CVEs published March 31, 2025
371 CVEs were published on March 31, 2025: 71 critical, 73 high. 1 is now in CISA KEV.
- Published
- 371
- Critical
- 71
- High
- 73
- Medium
- 222
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 204
Most affected products
- Apple macOS
- 73
- Apple iOS and iPadOS · Apple iPadOS +4
- 12
- Apple iOS and iPadOS · Apple macOS +2
- 11
- Tenda FH1202
- 8
- Apple iOS and iPadOS · Apple iPadOS +3
- 6
- Apple iOS and iPadOS · Apple macOS +3
- 5
- Enalean tuleap
- 5
- Apple Safari · Apple iOS and iPadOS +2
- 4
- Apple Safari · Apple iOS and iPadOS +5
- 4
- code-projects Payroll Management System
- 4
Critical 71
- CVE-2025-24167This issue was addressed through improved state management.Apple Safari · Apple iOS and iPadOS +2
- CVE-2025-24238A logic issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-24263A privacy issue was addressed by moving sensitive data to a protected location.Apple macOS
- CVE-2025-30426This issue was addressed with additional entitlement checks.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-24259This issue was addressed with additional entitlement checks.Apple iPadOS · Apple macOS
- CVE-2025-30430This issue was addressed through improved state management.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-24264The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +5
- CVE-2025-24233A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-24232This issue was addressed through improved state management.Apple macOS
- CVE-2025-24265An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2025-24273An out-of-bounds write issue was addressed with improved bounds checking.Apple macOS
- CVE-2025-30461An access issue was addressed with additional sandbox restrictions on the system pasteboards.Apple macOS
- CVE-2025-24249A permissions issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2025-24269The issue was addressed with improved memory handling.Apple macOS
- CVE-2025-30457This issue was addressed with improved validation of symlinks.Apple macOS
- CVE-2025-24253This issue was addressed with improved handling of symlinks.Apple macOS
- CVE-2025-24195An integer overflow was addressed with improved input validation.Apple macOS
- CVE-2025-24204The issue was addressed with improved checks.Apple macOS
- CVE-2025-24245This issue was addressed by adding a delay between verification code attempts.Apple macOS
- CVE-2025-31183The issue was addressed with improved restriction of data container access.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-24250This issue was addressed with improved access restrictions.Apple macOS
- CVE-2025-24207A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-24211This issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple iPadOS +3
- CVE-2025-24246An injection issue was addressed with improved validation.Apple macOS
- CVE-2025-24231The issue was addressed with improved checks.Apple macOS
- CVE-2025-24266A buffer overflow was addressed with improved bounds checking.Apple macOS
- CVE-2025-30458A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-30462A library injection issue was addressed with additional restrictions.Apple macOS
- CVE-2025-24230An out-of-bounds read issue was addressed with improved input validation.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-24181A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-24247A type confusion issue was addressed with improved checks.Apple macOS
- CVE-2025-24178This issue was addressed through improved state management.Apple iOS and iPadOS · Apple iPadOS +3
- CVE-2025-31182This issue was addressed with improved handling of symlinks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-31194An authentication issue was addressed with improved state management.Apple macOS
- CVE-2025-24237A buffer overflow was addressed with improved bounds checking.Apple iOS and iPadOS · Apple iPadOS +3
- CVE-2025-24260The issue was addressed with improved memory handling.Apple macOS
- CVE-2025-30433This issue was addressed with improved access restrictions.Apple iOS and iPadOS · Apple iPadOS +3
- CVE-2025-30444A race condition was addressed with improved locking.Apple macOS
