens SCALANCE LPE9403)
- [CVE-2025-27396](https://cve.now/CVE-2025-27396.md): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions \< V4.0). (CVSS 8.8, Siemens SCALANCE LPE9403)
- [CVE-2025-27395](https://cve.now/CVE-2025-27395.md): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions \< V4.0). (CVSS 7.2, Siemens SCALANCE LPE9403)
- [CVE-2025-27394](https://cve.now/CVE-2025-27394.md): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions \< V4.0). (CVSS 7.2, Siemens SCALANCE LPE9403)
- [CVE-2025-27393](https://cve.now/CVE-2025-27393.md): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions \< V4.0). (CVSS 7.2, Siemens SCALANCE LPE9403)
- [CVE-2025-27392](https://cve.now/CVE-2025-27392.md): A vulnerability has been identified in SCALANCE LPE9403 (6GK5998-3GS00-2AC2) (All versions \< V4.0). (CVSS 7.2, Siemens SCALANCE LPE9403)
- [CVE-2025-25267](https://cve.now/CVE-2025-25267.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions \< V2302.0021), Tecnomatix Plant Simulation V2404 (All (CVSS 6.2, Siemens Tecnomatix Plant Simulation)
- [CVE-2025-25266](https://cve.now/CVE-2025-25266.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2302 (All versions \< V2302.0021), Tecnomatix Plant Simulation V2404 (All (CVSS 6.8, Siemens Tecnomatix Plant Simulation)
- [CVE-2025-23402](https://cve.now/CVE-2025-23402.md): A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions \< V14.3.0.13), Teamcenter Visualization V2312 (All versi (CVSS 7.8, Siemens Teamcenter Visualization · Siemens Tecnomatix Plant…)
- [CVE-2025-23401](https://cve.now/CVE-2025-23401.md): A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions \< V14.3.0.13), Teamcenter Visualization V2312 (All versi (CVSS 7.8, Siemens Teamcenter Visualization · Siemens Tecnomatix Plant…)
- [CVE-2025-23400](https://cve.now/CVE-2025-23400.md): A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions \< V14.3.0.13), Teamcenter Visualization V2312 (All versi (CVSS 7.8, Siemens Teamcenter Visualization · Siemens Tecnomatix Plant…)
- [CVE-2025-23399](https://cve.now/CVE-2025-23399.md): A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions \< V14.3.0.13), Teamcenter Visualization V2312 (All versi (CVSS 7.8, Siemens Teamcenter Visualization · Siemens Tecnomatix Plant…)
- [CVE-2025-23398](https://cve.now/CVE-2025-23398.md): A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions \< V14.3.0.13), Teamcenter Visualization V2312 (All versi (CVSS 7.8, Siemens Teamcenter Visualization · Siemens Tecnomatix Plant…)
- [CVE-2025-23397](https://cve.now/CVE-2025-23397.md): A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions \< V14.3.0.13), Teamcenter Visualization V2312 (All versi (CVSS 7.8, Siemens Teamcenter Visualization · Siemens Tecnomatix Plant…)
- [CVE-2025-23396](https://cve.now/CVE-2025-23396.md): A vulnerability has been identified in Teamcenter Visualization V14.3 (All versions \< V14.3.0.13), Teamcenter Visualization V2312 (All versi (CVSS 7.8, Siemens Teamcenter Visualization · Siemens Tecnomatix Plant…)
- [CVE-2025-23384](https://cve.now/CVE-2025-23384.md): A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions \< V8.2.1), RUGGEDCOM RM1224 LTE(4G) NA (CVSS 3.7, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +19)
