# CVEs published 2025-03-19

84 CVEs were published on March 19, 2025: 12 critical, 34 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-27774](https://cve.now/CVE-2025-27774.md): Applio allows SSRF and file write in model\_download.py (CVSS 8.8, IAHispano Applio)
- [CVE-2025-27775](https://cve.now/CVE-2025-27775.md): Applio allows SSRF and file write in model\_download.py (CVSS 8.8, IAHispano Applio)
- [CVE-2025-27776](https://cve.now/CVE-2025-27776.md): Applio allows SSRF and file write in model\_download.py (CVSS 8.8, IAHispano Applio)
- [CVE-2025-27777](https://cve.now/CVE-2025-27777.md): Applio allows SSRF and file write in model\_download.py (CVSS 7.7, IAHispano Applio)
- [CVE-2025-27778](https://cve.now/CVE-2025-27778.md): Applio allows unsafe deserialization in infer.py (CVSS 8.9, IAHispano Applio)
- [CVE-2025-27779](https://cve.now/CVE-2025-27779.md): Applio allows unsafe deserialization in model\_blender.py (CVSS 8.9, IAHispano Applio)
- [CVE-2025-27782](https://cve.now/CVE-2025-27782.md): Applio allows arbitrary file write in inference.py (CVSS 7.7, IAHispano Applio)
- [CVE-2025-27783](https://cve.now/CVE-2025-27783.md): Applio allows arbitrary file write in train.py (CVSS 7.7, IAHispano Applio)
- [CVE-2025-27784](https://cve.now/CVE-2025-27784.md): Applio allows arbitrary file read in train.py export\_pth function (CVSS 7.7, IAHispano Applio)
- [CVE-2025-27787](https://cve.now/CVE-2025-27787.md): Applio allows a DoS in restart.py (CVSS 7.8, IAHispano Applio)
- [CVE-2025-27786](https://cve.now/CVE-2025-27786.md): Applio allows arbitrary file removal in core.py (CVSS 7.8, IAHispano Applio)
- [CVE-2025-27785](https://cve.now/CVE-2025-27785.md): Applio allows arbitrary file read in train.py export\_index function (CVSS 7.7, IAHispano Applio)
- [CVE-2025-27781](https://cve.now/CVE-2025-27781.md): Applio allows unsafe deserialization in inference.py (CVSS 8.9, IAHispano Applio)
- [CVE-2025-27780](https://cve.now/CVE-2025-27780.md): Applio allows unsafe deserialization in model\_information.py (CVSS 8.9, IAHispano Applio)
- [CVE-2025-27705](https://cve.now/CVE-2025-27705.md): There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.53. (CVSS 5.5, Absolute Security Secure Access)
- [CVE-2025-27704](https://cve.now/CVE-2025-27704.md): There is a cross-site scripting vulnerability in the Secure Access administrative console of Absolute Secure Access prior to version 13.53. (CVSS 5.5, Absolute Security Secure Access)
- [CVE-2025-27415](https://cve.now/CVE-2025-27415.md): Nuxt allows DOS via cache poisoning with payload rendering response (CVSS 7.5, nuxt)
- [CVE-2025-2536](https://cve.now/CVE-2025-2536.md): Cross-site scripting (XSS) vulnerability on Liferay Portal 7.4.3.82 through 7.4.3.128, and Liferay DXP 2024.Q3.0, 2024.Q2.0 through 2024.Q2. (CVSS 5.1, Liferay Portal · Liferay DXP +2)
- [CVE-2025-2476](https://cve.now/CVE-2025-2476.md): Use after free in Lens in Google Chrome prior to 134.0.6998.117 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 8.8, Google Chrome)
- [CVE-2024-7631](https://cve.now/CVE-2024-7631.md): Openshift-console: openshift console: path traversal (CVSS 4.3, openshift-console · Red Hat OpenShift Container Platform +1)
- [CVE-2024-51459](https://cve.now/CVE-2024-51459.md): IBM InfoSphere Server Information command execution (CVSS 8.4, IBM InfoSphere Information Server)
- [CVE-2024-25132](https://cve.now/CVE-2024-25132.md): Openshift-dedicated: hive: hibernation controller denial of service (CVSS 4.3, hive · github.com/openshift/hive)
- [CVE-2025-29926](https://cve.now/CVE-2025-29926.md): The WikiManager REST API allows any user to create wikis (CVSS 7.9, xwiki-platform · org.xwiki.platform:xwiki-platform-wiki-res…)
- [CVE-2025-29925](https://cve.now/CVE-2025-29925.md): XWiki allows unregistered users to access private pages information through REST endpoint (CVSS 8.7, xwiki-platform · org.xwiki.platform:xwiki-platform-rest-ser…)
