CVEs published March 12, 2025
101 CVEs were published on March 12, 2025: 13 critical, 28 high. 2 are now in CISA KEV.
- Published
- 101
- Critical
- 13
- High
- 28
- Medium
- 55
- Low
- 3
- Unrated
- 2
- Now in CISA KEV
- 2
- Fix available
- 41
Most affected products
- Linux
- 26
- Cisco IOS XR Software
- 10
- Bitdefender BOX
- 3
- Palo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1
- 3
- SAML-Toolkits ruby-saml · ruby-saml
- 3
- LoveCardsV2
- 2
- OpenText™ Service Manager
- 2
- Palo Alto Networks GlobalProtect App · Palo Alto Networks G…
- 2
- zzskzy Warehouse Refinement Management System
- 2
- 1E Client
- 1
Critical 13
- CVE-2025-25292Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)SAML-Toolkits ruby-saml · ruby-saml
- CVE-2025-25291ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)SAML-Toolkits ruby-saml · ruby-saml
- CVE-2025-27407Remote code execution when loading a crafted GraphQL schemarmosolgo graphql-ruby · graphql
- CVE-2025-1960CWE-1188: Initialization of a Resource with an Insecure Default vulnerability exists that could cause an attacker to execute unauthorized coSchneider Electric WebHMI – Deployed with EcoStruxure Power…
- CVE-2024-13871Unauthenticated Command Injection in Bitdefender BOX v1Bitdefender BOX
- CVE-2024-13872Bitdefender Box Insecure Update Mechanism Vulnerability in libboxhermes.soBitdefender BOX
- CVE-2025-21850nvmet: Fix crash when a namespace is disabledLinux
- CVE-2024-13446Workreap <= 3.2.5 - Unauthenticated Privilege Escalation via Account TakeoverAmentoTech Workreap
- CVE-2024-58087ksmbd: fix racy issue from session lookup and expireLinux
- CVE-2025-22954GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11.02 allows SQL Injection in /serials/lateissues-export.pl via the supplierid or Koha
- CVE-2025-25565SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in the Command.c file via the PtMakeCert and PtMakeCert2048 functions.
- CVE-2025-25567SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in Internat.c via the UniToStrForSingleChars function.
- CVE-2025-25568SoftEtherVPN 5.02.5187 is vulnerable to Use after Free in the Command.c file via the CheckNetworkAcceptThread function.
High 28
- CVE-2025-25293ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responsesSAML-Toolkits ruby-saml · ruby-saml
- CVE-2024-26290Authenticated Remote Command Injection affecting Avid NEXISAvid NEXIS E-series · Avid NEXIS F-series +2
- CVE-2025-0117GlobalProtect App: Local Privilege Escalation (PE) VulnerabilityPalo Alto Networks GlobalProtect App · Palo Alto Networks G…
- CVE-2025-0114PAN-OS: Denial of Service (DoS) in GlobalProtectPalo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1
- CVE-2025-20209Cisco IOS XR Software Internet Key Exchange Version 2 Denial of Service VulnerabilityCisco IOS XR Software
- CVE-2025-20146Cisco IOS XR Software for ASR 9000 Series Routers Layer 3 Multicast Routing Denial of Service VulnerabilityCisco IOS XR Software
- CVE-2025-20142Cisco IOS XR Software for ASR 9000 Series Routers L2VPN Denial of Service VulnerabilityCisco IOS XR Software
- CVE-2025-20141Cisco IOS XR Software Release 7.9.2 Denial of Service VulnerabillityCisco IOS XR Software
- CVE-2025-20138Cisco IOS XR Software CLI Privilege Escalation VulnerabilityCisco IOS XR Software
- CVE-2025-20115Cisco IOS XR Software Border Gateway Protocol Denial of Service VulnerabilityCisco IOS XR Software
- CVE-2025-0813CWE-287: Improper Authentication vulnerability exists that could cause an Authentication Bypass when an unauthorized user without permissionSchneider Electric EcoStruxure Power Automation System User…
- CVE-2025-1683Symbolic Link Exploit in 1E Client's - Nomad module allows Arbitrary File Deletion1E Client
- CVE-2025-0884Privilege Escalation vulnerability has been discovered in OpenText™ Service Manager.OpenText™ Service Manager
- CVE-2025-2240Smallrye-fault-tolerance: smallrye fault tolerancesmallrye-fault-tolerance-core · Red Hat build of Apache… +7
- CVE-2025-27788Ruby JSON Parser has Out-of-bounds Readruby json · json
- CVE-2024-10838Integer Underflow in DDS_Security_Deserialize_ methods may lead to OOB readEclipse Foundation Eclipse Cyclone DDS