- CVE-2025-30452The issue was addressed with improved checks.Apple macOS
- CVE-2025-24256The issue was addressed with improved bounds checks.Apple macOS
- CVE-2025-24190The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-24241A configuration issue was addressed with additional restrictions.Apple macOS
- CVE-2025-30465A permissions issue was addressed with improved validation.Apple iPadOS · Apple macOS
- CVE-2025-30424A logging issue was addressed with improved data redaction.Apple macOS
- CVE-2025-24172A permissions issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2025-31691OAuth2 Server - Moderately critical - Access bypass - SA-CONTRIB-2025-020Drupal OAuth2 Server · drupal/oauth2_server
- CVE-2025-31685Open Social - Moderately critical - Access bypass - SA-CONTRIB-2025-014Drupal Open Social · goalgorilla/open_social
- CVE-2025-31681Authenticator Login - Critical - Access bypass - SA-CONTRIB-2025-009Drupal Authenticator Login · drupal/alogin
- CVE-2025-31122scratch-coding-hut.github.io Login Links Generation vulnerabilityScratch-Coding-Hut
- CVE-2025-30223Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Inputbeego · github.com/beego/beego/v2 +1
- CVE-2025-3022OS Command Injection vulnerability in e-management of e-solutionse-solutions e-management
- CVE-2025-2071OS Command Injection Vulnerability in FAST LTA Silent Brick WebUIFAST LTA Silent Brick WebUI
- CVE-2025-26689Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions.Inaba Denki Sangyo Co. CHOCO TEI WATCHER mini
- CVE-2025-25211Weak password requirements issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions.Inaba Denki Sangyo Co. CHOCO TEI WATCHER mini
- CVE-2025-3011PiExtract SOOP-CLM - SQL InjectionPiExtract SOOP-CLM
- CVE-2025-1268Out-of-bounds vulnerability in EMF Recode processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic PlusCanon Generic Plus PCL6 Printer Driver · Canon Generic… +12
- CVE-2024-54802In Netgear WNR854T 1.5.2 (North America), the UPNP service (/usr/sbin/upnp) is vulnerable to stack-based buffer overflow in the M-SEARCH Hos
- CVE-2024-54803Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection.
- CVE-2024-54804Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection.
- CVE-2024-54805Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection.
- CVE-2024-54806Netgear WNR854T 1.5.2 (North America) is vulnerable to Arbitrary command execution in cmd.cgi which allows for the execution of system comma
- CVE-2024-54807In Netgear WNR854T 1.5.2 (North America), the UPNP service is vulnerable to command injection in the function addmap_exec which parses the N
- CVE-2024-54808Netgear WNR854T 1.5.2 (North America) contains a stack-based buffer overflow vulnerability in the SetDefaultConnectionService function due t
- CVE-2024-54809Netgear Inc WNR854T 1.5.2 (North America) contains a stack-based buffer overflow vulnerability in the parse_st_header function due to use of
- CVE-2025-22937An issue in Adtran 411 ONT vL80.00.0011.M2 allows attackers to escalate privileges via unspecified vectors.
- CVE-2025-22938Adtran 411 ONT L80.00.0011.M2 was discovered to contain weak default passwords.
- CVE-2025-22939A command injection vulnerability in the telnet service of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and
- CVE-2025-22940Incorrect access control in Adtran 411 ONT L80.00.0011.M2 allows unauthorized attackers to arbitrarily set the admin password.
- CVE-2025-22941A command injection vulnerability in the web interface of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and
- CVE-2025-29266Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without authentication if a container is rUnraid
- CVE-2025-30095VyOS 1.3 through 1.5 (fixed in 1.4.2) or any Debian-based system using dropbear in combination with live-build has the same Dropbear privateVyOS
High 73
- CVE-2025-24254This issue was addressed with improved validation of symlinks.Apple macOS
- CVE-2025-24255A file access issue was addressed with improved input validation.Apple macOS
- CVE-2025-24243The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-24234This issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2025-24170A logic issue was addressed with improved file handling.Apple macOS