- [CVE-2024-56336](https://cve.now/CVE-2024-56336.md): A vulnerability has been identified in SINAMICS S200 (All versions with serial number beginning with SZVS8, SZVS9, SZVS0 or SZVSN and the FS (CVSS 9.8, Siemens SINAMICS S200)
- [CVE-2024-56182](https://cve.now/CVE-2024-56182.md): A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC Field PG M6 (All versions \< V26.01.12), SIMATIC IPC BX-21 (CVSS 8.2, Siemens SIMATIC Field PG M5 · Siemens SIMATIC Field PG… +28)
- [CVE-2024-56181](https://cve.now/CVE-2024-56181.md): A vulnerability has been identified in SIMATIC Field PG M5 (All versions), SIMATIC IPC BX-21A (All versions \< V31.01.07), SIMATIC IPC BX-32A (CVSS 8.2, Siemens SIMATIC Field PG M5 · Siemens SIMATIC IPC BX-21A +27)
- [CVE-2024-52285](https://cve.now/CVE-2024-52285.md): A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions \< V6.4.8), SiPass integrated ACC-AP (All versions \< V (CVSS 5.3, Siemens SiPass integrated AC5102 · Siemens SiPass integrate…)
- [CVE-2025-1550](https://cve.now/CVE-2025-1550.md): Arbitrary Code Execution via Crafted Keras Config for Model Loading (CVSS 7.3, Google Keras · keras)
- [CVE-2025-2177](https://cve.now/CVE-2025-2177.md): libzvbi search.c vbi\_search\_new integer overflow (CVSS 6.9, libzvbi)
- [CVE-2025-2176](https://cve.now/CVE-2025-2176.md): libzvbi io-sim.c vbi\_capture\_sim\_load\_caption integer overflow (CVSS 6.9, libzvbi)
- [CVE-2025-1434](https://cve.now/CVE-2025-1434.md): XSS in AREAL SAS Topkapi Vision Webserv2 (CVSS 6.1, AREAL SAS Topkapi Vision Webserv2)
- [CVE-2025-2190](https://cve.now/CVE-2025-2190.md): The mobile application (com.transsnet.store) has a man-in-the-middle attack vulnerability, which may lead to code injection risks. (CVSS 8.1, TECNO com.transsnet.store)
- [CVE-2024-13228](https://cve.now/CVE-2024-13228.md): Qubely – Advanced Gutenberg Blocks \<= 1.8.13 - Authenticated (Contributor+) Sensitive Information Exposure via qubely\_get\_content (CVSS 4.3, themeum Qubely – Advanced Gutenberg Blocks)
- [CVE-2025-26702](https://cve.now/CVE-2025-26702.md): Improper Input Validation vulnerability in ZTE GoldenDB allows Input Data Manipulation.This issue affects GoldenDB: from 6.1.03 through 6.1. (CVSS 4.9, ZTE GoldenDB)
- [CVE-2025-2175](https://cve.now/CVE-2025-2175.md): libzvbi \_vbi\_strndup\_iconv integer overflow (CVSS 5.3, libzvbi)
- [CVE-2025-26703](https://cve.now/CVE-2025-26703.md): Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1 (CVSS 4.3, ZTE GoldenDB)
- [CVE-2025-26704](https://cve.now/CVE-2025-26704.md): Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1 (CVSS 6.4, ZTE GoldenDB)
- [CVE-2025-26705](https://cve.now/CVE-2025-26705.md): Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1 (CVSS 5.3, ZTE GoldenDB)
- [CVE-2025-26706](https://cve.now/CVE-2025-26706.md): Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1 (CVSS 5.4, ZTE GoldenDB)
- [CVE-2025-2174](https://cve.now/CVE-2025-2174.md): libzvbi conv.c vbi\_strndup\_iconv\_ucs2 integer overflow (CVSS 6.9, libzvbi)
- [CVE-2025-2173](https://cve.now/CVE-2025-2173.md): libzvbi conv.c vbi\_strndup\_iconv\_ucs2 uninitialized pointer (CVSS 6.9, libzvbi)
- [CVE-2025-0629](https://cve.now/CVE-2025-0629.md): Coronavirus (COVID-19) Notice Message \<= 1.1.2 - Admin+ Stored XSS (CVSS 4.8, Coronavirus (COVID-19) Notice Message)
- [CVE-2024-13864](https://cve.now/CVE-2024-13864.md): Countdown Timer \<= 1.0 - Reflected XSS (CVSS 7.1, Countdown Timer)
