CVEs published March 19, 2025
84 CVEs were published on March 19, 2025: 12 critical, 34 high. 1 is now in CISA KEV.
- Published
- 84
- Critical
- 12
- High
- 34
- Medium
- 33
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 35
Most affected products
- IAHispano Applio
- 14
- Adobe Experience Manager
- 4
- Synology DiskStation Manager · Synology BeeStation OS
- 3
- Absolute Security Secure Access
- 2
- Beta80 Life 1st
- 2
- Chimpstudio FoodBakery | Delivery Restaurant Directory Word…
- 2
- Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS
- 2
- Elfatek Elektronics ANKA JPD-00028
- 2
- SecurEnvoy SecurAccess
- 2
- Synology Drive Server
- 2
Critical 12
- CVE-2025-29783vLLM Allows Remote Code Execution via Mooncake Integrationvllm-project vllm · vllm
- CVE-2025-2512File Away <= 3.9.9.0.1 - Missing Authorization to Unauthenticated File Upload via upload Functionthomstark File Away
- CVE-2024-13442Service Finder Bookings <= 5.0 - Unauthenticated Privilege Escalation via Account Takeoveraonetheme Service Finder Bookings
- CVE-2024-13790MinimogWP – The High Converting eCommerce WordPress Theme <= 3.7.0 - Unauthenticated Local PHP File InclusionThemeMove MinimogWP – The High Converting eCommerce WordPre…
- CVE-2024-13410CozyStay <= 1.7.0 and TinySalt <= 3.9.0 - Unauthenticated PHP Object Injection in ajax_handlerLoftOcean CozyStay - Hotel Booking WordPress Theme · LoftOc…
- CVE-2024-12922Altair <= 5.2.4 - Unauthenticated Arbitrary Options Update via pp_import_currentThemeGoods Altair
- CVE-2024-11131A vulnerability regarding out-of-bounds read is found in the video interface.Synology Camera Firmware
- CVE-2024-10442Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 aSynology Unified Controller · Synology Replication Service
- CVE-2024-10441Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and SynolSynology DiskStation Manager · Synology BeeStation OS
- CVE-2024-57061An issue in Termius Version 9.9.0 through v.9.16.0 allows a physically proximate attacker to execute arbitrary code via the insecure Electro
- CVE-2025-29137Tenda AC7 V1.0 V15.03.06.44 found a buffer overflow caused by the timeZone parameter in the form_fast_setting_wifi_set function, which can c
- CVE-2025-29401An arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execute arbitrary code via
High 34
- CVE-2025-27774Applio allows SSRF and file write in model_download.pyIAHispano Applio
- CVE-2025-27775Applio allows SSRF and file write in model_download.pyIAHispano Applio
- CVE-2025-27776Applio allows SSRF and file write in model_download.pyIAHispano Applio
- CVE-2025-27777Applio allows SSRF and file write in model_download.pyIAHispano Applio
- CVE-2025-27778Applio allows unsafe deserialization in infer.pyIAHispano Applio
- CVE-2025-27779Applio allows unsafe deserialization in model_blender.pyIAHispano Applio
- CVE-2025-27782Applio allows arbitrary file write in inference.pyIAHispano Applio
- CVE-2025-27783Applio allows arbitrary file write in train.pyIAHispano Applio
- CVE-2025-27784Applio allows arbitrary file read in train.py export_pth functionIAHispano Applio
- CVE-2025-27787Applio allows a DoS in restart.pyIAHispano Applio
- CVE-2025-27786Applio allows arbitrary file removal in core.pyIAHispano Applio
- CVE-2025-27785Applio allows arbitrary file read in train.py export_index functionIAHispano Applio
- CVE-2025-27781Applio allows unsafe deserialization in inference.pyIAHispano Applio
- CVE-2025-27780Applio allows unsafe deserialization in model_information.pyIAHispano Applio
- CVE-2025-27415Nuxt allows DOS via cache poisoning with payload rendering responsenuxt
- CVE-2025-2476Use after free in Lens in Google Chrome prior to 134.0.6998.117 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2024-51459IBM InfoSphere Server Information command executionIBM InfoSphere Information Server
- CVE-2025-29926The WikiManager REST API allows any user to create wikisxwiki-platform · org.xwiki.platform:xwiki-platform-wiki-res…
- CVE-2025-29925XWiki allows unregistered users to access private pages information through REST endpointxwiki-platform · org.xwiki.platform:xwiki-platform-rest-ser…
- CVE-2025-29924XWiki uses the wrong wiki reference in AuthorizationManagerxwiki-platform · org.xwiki.platform:xwiki-platform-security…
- CVE-2025-30153Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filtergetkin kin-openapi · github.com/getkin/kin-openapi
- CVE-2025-30154Multiple Reviewdog actions were compromised during a specific time periodreviewdog
- CVE-2024-12920FoodBakery | Delivery Restaurant Directory WordPress Theme <= 4.7 - Missing Authorization in Multiple FunctionsChimpstudio FoodBakery | Delivery Restaurant Directory Word…
- CVE-2024-13933FoodBakery | Delivery Restaurant Directory WordPress Theme <= 4.7 - Cross-Site Request Forgery in Multiple FunctionsChimpstudio FoodBakery | Delivery Restaurant Directory Word…
- CVE-2024-12137Authentication Bypass in Elfatek Elektronics' ANKA JPD-00028Elfatek Elektronics ANKA JPD-00028
- CVE-2024-13412CozyStay <= 1.7.0 - Missing Authorization to Arbitrary Action Execution in ajax_handlerLoftOcean CozyStay - Hotel Booking WordPress Theme
- CVE-2025-1232Site Reviews < 7.2.5 - Unauthenticated Stored XSSSite Reviews
- CVE-2024-50631Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in the system syncing daemon in Synology Synology Drive Server
- CVE-2024-50630Missing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280,Synology Drive Server
- CVE-2024-12295BoomBox Theme Extensions <= 1.8.0 - Authenticated (Subscriber+) Privilege Escalation via Password Reset/Account Takeover in boombox_ajax_reset_passwordPX-lab BoomBox Theme Extensions