- CVE-2025-30471A validation issue was addressed with improved logic.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-24213This issue was addressed with improved handling of floats.Apple Safari · Apple iOS and iPadOS +5
- CVE-2025-30456A parsing issue in the handling of directory paths was addressed with improved path validation.Apple iOS and iPadOS · Apple macOS
- CVE-2025-24229A logic issue was addressed with improved checks.Apple macOS
- CVE-2025-30437The issue was addressed with improved bounds checks.Apple macOS
- CVE-2025-30460A permissions issue was addressed by removing vulnerable code and adding additional checks.Apple macOS
- CVE-2025-24209A buffer overflow issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +4
- CVE-2024-54533A permissions issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2025-24228A buffer overflow issue was addressed with improved memory handling.Apple macOS
- CVE-2025-24196A type confusion issue was addressed with improved memory handling.Apple macOS
- CVE-2025-24180The issue was addressed with improved input validation.Apple Safari · Apple iOS and iPadOS +3
- CVE-2025-24267A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-24221This issue was addressed with improved data access restriction.Apple iOS and iPadOS · Apple iPadOS +1
- CVE-2025-24173This issue was addressed with additional entitlement checks.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-30464An out-of-bounds write issue was addressed with improved bounds checking.Apple macOS
- CVE-2025-24095This issue was addressed with additional entitlement checks.Apple iOS and iPadOS · Apple visionOS
- CVE-2025-24257An out-of-bounds write issue was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-31184This issue was addressed with improved permissions checking.Apple Safari · Apple iOS and iPadOS +2
- CVE-2025-31188A race condition was addressed with additional validation.Apple macOS
- CVE-2025-24277A parsing issue in the handling of directory paths was addressed with improved path validation.Apple macOS
- CVE-2025-30449A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-31694Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2025-023Drupal Two-factor Authentication · drupal/tfa
- CVE-2025-26683Azure Playwright Elevation of Privilege VulnerabilityMicrosoft Azure Playwright
- CVE-2025-31692AI (Artificial Intelligence) - Critical - Remote Code Execution - SA-CONTRIB-2025-021Drupal AI · drupal/ai
- CVE-2025-31690Cache Utility - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-019Drupal Cache Utility · drupal/cache_utility
- CVE-2025-31689General Data Protection Regulation - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-018Drupal General Data Protection Regulation · drupal/gdpr
- CVE-2025-31686Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015Drupal Open Social · goalgorilla/open_social
- CVE-2025-31678AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004Drupal AI · drupal/ai
- CVE-2025-31677AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003Drupal AI · drupal/ai
- CVE-2025-31676Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001Drupal Email TFA · drupal/email_tfa
- CVE-2025-31674Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003Drupal core · drupal/core
- CVE-2025-21893keys: Fix UAF in key_put()Linux
- CVE-2025-31123Zitadel Expired JWT Keys Usable for Authorization Grantszitadel
- CVE-2025-31129jooby-pac4j: deserialization of untrusted datajooby-project jooby · io.jooby:jooby-pac4j
- CVE-2025-30005Xorcom CompletePBX <= 5.2.35 Authenticated Path Traversal & File DeletionXorcom CompletePBX
- CVE-2025-30004Xorcom CompletePBX <= 5.2.35 Task Scheduler Authenticated Command InjectionXorcom CompletePBX
- CVE-2025-2794Kentico Xperience <= 13.0.180 Unsafe ReflectionKentico Xperience
- CVE-2025-30161OpenEMR Stored XSS in OpenEMR Bronchitis Formopenemr
- CVE-2025-29772OpenEMR allows Reflected XSS in CAMOS new.phpopenemr
- CVE-2025-1449Admin Shell Access Vulnerability in Rockwell Automation Verve Asset ManagerRockwell Automation Verve Asset Manager
- CVE-2024-12021Stored Cross-Site ScriptingBlack Duck Coverity
- CVE-2023-0881DDoS in Ubuntu package linux-bluefieldUbuntu package linux-bluefield
