# CVEs published 2025-03-30

16 CVEs were published on March 30, 2025: 1 critical, 5 high. Days are UTC.

- [CVE-2025-2961](https://cve.now/CVE-2025-2961.md): opensolon org.noear.solon.core.handle.RenderManager aa render\_mav path traversal (CVSS 5.3, opensolon · org.noear:solon-view)
- [CVE-2024-13804](https://cve.now/CVE-2024-13804.md): Unauthenticated RCE in HPE Insight Cluster Management Utility (CVSS 9.8, Hewlett Packard Enterprise HPE Insight Cluster Management U…)
- [CVE-2025-2960](https://cve.now/CVE-2025-2960.md): TRENDnet TEW-637AP/TEW-638APB HTTP Request goahead sub\_41DED0 null pointer dereference (CVSS 7.1, TRENDnet TEW-637AP · TRENDnet TEW-638APB)
- [CVE-2025-2959](https://cve.now/CVE-2025-2959.md): TRENDnet TEW-410APB HTTP Request httpd sub\_4019A0 null pointer dereference (CVSS 7.1, TRENDnet TEW-410APB)
- [CVE-2025-2958](https://cve.now/CVE-2025-2958.md): TRENDnet TEW-818DRU HTTP Request httpd denial of service (CVSS 7.1, TRENDnet TEW-818DRU)
- [CVE-2025-2957](https://cve.now/CVE-2025-2957.md): TRENDnet TEW-411BRP+ HTTP Request httpd sub\_401DB0 null pointer dereference (CVSS 7.1, TRENDnet TEW-411BRP+)
- [CVE-2025-2956](https://cve.now/CVE-2025-2956.md): TRENDnet TI-G102i HTTP Request lighttpd plugins\_call\_handle\_uri\_raw null pointer dereference (CVSS 7.1, TRENDnet TI-G102i)
- [CVE-2025-2955](https://cve.now/CVE-2025-2955.md): TOTOLINK A3000RU IBMS Configuration File ExportIbmsConfig.sh access control (CVSS 6.9, TOTOLINK A3000RU)
- [CVE-2025-2954](https://cve.now/CVE-2025-2954.md): mannaandpoem OpenManus File file\_saver.py execute access control (CVSS 4.8, mannaandpoem OpenManus)
- [CVE-2025-2953](https://cve.now/CVE-2025-2953.md): PyTorch torch.mkldnn\_max\_pool2d denial of service (CVSS 4.8, PyTorch · torch)
- [CVE-2025-2952](https://cve.now/CVE-2025-2952.md): Bluestar Micro Mall api.php unrestricted upload (CVSS 5.3, Bluestar Micro Mall)
- [CVE-2025-2951](https://cve.now/CVE-2025-2951.md): Bluestar Micro Mall data.php sql injection (CVSS 5.3, Bluestar Micro Mall)
- [CVE-2025-1861](https://cve.now/CVE-2025-1861.md): Stream HTTP wrapper truncates redirect location to 1024 bytes (CVSS 6.3, PHP Group PHP)
- [CVE-2025-1736](https://cve.now/CVE-2025-1736.md): Stream HTTP wrapper header check might omit basic auth header (CVSS 6.3, PHP Group PHP)
- [CVE-2025-1734](https://cve.now/CVE-2025-1734.md): Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVSS 6.3, PHP Group PHP)
- [CVE-2025-1219](https://cve.now/CVE-2025-1219.md): libxml streams use wrong content-type header when requesting a redirected resource (CVSS 6.3, PHP Group PHP)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.