- [CVE-2025-29924](https://cve.now/CVE-2025-29924.md): XWiki uses the wrong wiki reference in AuthorizationManager (CVSS 8.7, xwiki-platform · org.xwiki.platform:xwiki-platform-security…)
- [CVE-2025-0431](https://cve.now/CVE-2025-0431.md): Enterprise Protection Backslash URL Rewrite Bypass (CVSS 5.8, Proofpoint Enterprise Protection)
- [CVE-2024-53967](https://cve.now/CVE-2024-53967.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-53968](https://cve.now/CVE-2024-53968.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-53969](https://cve.now/CVE-2024-53969.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-53970](https://cve.now/CVE-2024-53970.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2025-30153](https://cve.now/CVE-2025-30153.md): Improper Handling of Highly Compressed Data (Data Amplification) in github.com/getkin/kin-openapi/openapi3filter (CVSS 7.5, getkin kin-openapi · github.com/getkin/kin-openapi)
- [CVE-2025-30152](https://cve.now/CVE-2025-30152.md): Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout (CVSS 6.5, Sylius PayPalPlugin · sylius/paypal-plugin)
- [CVE-2025-26486](https://cve.now/CVE-2025-26486.md): Broken or Risky Cryptographic Algorithm, Use of Password Hash With Insufficient Computational Effort, Use of Weak Hash, Use of a One-Way H (CVSS 6.0, Beta80 Life 1st)
- [CVE-2025-30144](https://cve.now/CVE-2025-30144.md): Fast-JWT Improperly Validates iss Claims (CVSS 6.5, nearform fast-jwt · fast-jwt)
- [CVE-2025-30197](https://cve.now/CVE-2025-30197.md): Jenkins Zoho QEngine Plugin 1.0.29.vfa\_cc23396502 and earlier does not mask the QEngine API Key form field, increasing the potential for att (CVSS 3.1, Jenkins Project Jenkins Zoho QEngine Plugin · io.jenkins.pl…)
- [CVE-2025-30196](https://cve.now/CVE-2025-30196.md): Jenkins AnchorChain Plugin 1.0 does not limit URL schemes for links it creates based on workspace content, allowing the \`javascript:\` scheme (CVSS 6.5, Jenkins Project Jenkins AnchorChain Plugin · org.jenkins-ci…)
- [CVE-2025-29783](https://cve.now/CVE-2025-29783.md): vLLM Allows Remote Code Execution via Mooncake Integration (CVSS 9.1, vllm-project vllm · vllm)
- [CVE-2025-29770](https://cve.now/CVE-2025-29770.md): vLLM denial of service via outlines unbounded cache on disk (CVSS 6.5, vllm-project vllm · vllm)
- [CVE-2025-1758](https://cve.now/CVE-2025-1758.md): Improper Input Validation vulnerability in Progress LoadMaster allows : Buffer OverflowThis issue affects: \* LoadMaster: 7.2.40.0 and above (CVSS 4.3, Progress LoadMaster)
- [CVE-2025-26485](https://cve.now/CVE-2025-26485.md): A vulnerability in Beta80 Life 1st enables the retrieval of different error messages for failed authentication attempts (in case of the usa (CVSS 5.8, Beta80 Life 1st)
- [CVE-2025-2324](https://cve.now/CVE-2025-2324.md): A MOVEit Transfer user configured as a Shared Account can gain unintended List permissions on a folder (CVSS 5.9, Progress MOVEit Transfer)
- [CVE-2025-23382](https://cve.now/CVE-2025-23382.md): Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.26, contain(s) an Exposure of Sensitive System Information to an Unautho (CVSS 5.5, Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS)
- [CVE-2025-30154](https://cve.now/CVE-2025-30154.md): Multiple Reviewdog actions were compromised during a specific time period (CVSS 8.6, KEV, reviewdog)
- [CVE-2025-26475](https://cve.now/CVE-2025-26475.md): Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS, version(s) 5.26, Enables Live-Restore setting which enhances security by keeping cont (CVSS 5.5, Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS)
- [CVE-2024-42176](https://cve.now/CVE-2024-42176.md): HCL MyXalytics is affected by concurrent login vulnerability (CVSS 2.6, HCL Software HCL MyXalytics)
- [CVE-2025-1472](https://cve.now/CVE-2025-1472.md): Unauthorized View Access to Site Statistics and Team Statistics (CVSS 4.3, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2025-2512](https://cve.now/CVE-2025-2512.md): File Away \<= 3.9.9.0.1 - Missing Authorization to Unauthenticated File Upload via upload Function (CVSS 9.8, thomstark File Away)