- CVE-2025-31625WordPress Useinfluence plugin <= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerabilityramanparashar Useinfluence
- CVE-2025-31623WordPress Rich Text Editor plugin <= 1.0.1 - CSRF to Stored XSS vulnerabilityrichtexteditor Rich Text Editor
- CVE-2025-31617WordPress PostmarkApp Email Integrator plugin <= 2.4 - CSRF to Stored XSS vulnerabilityGagan Deep Singh PostmarkApp Email Integrator
- CVE-2025-31616WordPress Varnish WordPress plugin <= 1.7 - CSRF to Stored XSS vulnerabilityAdminGeekZ Varnish WordPress
- CVE-2025-31615WordPress Simple Contact Forms plugin <= 1.6.4 - CSRF to Stored XSS vulnerabilityowenr88 Simple Contact Forms
- CVE-2025-31613WordPress AB Google Map Travel plugin <= 4.6 - CSRF to Stored XSS vulnerabilityAboobacker. AB Google Map Travel
- CVE-2025-31585WordPress Leadfox for WordPress plugin <= 2.1.9 - CSRF to Stored XSS vulnerabilityLeadfox for WordPress
- CVE-2025-31583WordPress WP Copy Media URL plugin <= 2.1 - CSRF to Stored XSS vulnerabilityAshish Ajani WP Copy Media URL
- CVE-2025-31570WordPress Related Posts Widget with Thumbnails plugin <= 1.2 - CSRF to Stored XSS vulnerabilitywp-buy Related Posts Widget with Thumbnails
- CVE-2025-31569WordPress wordpress related Posts with thumbnails plugin <= 3.0.0.1 - CSRF to Stored XSS vulnerabilitywp-buy wordpress related Posts with thumbnails
- CVE-2025-31566WordPress Rio Video Gallery plugin <= 2.3.6 - CSRF to Stored XSS vulnerabilityriosisgroup Rio Video Gallery
- CVE-2025-31547WordPress Uptime Robot Plugin for WordPress plugin <= 2.3 - SQL Injection vulnerabilityAphotrax Uptime Robot Plugin for WordPress
- CVE-2025-31542WordPress My auctions allegro plugin <= 3.6.20 - SQL Injection vulnerabilitywphocus My auctions allegro
- CVE-2025-31526WordPress Behance Portfolio Manager plugin <= 1.7.5 - SQL Injection vulnerabilityeleopard Behance Portfolio Manager
- CVE-2025-2586Ols: unauthenticated metrics flooding in openshift lightspeed service leading to resource exhaustionlightspeed-service · Red Hat OpenShift Lightspeed
- CVE-2025-23995WordPress Tantyyellow theme <= 1.0.0.5 - Reflected Cross Site Scripting (XSS) vulnerabilityta2g Tantyyellow
- CVE-2025-3021Path Traversal vulnerability in e-management of e-solutionse-solutions e-management
- CVE-2025-2402Hard-coded password for object store of KNIME Business HubKNIME Business Hub
- CVE-2025-31387WordPress InstaWP Connect plugin <= 0.1.0.82 - Local File Inclusion vulnerabilityInstaWP Connect
- CVE-2025-31016WordPress JetWooBuilder plugin <= 2.1.18 - Local File Inclusion vulnerabilityCrocoblock JetWooBuilder
- CVE-2025-30855WordPress Ads by WPQuads plugin <= 2.0.87.1 - Broken Access Control VulnerabilityAds by WPQuads
- CVE-2025-30835WordPress Accounting for WooCommerce plugin <= 1.6.8 - Local File Inclusion vulnerabilityBastien Ho Accounting for WooCommerce
- CVE-2025-31103Untrusted data deserialization vulnerability exists in a-blog cms.appleple a-blog cms
- CVE-2025-24517Use of client-side authentication issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions.Inaba Denki Sangyo Co. CHOCO TEI WATCHER mini
- CVE-2025-3014Insecure direct object references (IDOR) in NightWolf Penetration PlatformFPT Software NightWolf Penetration Platform
- CVE-2025-3013Insecure direct object references (IDOR) in NightWolf Penetration PlatformFPT Software NightWolf Penetration Platform
Medium, low and unrated 227
- CVE-2025-3041Project Worlds Online Time Table Generator updatestudent.php unrestricted uploadProject Worlds Online Time Table Generator
- CVE-2025-3040Project Worlds Online Time Table Generator add_student.php unrestricted uploadProject Worlds Online Time Table Generator
- CVE-2025-3039code-projects Payroll Management System add_employee.php sql injectioncode-projects Payroll Management System
- CVE-2025-3038code-projects Payroll Management System view_account.php sql injectioncode-projects Payroll Management System
- CVE-2025-3037yzk2356911358 StudentServlet-JSP cross-site request forgeryyzk2356911358 StudentServlet-JSP
- CVE-2025-30470A path handling issue was addressed with improved logic.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-30427A use-after-free issue was addressed with improved memory management.Apple Safari · Apple iOS and iPadOS +5