- CVE-2025-21864tcp: drop secpath at the same time as we currently drop dstLinux
- CVE-2025-21863io_uring: prevent opcode speculationLinux
- CVE-2025-21858geneve: Fix use-after-free in geneve_find_dev().Linux
- CVE-2025-21856s390/ism: add release function for struct deviceLinux
- CVE-2025-21855ibmvnic: Don't reference skb after sending to VIOSLinux
- CVE-2025-21851bpf: Fix softlockup in arena_map_free on 64k page kernelLinux
- CVE-2025-21844smb: client: Add check for next_buffer in receive_encrypted_standard()Linux
- CVE-2024-58089btrfs: fix double accounting race when btrfs_run_delalloc_range() failedLinux
- CVE-2025-25709An issue in dtp.ae tNexus Airport View v.2.8 allows a remote attacker to escalate privileges via the addUser and updateUser endpoints
- CVE-2025-25711An issue in dtp.ae tNexus Airport View v.2.8 allows a remote attacker to escalate privileges via the ProfileID value to the [/tnexus/rest/ad
- CVE-2025-25975An issue in parse-git-config v.3.0.0 allows an attacker to obtain sensitive information via the expandKeys functionparse-git-config
- CVE-2025-26260Plenti <= 0.7.16 is vulnerable to code execution.github.com/plentico/plenti
Medium, low and unrated 60
- CVE-2025-0118GlobalProtect App: Execution of Unsafe ActiveX Control VulnerabilityPalo Alto Networks GlobalProtect App · Palo Alto Networks G…
- CVE-2025-0116PAN-OS: Firewall Denial of Service (DoS) Using a Specially Crafted LLDP FramePalo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1
- CVE-2025-0115PAN-OS: Authenticated Admin File Read Vulnerability in PAN-OS CLIPalo Alto Networks PAN-OS · Palo Alto Networks Cloud NGFW +1
- CVE-2025-22870HTTP Proxy bypass using IPv6 Zone IDs in golang.org/x/netGo standard library net/http · golang.org/x/net/http/htt… +3
- CVE-2025-27017Apache NiFi: Potential Insertion of MongoDB Password in Provenance RecordApache Software Foundation Apache NiFi · org.apache.nifi:ni…
- CVE-2025-20177Cisco IOS XR Software Image Verification Bypass VulnerabilityCisco IOS XR Software
- CVE-2025-20145Cisco IOS XR Software Access Control List Bypass VulnerabilityCisco IOS XR Software
- CVE-2025-20144Cisco IOS XR Software Access Control List Bypass VulnerabilityCisco IOS XR Software
- CVE-2025-20143Cisco IOS XR Software Secure Boot Bypass VulnerabilityCisco IOS XR Software
- CVE-2025-27867Apache Felix HTTP Webconsole Plugin: XSS in HTTP Webconsole PluginApache Software Foundation Apache Felix HTTP Webconsole Plu…
- CVE-2025-1984Local Privilege Escalation on Xerox® Desktop Print Experience® v8.5Xerox® Desktop Print Experience
- CVE-2025-2002CWE-532: Insertion of Sensitive Information into Log Files vulnerability exists that could cause the disclosure of FTP server credentials whSchneider Electric EcoStruxure Panel Server
- CVE-2025-0883vulnerability has been discovered in OpenText™ Service Manager.OpenText™ Service Manager
- CVE-2025-29891Apache Camel: Camel Message Header Injection through request parametersApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2024-52362IBM App Connect Enterprise Certified Container denial of serviceIBM App Connect Enterprise Certified Container
- CVE-2025-27794Flarum Vulnerable to Session Hijacking via Authoritative Subdomain Cookie Overwriteflarum framework · flarum/core +1
- CVE-2025-21590Junos OS: An local attacker with shell access can execute arbitrary codeJuniper Networks Junos OS
- CVE-2025-29904In JetBrains Ktor before 3.1.1 an HTTP Request Smuggling was possibleJetBrains Ktor
- CVE-2025-29903In JetBrains Runtime before 21.0.6b872.80 arbitrary dynamic library execution due to insecure macOS flags was possibleJetBrains Runtime
- CVE-2024-13870Unauthenticated Firmware Downgrade in Bitdefender Box v1Bitdefender BOX
- CVE-2025-1527ShopLentor – WooCommerce Builder for Elementor & Gutenberg +20 Modules – All in One Solution (formerly WooLentor) <= 3.1.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Flash Sale Countdown Moduledevitemsllc ShopLentor – All-in-One WooCommerce Growth & St…