- CVE-2024-10444Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057-Synology DiskStation Manager
- CVE-2024-55551An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10).Exasol JDBC driver
- CVE-2025-30234SmartOS, as used in Triton Data Center and other products, has static host SSH keys in the 60f76fd2-143f-4f57-819b-1ae32684e81b image (a DebMNX SmartOS
- CVE-2025-30236Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code (skipping a password check) SecurEnvoy SecurAccess
Medium, low and unrated 38
- CVE-2025-27705There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.53.Absolute Security Secure Access
- CVE-2025-27704There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.53.Absolute Security Secure Access
- CVE-2025-2536Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2.Liferay Portal · Liferay DXP +2
- CVE-2024-7631Openshift-console: openshift console: path traversalopenshift-console · Red Hat OpenShift Container Platform +1
- CVE-2024-25132Openshift-dedicated: hive: hibernation controller denial of servicehive · github.com/openshift/hive
- CVE-2025-0431Enterprise Protection Backslash URL Rewrite BypassProofpoint Enterprise Protection
- CVE-2024-53967Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-53968Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-53969Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)Adobe Experience Manager
- CVE-2024-53970Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2025-30152Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal CheckoutSylius PayPalPlugin · sylius/paypal-plugin
- CVE-2025-26486Broken or Risky Cryptographic Algorithm, Use of Password Hash With Insufficient Computational Effort, Use of Weak Hash, Use of a One-Way HBeta80 Life 1st
- CVE-2025-30144Fast-JWT Improperly Validates iss Claimsnearform fast-jwt · fast-jwt
- CVE-2025-30197Jenkins Zoho QEngine Plugin 1.0.29.vfa_cc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for attJenkins Project Jenkins Zoho QEngine Plugin · io.jenkins.pl…
- CVE-2025-30196Jenkins AnchorChain Plugin 1.0 does not limit URL schemes for links it creates based on workspace content, allowing the `javascript:` schemeJenkins Project Jenkins AnchorChain Plugin · org.jenkins-ci…
- CVE-2025-29770vLLM denial of service via outlines unbounded cache on diskvllm-project vllm · vllm
- CVE-2025-1758Improper Input Validation vulnerability in Progress LoadMaster allows : Buffer OverflowThis issue affects: * LoadMaster: 7.2.40.0 and aboveProgress LoadMaster
- CVE-2025-26485A vulnerability in Beta80 Life 1st enables the retrieval of different error messages for failed authentication attempts (in case of the usaBeta80 Life 1st
- CVE-2025-2324A MOVEit Transfer user configured as a Shared Account can gain unintended List permissions on a folderProgress MOVEit Transfer
- CVE-2025-23382Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.26, contain(s) an Exposure of Sensitive System Information to an UnauthoDell Secure Connect Gateway (SCG) 5.0 Appliance - SRS
- CVE-2025-26475Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.26, Enables Live-Restore setting which enhances security by keeping contDell Secure Connect Gateway (SCG) 5.0 Appliance - SRS
- CVE-2024-42176HCL MyXalytics is affected by concurrent login vulnerabilityHCL Software HCL MyXalytics
- CVE-2025-1472Unauthorized View Access to Site Statistics and Team StatisticsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2024-45644IBM Security ReaQta file uploadIBM Security ReaQta
- CVE-2025-2511AHAthat Plugin <= 1.6 - Authenticated (Administrator+) SQL Injection via id Parametermitchelllevy AHAthat Plugin
- CVE-2025-27018Apache Airflow MySQL Provider: SQL injection in MySQL provider core functionApache Software Foundation Apache Airflow MySQL Provider ·…
- CVE-2024-12136Improper Access Control in Elfatek Elektronics' ANKA JPD-00028Elfatek Elektronics ANKA JPD-00028
- CVE-2024-50629Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.1-65374 and Synology Synology DiskStation Manager · Synology BeeStation OS
- CVE-2025-2290LifterLMS <= 8.0.1 - Missing Authorization to Unauthenticated Post Trashingchrisbadgett LifterLMS – WP LMS for eLearning, Online Cours…
- CVE-2024-10445Improper certificate validation vulnerability in the update functionality in Synology BeeStation OS (BSM) before 1.1-65374 and Synology DiskSynology DiskStation Manager · Synology BeeStation OS
- CVE-2024-55009A reflected cross-site scripting (XSS) vulnerability in AutoBib - Bibliographic collection management system 3.1.140 and earlier allows atta
- CVE-2025-26816A vulnerability in Intrexx Portal Server 12.0.2 and earlier which was classified as problematic potentially allows users with particular per
- CVE-2025-29118Tenda AC8 V16.03.34.06 was discovered to contain a stack overflow via the src parameter in the function sub_47D878.
- CVE-2025-29405An arbitrary file upload vulnerability in the component /admin/template.php of emlog pro 2.5.0 and pro 2.5.* allows attackers to execute arb
- CVE-2025-30092Intrexx Portal Server 12.x <= 12.0.2 and 11.x <= 11.9.2 allows XSS in multiple Velocity scripts.
- CVE-2025-30235Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 is intended to disable accounts that have had more than 10 failed authentication atteSecurEnvoy SecurAccess
- CVE-2025-30258In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has incGnuPG
- CVE-2025-30259The WhatsApp cloud service before late 2024 did not block certain crafted PDF content that can defeat a sandbox protection mechanism and conMeta WhatsApp cloud service