- CVE-2025-24262A privacy issue was addressed with improved private data redaction for log entries.Apple macOS
- CVE-2024-40864The issue was addressed with improved handling of protocols.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-24235A memory initialization issue was addressed with improved memory handling.Apple macOS
- CVE-2025-24242This issue was addressed with improved handling of symlinks.Apple macOS
- CVE-2025-24215The issue was addressed with improved checks.Apple iPadOS · Apple macOS
- CVE-2025-24203The issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-24192A script imports issue was addressed with improved isolation.Apple Safari · Apple iOS and iPadOS +2
- CVE-2025-30450This issue was addressed with improved validation of symlinks.Apple macOS
- CVE-2025-31187This issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2025-24278This issue was addressed with improved validation of symlinks.Apple macOS
- CVE-2025-24281This issue was addressed with improved data protection.Apple macOS
- CVE-2025-30446A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-24239A downgrade issue was addressed with additional code-signing restrictions.Apple macOS
- CVE-2025-31191This issue was addressed through improved state management.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-30447The issue was resolved by sanitizing logging.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-24280An access issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2025-24279This issue was addressed with improved file handling.Apple macOS
- CVE-2025-30451This issue was addressed with improved redaction of sensitive information.Apple macOS
- CVE-2025-24193This issue was addressed with improved authentication.Apple iOS and iPadOS
- CVE-2025-24202A logging issue was addressed with improved data redaction.Apple iOS and iPadOS · Apple macOS
- CVE-2025-24214A privacy issue was addressed by not logging contents of text fields.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-24097A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple iPadOS +3
- CVE-2025-30467The issue was addressed with improved checks.Apple Safari · Apple iOS and iPadOS +2
- CVE-2025-24218A privacy issue was addressed with improved private data redaction for log entries.Apple macOS
- CVE-2025-24182An out-of-bounds read issue was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-24244The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple iPadOS +3
- CVE-2025-24205An authorization issue was addressed with improved state management.Apple iOS and iPadOS · Apple iPadOS +1
- CVE-2025-24194A logic issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-24157A buffer overflow issue was addressed with improved memory handling.Apple macOS
- CVE-2025-24248A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2025-24198This issue was addressed by restricting options offered on a locked device.Apple iOS and iPadOS · Apple iPadOS +1
- CVE-2025-24272The issue was addressed with improved checks.Apple macOS
- CVE-2025-24199An uncontrolled format string issue was addressed with improved input validation.Apple macOS
- CVE-2025-24208A permissions issue was addressed with additional restrictions.Apple Safari · Apple iOS and iPadOS
- CVE-2025-30441This issue was addressed through improved state management.Apple Xcode
- CVE-2025-24212This issue was addressed with improved checks.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-30454A path handling issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-30439The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-30435This issue was addressed with improved redaction of sensitive information.Apple macOS
- CVE-2025-30434The issue was addressed with improved input sanitization.Apple iOS and iPadOS
- CVE-2025-30463The issue was addressed with improved restriction of data container access.Apple iOS and iPadOS · Apple macOS
- CVE-2025-24226The issue was addressed with improved checks.Apple Xcode
- CVE-2025-30438This issue was addressed with improved access restrictions.Apple iOS and iPadOS · Apple macOS +3