- [CVE-2024-45644](https://cve.now/CVE-2024-45644.md): IBM Security ReaQta file upload (CVSS 4.7, IBM Security ReaQta)
- [CVE-2025-2511](https://cve.now/CVE-2025-2511.md): AHAthat Plugin \<= 1.6 - Authenticated (Administrator+) SQL Injection via id Parameter (CVSS 4.9, mitchelllevy AHAthat Plugin)
- [CVE-2024-12920](https://cve.now/CVE-2024-12920.md): FoodBakery | Delivery Restaurant Directory WordPress Theme \<= 4.7 - Missing Authorization in Multiple Functions (CVSS 8.8, Chimpstudio FoodBakery | Delivery Restaurant Directory Word…)
- [CVE-2024-13442](https://cve.now/CVE-2024-13442.md): Service Finder Bookings \<= 5.0 - Unauthenticated Privilege Escalation via Account Takeover (CVSS 9.8, aonetheme Service Finder Bookings)
- [CVE-2024-13933](https://cve.now/CVE-2024-13933.md): FoodBakery | Delivery Restaurant Directory WordPress Theme \<= 4.7 - Cross-Site Request Forgery in Multiple Functions (CVSS 8.8, Chimpstudio FoodBakery | Delivery Restaurant Directory Word…)
- [CVE-2025-27018](https://cve.now/CVE-2025-27018.md): Apache Airflow MySQL Provider: SQL injection in MySQL provider core function (CVSS 6.3, Apache Software Foundation Apache Airflow MySQL Provider ·…)
- [CVE-2024-12136](https://cve.now/CVE-2024-12136.md): Improper Access Control in Elfatek Elektronics' ANKA JPD-00028 (CVSS 6.9, Elfatek Elektronics ANKA JPD-00028)
- [CVE-2024-12137](https://cve.now/CVE-2024-12137.md): Authentication Bypass in Elfatek Elektronics' ANKA JPD-00028 (CVSS 7.6, Elfatek Elektronics ANKA JPD-00028)
- [CVE-2024-13790](https://cve.now/CVE-2024-13790.md): MinimogWP – The High Converting eCommerce WordPress Theme \<= 3.7.0 - Unauthenticated Local PHP File Inclusion (CVSS 9.8, ThemeMove MinimogWP – The High Converting eCommerce WordPre…)
- [CVE-2024-13412](https://cve.now/CVE-2024-13412.md): CozyStay \<= 1.7.0 - Missing Authorization to Arbitrary Action Execution in ajax\_handler (CVSS 7.5, LoftOcean CozyStay - Hotel Booking WordPress Theme)
- [CVE-2024-13410](https://cve.now/CVE-2024-13410.md): CozyStay \<= 1.7.0 and TinySalt \<= 3.9.0 - Unauthenticated PHP Object Injection in ajax\_handler (CVSS 9.8, LoftOcean CozyStay - Hotel Booking WordPress Theme · LoftOc…)
- [CVE-2025-1232](https://cve.now/CVE-2025-1232.md): Site Reviews \< 7.2.5 - Unauthenticated Stored XSS (CVSS 8.8, Site Reviews)
- [CVE-2024-50631](https://cve.now/CVE-2024-50631.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in the system syncing daemon in Synology (CVSS 7.5, Synology Drive Server)
- [CVE-2024-50630](https://cve.now/CVE-2024-50630.md): Missing authentication for critical function vulnerability in the webapi component in Synology Drive Server before 3.0.4-12699, 3.2.1-23280, (CVSS 7.5, Synology Drive Server)
- [CVE-2024-50629](https://cve.now/CVE-2024-50629.md): Improper encoding or escaping of output vulnerability in the webapi component in Synology BeeStation OS (BSM) before 1.1-65374 and Synology (CVSS 5.3, Synology DiskStation Manager · Synology BeeStation OS)
- [CVE-2024-12922](https://cve.now/CVE-2024-12922.md): Altair \<= 5.2.4 - Unauthenticated Arbitrary Options Update via pp\_import\_current (CVSS 9.8, ThemeGoods Altair)
- [CVE-2024-12295](https://cve.now/CVE-2024-12295.md): BoomBox Theme Extensions \<= 1.8.0 - Authenticated (Subscriber+) Privilege Escalation via Password Reset/Account Takeover in boombox\_ajax\_reset\_password (CVSS 8.8, PX-lab BoomBox Theme Extensions)
- [CVE-2025-2290](https://cve.now/CVE-2025-2290.md): LifterLMS \<= 8.0.1 - Missing Authorization to Unauthenticated Post Trashing (CVSS 5.3, chrisbadgett LifterLMS – WP LMS for eLearning, Online Cours…)
- [CVE-2024-11131](https://cve.now/CVE-2024-11131.md): A vulnerability regarding out-of-bounds read is found in the video interface. (CVSS 9.8, Synology Camera Firmware)