- CVE-2025-2239Absolute Path Disclosure Vulnerability in Hillstone Next Generation FireWallHillstone Networks Hillstone Next Generation FireWall
- CVE-2025-21866powerpc/code-patching: Fix KASAN hit by not flagging text patching area as VM_ALLOCLinux
- CVE-2025-21865gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().Linux
- CVE-2025-21862drop_monitor: fix incorrect initialization orderLinux
- CVE-2025-21861mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize()Linux
- CVE-2025-21860mm/zswap: fix inconsistency when zswap_store_page() failsLinux
- CVE-2025-21859USB: gadget: f_midi: f_midi_complete to call queue_workLinux
- CVE-2025-21857net/sched: cls_api: fix error handling causing NULL dereferenceLinux
- CVE-2025-21854sockmap, vsock: For connectible sockets allow only connectedLinux
- CVE-2025-21853bpf: avoid holding freeze_mutex during mmap operationLinux
- CVE-2025-21852net: Add rx_skb of kfree_skb to raw_tp_null_args[].Linux
- CVE-2025-21849drm/i915/gt: Use spin_lock_irqsave() in interruptible contextLinux
- CVE-2025-21848nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()Linux
- CVE-2025-21847ASoC: SOF: stream-ipc: Check for cstream nullity in sof_ipc_msg_data()Linux
- CVE-2025-21846acct: perform last write from workqueueLinux
- CVE-2025-21845mtd: spi-nor: sst: Fix SST write failureLinux
- CVE-2024-58088bpf: Fix deadlock when freeing cgroup storageLinux
- CVE-2024-13430Page Builder: Pagelayer – Drag and Drop website builder <= 1.9.8 - Authenticated (Contributor+) Private Post Disclosure in pagelayer_builder_posts_shortcodesoftaculous Page Builder: Pagelayer – Drag and Drop website…
- CVE-2024-12589Finale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.19.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Countdown Timerdjeet Finale Lite – Sales Countdown Timer & Discount for Wo…
- CVE-2024-13838Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder Plugin <= 6.2 - Authenticated (Admin+) Server-Side Request Forgery via Webhookuncannyowl Uncanny Automator – Easy Automation, Integration…
- CVE-2024-13498NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.8.1 - Unauthenticated Sensitive Information Exposurewebaways NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2025-24912hostapd fails to process crafted RADIUS packets properly.Jouni Malinen hostapd
- CVE-2025-2077Simple Amazon Affiliate <= 1.0.9 - Reflected Cross-Site Scriptingduogeek Simple Amazon Affiliate
- CVE-2025-2078BlogBuzzTime-for-wp <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scriptinggpenverne BlogBuzzTime for WP
- CVE-2025-1508WP Crowdfunding <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Downloadthemeum WP Crowdfunding
- CVE-2025-2076binlayerpress <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scriptinggnarf binlayerpress
- CVE-2025-2205GDPR Cookie Compliance <= 4.15.6 - Authenticated (Admin+) Stored Cross-Site Scriptingmooveagency GDPR Cookie Compliance – Cookie Banner, Cookie…
- CVE-2025-2220Odyssey CMS reCAPTCHA odyssey_contact_form.php key managementOdyssey CMS
- CVE-2025-2219LoveCards LoveCardsV2 image unrestricted uploadLoveCardsV2
- CVE-2025-2218LoveCards LoveCardsV2 Setting other access controlLoveCardsV2
- CVE-2025-2217zzskzy Warehouse Refinement Management System getAdyData.ashx ProcessRequest sql injectionzzskzy Warehouse Refinement Management System
- CVE-2025-2216zzskzy Warehouse Refinement Management System SaveCrash.ashx UploadCrash unrestricted uploadzzskzy Warehouse Refinement Management System
- CVE-2024-27763XPixelGroup BasicSR through 1.4.2 might locally allow code execution in contrived situations where "scontrol show hostname" is executed in tbasicsr
- CVE-2024-34398An issue was discovered in BMC Remedy Mid Tier 7.6.04.
- CVE-2025-25566Memory Leak vulnerability in SoftEtherVPN 5.02.5187 allows an attacker to cause a denial of service via the UnixMemoryAlloc function.
- CVE-2025-25683AlekSIS-Core is vulnerable to Incorrect Access Control.
- CVE-2025-25774An issue was discovered in Open5GS v2.7.2.
- CVE-2025-27914An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1.
- CVE-2025-27915An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0 and 10.1.