- CVE-2025-24210A logic error was addressed with improved error handling.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-30455The issue was addressed with improved checks.Apple macOS
- CVE-2025-30443A privacy issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2025-24276This issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2025-30425This issue was addressed through improved state management.Apple Safari · Apple iOS and iPadOS +4
- CVE-2025-24283A logging issue was addressed with improved data redaction.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-30429A path handling issue was addressed with improved validation.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-24217This issue was addressed with improved redaction of sensitive information.Apple iOS and iPadOS · Apple macOS +2
- CVE-2025-24240A race condition was addressed with additional validation.Apple macOS
- CVE-2025-30469This issue was addressed through improved state management.Apple iOS and iPadOS
- CVE-2025-24216The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +5
- CVE-2025-24191The issue was addressed with improved validation of environment variables.Apple macOS
- CVE-2025-30428This issue was addressed through improved state management.Apple iOS and iPadOS · Apple iPadOS
- CVE-2025-24282A library injection issue was addressed with additional restrictions.Apple macOS
- CVE-2025-31192The issue was addressed with improved checks.Apple Safari · Apple iOS and iPadOS +1
- CVE-2025-30432A logic issue was addressed with improved state management.Apple iOS and iPadOS · Apple iPadOS +4
- CVE-2025-24164A logic issue was addressed with improved checks.Apple macOS
- CVE-2025-3062Drupal Admin LTE theme - Critical - Unsupported - SA-CONTRIB-2025-010Drupal Admin LTE theme · drupal/druadmin_lte_theme
- CVE-2025-24261The issue was addressed with improved checks.Apple macOS
- CVE-2025-24148This issue was addressed with improved handling of executable types.Apple macOS
- CVE-2025-24236An access issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2025-3061Material Admin - Critical - Unsupported - SA-CONTRIB-2025-006Drupal Material Admin · drupal/material_admin
- CVE-2025-3060Flattern – Multipurpose Bootstrap Business Profile - Critical - Unsupported - SA-CONTRIB-2025-005Drupal Flattern – Multipurpose Bootstrap Business Profile
- CVE-2025-3059Profile Private - Critical - Unsupported - SA-CONTRIB-2025-002Drupal Profile Private · drupal/profile_private
- CVE-2025-3036yzk2356911358 StudentServlet-JSP Student Management cross site scriptingyzk2356911358 StudentServlet-JSP
- CVE-2025-3018SourceCodester Online Eyewear Shop Users.php sql injectionSourceCodester Online Eyewear Shop
- CVE-2025-31697Formatter Suite - Moderately critical - Cross site scripting - SA-CONTRIB-2025-026Drupal Formatter Suite · drupal/formatter_suite
- CVE-2025-31696RapiDoc OAS Field Formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-025Drupal RapiDoc OAS Field Formatter · drupal/rapidoc_element…
- CVE-2025-31695Link field display mode formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-024Drupal Link field display mode formatter · drupal/link_fiel…
- CVE-2025-31693AI (Artificial Intelligence) - Moderately critical - Gadget Chain - SA-CONTRIB-2025-022Drupal AI · drupal/ai
- CVE-2025-31688Configuration Split - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-017Drupal Configuration Split · drupal/config_split
- CVE-2025-31687SpamSpan filter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-016Drupal SpamSpan filter · drupal/spamspan
- CVE-2025-31684OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013Drupal OAuth2 Client · drupal/oauth2_client
- CVE-2025-31683Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012Drupal Google Tag · drupal/google_tag
- CVE-2025-31682Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011Drupal Google Tag · drupal/google_tag
- CVE-2025-31680Matomo Analytics - Moderately critical - Cross site request forgery - SA-CONTRIB-2025-008Drupal Matomo Analytics · drupal/matomo
- CVE-2025-31679Ignition Error Pages - Critical - Cross Site Scripting - SA-CONTRIB-2025-007Drupal Ignition Error Pages · drupal/ignition
- CVE-2025-31675Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004Drupal core · Drupal Link +1