- [CVE-2024-10442](https://cve.now/CVE-2024-10442.md): Off-by-one error vulnerability in the transmission component in Synology Replication Service before 1.0.12-0066, 1.2.2-0353 and 1.3.0-0423 a (CVSS 10.0, Synology Unified Controller · Synology Replication Service)
- [CVE-2024-10445](https://cve.now/CVE-2024-10445.md): Improper certificate validation vulnerability in the update functionality in Synology BeeStation OS (BSM) before 1.1-65374 and Synology Disk (CVSS 4.3, Synology DiskStation Manager · Synology BeeStation OS)
- [CVE-2024-10441](https://cve.now/CVE-2024-10441.md): Improper encoding or escaping of output vulnerability in the system plugin daemon in Synology BeeStation OS (BSM) before 1.1-65374 and Synol (CVSS 9.8, Synology DiskStation Manager · Synology BeeStation OS)
- [CVE-2024-10444](https://cve.now/CVE-2024-10444.md): Improper certificate validation vulnerability in the LDAP utilities in Synology DiskStation Manager (DSM) before 7.1.1-42962-8, 7.2.1-69057- (CVSS 7.5, Synology DiskStation Manager)
- [CVE-2024-55009](https://cve.now/CVE-2024-55009.md): A reflected cross-site scripting (XSS) vulnerability in AutoBib - Bibliographic collection management system 3.1.140 and earlier allows atta (CVSS 6.1)
- [CVE-2024-55551](https://cve.now/CVE-2024-55551.md): An issue was discovered in Exasol JDBC driver before 24.2.1 (2024-12-10). (CVSS 8.3, Exasol JDBC driver)
- [CVE-2024-57061](https://cve.now/CVE-2024-57061.md): An issue in Termius Version 9.9.0 through v.9.16.0 allows a physically proximate attacker to execute arbitrary code via the insecure Electro (CVSS 9.8)
- [CVE-2025-26816](https://cve.now/CVE-2025-26816.md): A vulnerability in Intrexx Portal Server 12.0.2 and earlier which was classified as problematic potentially allows users with particular per (CVSS 6.5)
- [CVE-2025-29118](https://cve.now/CVE-2025-29118.md): Tenda AC8 V16.03.34.06 was discovered to contain a stack overflow via the src parameter in the function sub\_47D878. (CVSS 6.5)
- [CVE-2025-29137](https://cve.now/CVE-2025-29137.md): Tenda AC7 V1.0 V15.03.06.44 found a buffer overflow caused by the timeZone parameter in the form\_fast\_setting\_wifi\_set function, which can c (CVSS 9.8)
- [CVE-2025-29401](https://cve.now/CVE-2025-29401.md): An arbitrary file upload vulnerability in the component /views/plugin.php of emlog pro v2.5.7 allows attackers to execute arbitrary code via (CVSS 9.8)
- [CVE-2025-29405](https://cve.now/CVE-2025-29405.md): An arbitrary file upload vulnerability in the component /admin/template.php of emlog pro 2.5.0 and pro 2.5.\* allows attackers to execute arb (CVSS 6.3)
- [CVE-2025-30092](https://cve.now/CVE-2025-30092.md): Intrexx Portal Server 12.x \<= 12.0.2 and 11.x \<= 11.9.2 allows XSS in multiple Velocity scripts. (CVSS 6.1)
- [CVE-2025-30234](https://cve.now/CVE-2025-30234.md): SmartOS, as used in Triton Data Center and other products, has static host SSH keys in the 60f76fd2-143f-4f57-819b-1ae32684e81b image (a Deb (CVSS 8.3, MNX SmartOS)
- [CVE-2025-30235](https://cve.now/CVE-2025-30235.md): Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 is intended to disable accounts that have had more than 10 failed authentication atte (CVSS 3.5, SecurEnvoy SecurAccess)
- [CVE-2025-30236](https://cve.now/CVE-2025-30236.md): Shearwater SecurEnvoy SecurAccess Enrol before 9.4.515 allows authentication through only a six-digit TOTP code (skipping a password check) (CVSS 8.6, SecurEnvoy SecurAccess)
- [CVE-2025-30258](https://cve.now/CVE-2025-30258.md): In GnuPG before 2.5.5, if a user chooses to import a certificate with certain crafted subkey data that lacks a valid backsig or that has inc (CVSS 2.7, GnuPG)
- [CVE-2025-30259](https://cve.now/CVE-2025-30259.md): The WhatsApp cloud service before late 2024 did not block certain crafted PDF content that can defeat a sandbox protection mechanism and con (CVSS 3.5, Meta WhatsApp cloud service)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.