- [CVE-2024-13862](https://cve.now/CVE-2024-13862.md): S3Bubble Media Streaming \<= 8.0 - Reflected XSS (CVSS 7.1, S3Bubble Media Streaming)
- [CVE-2024-13853](https://cve.now/CVE-2024-13853.md): SEO Tools \<= 4.0.7 - Reflected XSS (CVSS 6.1, SEO Tools)
- [CVE-2024-13836](https://cve.now/CVE-2024-13836.md): WP Login Control \<= 2.0.0 - Reflected XSS (CVSS 7.1, WP Login Control)
- [CVE-2024-13615](https://cve.now/CVE-2024-13615.md): Social Media Plugin by Social Snap \<= 1.3.6 - Admin+ Stored XSS (CVSS 3.5, Social Share Buttons, Social Sharing Icons, Click to Tweet…)
- [CVE-2024-13580](https://cve.now/CVE-2024-13580.md): XV Random Quotes \<= 1.40 - Settings Reset via CSRF (CVSS 4.3, XV Random Quotes)
- [CVE-2024-13574](https://cve.now/CVE-2024-13574.md): XV Random Quotes \<= 1.40 - Reflected XSS (CVSS 7.1, XV Random Quotes)
- [CVE-2024-13413](https://cve.now/CVE-2024-13413.md): ProductDyno \<= 1.0.24 - Reflected Cross-Site Scripting via 'res' Parameter (CVSS 6.1, frazahmed ProductDyno)
- [CVE-2024-13436](https://cve.now/CVE-2024-13436.md): Appsero Helper \<= 1.3.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, wedevs Appsero Helper)
- [CVE-2025-2169](https://cve.now/CVE-2025-2169.md): WPCS – WordPress Currency Switcher Professional \<= 1.2.0.4 - Unauthenticated Arbitrary Shortcode Execution (CVSS 7.3, realmag777 WPCS – WordPress Currency Switcher Professional)
- [CVE-2025-1661](https://cve.now/CVE-2025-1661.md): HUSKY – Products Filter Professional for WooCommerce \<= 1.3.6.5 - Unauthenticated Local File Inclusion (CVSS 9.8, realmag777 HUSKY – Products Filter Professional for WooComm…)
- [CVE-2025-26707](https://cve.now/CVE-2025-26707.md): Improper Privilege Management vulnerability in ZTE GoldenDB allows Privilege Escalation.This issue affects GoldenDB: from 6.1.03 through 6.1 (CVSS 5.3, ZTE GoldenDB)
- [CVE-2024-12010](https://cve.now/CVE-2024-12010.md): A post-authentication command injection vulnerability in the ”zyUtilMailSend” function of the Zyxel AX7501-B1 firmware version V5.17(ABPC.5. (CVSS 7.2, Zyxel AX7501-B1 firmware)
- [CVE-2024-12009](https://cve.now/CVE-2024-12009.md): A post-authentication command injection vulnerability in the "ZyEE" function of the Zyxel EX5601-T1 firmware version V5.70(ACDZ.3.6)C0 and e (CVSS 7.2, Zyxel EX5601-T1 firmware)
- [CVE-2024-11253](https://cve.now/CVE-2024-11253.md): A post-authentication command injection vulnerability in the "DNSServer” parameter of the diagnostic function in the Zyxel VMG8825-T50K firm (CVSS 7.2, Zyxel VMG8825-T50K firmware)
- [CVE-2024-22340](https://cve.now/CVE-2024-22340.md): IBM Common Cryptographic Architecture information disclosure (CVSS 6.5, IBM Common Cryptographic Architecture · IBM 4769 Developers…)
- [CVE-2024-41760](https://cve.now/CVE-2024-41760.md): IBM Common Cryptographic Architecture information disclosure (CVSS 3.7, IBM Common Cryptographic Architecture · IBM 4769 Developers…)
- [CVE-2024-49823](https://cve.now/CVE-2024-49823.md): IBM Common Cryptographic Architecture denial of service (CVSS 6.5, IBM Common Cryptographic Architecture · IBM 4769 Developers…)
- [CVE-2025-27436](https://cve.now/CVE-2025-27436.md): Broken Access Control vulnerabilities in SAP S/4HANA (Manage Bank Statements) (CVSS 4.3, SAP\_SE SAP S/4HANA)