- CVE-2025-31673Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002Drupal core · drupal/core
- CVE-2025-3057Drupal core - Critical - Cross site scripting - SA-CORE-2025-001Drupal core · drupal/core
- CVE-2025-3017TA-Lib ta_regtest test_minmax.c setInputBuffer out-of-bounds writeTA-Lib
- CVE-2025-3016Open Asset Import Library Assimp MDL File MDLMaterialLoader.cpp ParseTextureColorData resource consumptionOpen Asset Import Library Assimp · pyassimp
- CVE-2024-24456An E-RAB Release Command packet containing a malformed NAS PDU will cause the Athonet MME to immediately crash, potentially due to a buffer Hewlett Packard Enterprise (HPE) HPE Athonet Core
- CVE-2025-3015Open Asset Import Library Assimp ASE File ASELoader.cpp BuildUniqueRepresentation out-of-boundsOpen Asset Import Library Assimp · pyassimp
- CVE-2025-3010Khronos Group glslang Intermediate.cpp isConversionAllowed null pointer dereferenceKhronos Group glslang
- CVE-2025-31124Zitadel allows User Enumeration by loginname attribute normalizationzitadel
- CVE-2025-3009Jinher Network OA NetDiskProperty.aspx sql injectionJinher Network OA
- CVE-2025-3008Novastar CX40 NetFilter Utility netconfig popen command injectionNovastar CX40
- CVE-2025-31128gifplayer XSS vulnerabilityrubentd gifplayer · gifplayer +1
- CVE-2025-29908Netty QUIC hash collision DoS attacknetty-incubator-codec-quic · io.netty.incubator:netty-incub…
- CVE-2025-3007Novastar CX40 NetFilter Utility netconfig getopt stack-based overflowNovastar CX40
- CVE-2025-3006PHPGurukul e-Diary Management System edit-category.php sql injectionPHPGurukul e-Diary Management System
- CVE-2025-3005Sayski ForestBlog Friend Link cross site scriptingSayski ForestBlog
- CVE-2025-31125Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` queryvitejs vite · vite
- CVE-2025-3004Sayski ForestBlog search cross site scriptingSayski ForestBlog
- CVE-2025-30006Xorcom CompletePBX <= 5.2.35 Reflected Cross-Site ScriptingXorcom CompletePBX
- CVE-2025-31117OpenEMR Out-of-Band Server-Side Request Forgery (OOB SSRF) Vulnerabilityopenemr
- CVE-2025-31116Mobile Security Framework (MobSF) has a SSRF Vulnerability fix bypass on assetlinks_check with DNS RebindingMobile-Security-Framework-MobSF · mobsf
- CVE-2025-2292Xorcom CompletePBX <= 5.2.35 Authenticated File DisclosureXorcom CompletePBX
- CVE-2025-30369Zulip allows the deletion of Custom profile fields by administrators of a different organizationzulip
- CVE-2025-3003ESAFENET CDG UserAjax sql injectionESAFENET CDG
- CVE-2025-30368Zulip allows the deletion of organization by administrators of a different organizationzulip
- CVE-2025-30149OpenEMR Reflected XSS in AJAX Scriptopenemr
- CVE-2025-3002Digital China DCME-520 mon_merge_stat_hist.php os command injectionDigital China DCME-520
- CVE-2025-30155Tuleap does not enforce read permissions on parent trackers in the REST APIEnalean tuleap
- CVE-2025-30209Tuleap has improper permission handling in the REST endpoints and release notes display of the FRS pluginEnalean tuleap
- CVE-2025-30203Tuleap allows XSS via the content of RSS feeds in the RSS widgetsEnalean tuleap
- CVE-2025-29929Tuleap is missing CSRF protection on tracker hierarchy administrationEnalean tuleap
- CVE-2025-29766Tuleap has missing CSRF protections on artifact submission & edition from the tracker viewEnalean tuleap
- CVE-2025-27149Zulip exports can leak private datazulip
- CVE-2025-3001PyTorch torch.lstm_cell memory corruptionPyTorch · torch
- CVE-2025-3048Path Traversal in AWS SAM CLI allows file copy to local cacheAWS Serverless Application Model Command Line Interface · a…
- CVE-2025-3047Path Traversal in AWS SAM CLI allows file copy to build containerAWS Serverless Application Model Command Line Interface · a…
- CVE-2025-27095JumpServer has a Kubernetes Token Leak Vulnerabilityjumpserver
- CVE-2025-3000PyTorch torch.jit.script memory corruptionPyTorch · torch
- CVE-2023-33302A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiMail webmail and administrative interface versionFortinet FortiNDR · Fortinet FortiMail
- CVE-2025-2999PyTorch torch.nn.utils.rnn.unpack_sequence memory corruptionPyTorch · torch