- [CVE-2025-27434](https://cve.now/CVE-2025-27434.md): Cross-Site Scripting (XSS) vulnerability in SAP Commerce (Swagger UI) (CVSS 8.8, SAP\_SE SAP Commerce)
- [CVE-2025-27433](https://cve.now/CVE-2025-27433.md): Broken Access Control vulnerabilities in SAP S/4HANA (Manage Bank Statements) (CVSS 4.3, SAP\_SE SAP S/4HANA)
- [CVE-2025-27432](https://cve.now/CVE-2025-27432.md): Missing Authorization check in SAP Electronic Invoicing for Brazil (eDocument Cockpit) (CVSS 2.4, SAP\_SE SAP Electronic Invoicing for Brazil)
- [CVE-2025-27431](https://cve.now/CVE-2025-27431.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java (CVSS 5.4, SAP\_SE SAP NetWeaver Application Server Java)
- [CVE-2025-27430](https://cve.now/CVE-2025-27430.md): Server Side Request Forgery (SSRF) in SAP CRM and SAP S/4 HANA (Interaction Center) (CVSS 3.5, SAP\_SE SAP CRM and SAP S/4HANA)
- [CVE-2025-26661](https://cve.now/CVE-2025-26661.md): Missing Authorization check in SAP NetWeaver (ABAP Class Builder) (CVSS 8.8, SAP\_SE SAP NetWeaver)
- [CVE-2025-26660](https://cve.now/CVE-2025-26660.md): Broken Access Control in SAP Fiori apps (Posting Library) (CVSS 4.3, SAP\_SE SAP Fiori apps)
- [CVE-2025-26659](https://cve.now/CVE-2025-26659.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) (CVSS 6.1, SAP\_SE SAP NetWeaver Application Server ABAP)
- [CVE-2025-26658](https://cve.now/CVE-2025-26658.md): Broken Authentication in SAP Business One (Service Layer) (CVSS 6.8, SAP\_SE SAP Business One)
- [CVE-2025-26656](https://cve.now/CVE-2025-26656.md): Missing Authorization check in S/4HANA (Manage Purchasing Info Records) (CVSS 4.3, SAP\_SE S/4HANA)
- [CVE-2025-26655](https://cve.now/CVE-2025-26655.md): Missing Authorization check in SAP JIT(Outbound) (CVSS 3.1, SAP\_SE SAP Just In Time)
- [CVE-2025-25245](https://cve.now/CVE-2025-25245.md): Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence) (CVSS 5.4, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2025-25244](https://cve.now/CVE-2025-25244.md): Missing Authorization Check in SAP Business Warehouse (Process Chains) (CVSS 5.7, SAP\_SE SAP Business Warehouse)
- [CVE-2025-25242](https://cve.now/CVE-2025-25242.md): Cross-Site Scripting (XSS) in SAP NetWeaver Application Server ABAP (CVSS 6.1, SAP\_SE SAP NetWeaver Application Server ABAP)
- [CVE-2025-23194](https://cve.now/CVE-2025-23194.md): Missing Authentication check in SAP NetWeaver Enterprise Portal (OBN component) (CVSS 5.3, SAP\_SE SAP NetWeaver Enterprise Portal)
- [CVE-2025-23188](https://cve.now/CVE-2025-23188.md): Missing Authorization check in SAP S/4HANA (RBD) (CVSS 4.3, SAP\_SE SAP S/4HANA)
- [CVE-2025-23185](https://cve.now/CVE-2025-23185.md): Information Disclosure in SAP Business Objects Business Intelligence Platform (CVSS 4.1, SAP\_SE SAP Business Objects Business Intelligence Platform)
- [CVE-2025-0071](https://cve.now/CVE-2025-0071.md): Information Disclosure vulnerability in SAP Web Dispatcher and Internet Communication Manager (CVSS 4.9, SAP\_SE SAP Web Dispatcher and Internet Communication Manager)
- [CVE-2025-0062](https://cve.now/CVE-2025-0062.md): Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence) (CVSS 4.7, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2021-37787](https://cve.now/CVE-2021-37787.md): The unprivileged administrative interface in ABO.CMS version 5.8 through v.5.9.3 is affected by a SQL Injection vulnerability via a HTTP POS (CVSS 6.5)
- [CVE-2024-28607](https://cve.now/CVE-2024-28607.md): The ip-utils package through 2.4.0 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as glo (CVSS 2.9, librasean IP-Utils)
- [CVE-2024-51319](https://cve.now/CVE-2024-51319.md): A local file include vulnerability in the /servlet/Report of Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remot (CVSS 7.3)
- [CVE-2024-51320](https://cve.now/CVE-2024-51320.md): Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via th (CVSS 5.4)
- [CVE-2024-51321](https://cve.now/CVE-2024-51321.md): In Zucchetti Ad Hoc Infinity 2.4, an improper check on the m\_cURL parameter allows an attacker to redirect the victim to an attacker-control (CVSS 7.6)
- [CVE-2024-51322](https://cve.now/CVE-2024-51322.md): Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via th (CVSS 5.4)
- [CVE-2024-58102](https://cve.now/CVE-2024-58102.md): An issue was discovered in Datalust Seq before 2024.3.13545. (CVSS 5.7, Datalust Seq)
- [CVE-2025-25680](https://cve.now/CVE-2025-25680.md): LSC Smart Connect LSC Indoor PTZ Camera 7.6.32 is contains a RCE vulnerability in the tuya\_ipc\_direct\_connect function of the anyka\_ipc proc (CVSS 7.7)
- [CVE-2025-25747](https://cve.now/CVE-2025-25747.md): Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive info (CVSS 5.4)
- [CVE-2025-25748](https://cve.now/CVE-2025-25748.md): A CSRF vulnerability in the gestione\_utenti.php endpoint of HotelDruid 3.0.7 allows attackers to perform unauthorized actions (e.g., modifyi (CVSS 7.3)
- [CVE-2025-25749](https://cve.now/CVE-2025-25749.md): An issue in HotelDruid version 3.0.7 and earlier allows users to set weak passwords due to the lack of enforcement of password strength poli (CVSS 7.1)
- [CVE-2025-25925](https://cve.now/CVE-2025-25925.md): A stored cross-scripting (XSS) vulnerability in Openmrs v2.4.3 Build 0ff0ed allows attackers to execute arbitrary web scripts or HTML via in (CVSS 4.8)
- [CVE-2025-25927](https://cve.now/CVE-2025-25927.md): A Cross-Site Request Forgery (CSRF) in Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitrary operations via a crafted GET request (CVSS 6.8)
- [CVE-2025-25928](https://cve.now/CVE-2025-25928.md): A Cross-Site Request Forgery (CSRF) in the component /admin/users/user.form of Openmrs 2.4.3 Build 0ff0ed allows attackers to execute arbitr (CVSS 8.0)
- [CVE-2025-25929](https://cve.now/CVE-2025-25929.md): A reflected cross-site scripting (XSS) vulnerability in the component /legacyui/quickReportServlet of Openmrs 2.4.3 Build 0ff0ed allows atta (CVSS 5.4)
- [CVE-2025-26701](https://cve.now/CVE-2025-26701.md): An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. (CVSS 10.0, Percona Monitoring and Management)
- [CVE-2025-27893](https://cve.now/CVE-2025-27893.md): In Archer Platform 6 through 6.14.00202.10024, an authenticated user with record creation privileges can manipulate immutable fields, such a (CVSS 1.8, Archer)
- [CVE-2025-27911](https://cve.now/CVE-2025-27911.md): An issue was discovered in Datalust Seq before 2024.3.13545. (CVSS 6.5, Datalust Seq)
- [CVE-2025-27912](https://cve.now/CVE-2025-27912.md): An issue was discovered in Datalust Seq before 2024.3.13545. (CVSS 8.8, Datalust Seq)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.