- CVE-2025-2998PyTorch torch.nn.utils.rnn.pad_packed_sequence memory corruptionPyTorch · torch
- CVE-2025-2997zhangyanbo2007 youkefu url server-side request forgeryzhangyanbo2007 youkefu
- CVE-2025-2996Tenda FH1202 Web Management Interface SysToolDDNS access controlTenda FH1202
- CVE-2025-31629WordPress Infusionsoft Web Form JavaScript plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilityJacob Allred Infusionsoft Web Form JavaScript
- CVE-2025-31627WordPress Media Library Assistant plugin <= 3.24 - Stored Cross Site Scripting (XSS) vulnerabilityDavid Lingren Media LIbrary Assistant
- CVE-2025-31624WordPress Processing Projects plugin <= 1.0.2 - Cross Site Scripting (XSS) vulnerabilityLABCAT Processing Projects
- CVE-2025-31621WordPress byBrick Accordion plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilitydavidpaulsson byBrick Accordion
- CVE-2025-31620WordPress CoverManager plugin <= 0.0.1 - Cross Site Scripting (XSS) vulnerabilitycarperfer CoverManager
- CVE-2025-31618WordPress Connector to CiviCRM with CiviMcRestFace plugin <= 1.0.10 - Broken Access Control vulnerabilityJaap Jansma Connector to CiviCRM with CiviMcRestFace
- CVE-2025-31614WordPress Terms Before Download plugin <= 1.0.5 - Cross Site Scripting (XSS) vulnerabilityhiroprot Terms Before Download
- CVE-2025-31611WordPress Auto Post After Image Upload plugin <= 1.6 - Broken Access Control vulnerabilityShaharia Azam Auto Post After Image Upload
- CVE-2025-31610WordPress Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilitygingerplugins Notification Bar, Sticky Notification Bar, St…
- CVE-2025-31609WordPress WPCargo Track & Trace plugin <= 8.0.2 - Insecure Direct Object References (IDOR) vulnerabilityArni Cinco WPCargo Track & Trace
- CVE-2025-31608WordPress CookieHint WP plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityreDim CookieHint WP
- CVE-2025-31607WordPress Simple-Audioplayer plugin <= 1.1 - Cross Site Scripting (XSS) vulnerabilityflomei Simple-Audioplayer
- CVE-2025-31606WordPress SP Blog Designer plugin <= 1.0.0 - Arbitrary Shortcode Execution vulnerabilitysoftpulseinfotech SP Blog Designer
- CVE-2025-31605WordPress Welcome Popup plugin <= 1.0.10 - Cross Site Scripting (XSS) vulnerabilityWeblineIndia Welcome Popup
- CVE-2025-31604WordPress Cal.com plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityCal.com
- CVE-2025-31603WordPress CF7 Spreadsheets plugin <= 2.3.2 - Settings Change vulnerabilitymoshensky CF7 Spreadsheets
- CVE-2025-31602WordPress Apimo Connector plugin <= 2.6.5.1 - Cross Site Request Forgery (CSRF) vulnerabilityProptech Plugin Apimo Connector
- CVE-2025-31601WordPress Appointy Appointment Scheduler plugin <= 4.2.1 - CSRF to Settings Change vulnerabilityAppointy Appointment Scheduler
- CVE-2025-31600WordPress DesignO plugin <= 2.6.0 - Cross Site Request Forgery (CSRF) vulnerabilitydesignnbuy DesignO
- CVE-2025-31598WordPress Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin <= 4.0.3 - Stored Cross Site Scripting (XSS) vulnerabilityWPFactory Quantity Dynamic Pricing & Bulk Discounts for Woo…
- CVE-2025-31597WordPress Ultimate Live Cricket WordPress Lite plugin <= 1.4.2 - Cross Site Scripting (XSS) vulnerabilitycrazycric Ultimate Live Cricket WordPress Lite
- CVE-2025-31596WordPress Chat by Chatwee plugin <= 2.1.3 - Broken Access Control vulnerabilityChat by Chatwee
- CVE-2025-31595WordPress Timeline Event History plugin <= 3.2 - Cross Site Scripting (XSS) vulnerabilitywpdiscover Timeline Event History
- CVE-2025-31593WordPress OpenMenu plugin <= 3.5 - Cross Site Scripting (XSS) vulnerabilityOpenMenu
- CVE-2025-31592WordPress Send E-mail plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilityPaolo Melchiorre Send E-mail
- CVE-2025-31591WordPress Exit Popup Free plugin <= 1.0 - Cross Site Scripting (XSS) vulnerabilitypromoz73 Exit Popup Free
- CVE-2025-31590WordPress WP Date and Time Shortcode plugin <= 2.6.7 - Cross Site Scripting (XSS) vulnerabilityDenra.com WP Date and Time Shortcode
- CVE-2025-31589WordPress Ethiopian Calendar plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilityKibru Demeke Ethiopian Calendar
- CVE-2025-31588WordPress Elfsight Testimonials Slider plugin <= 1.0.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerabilityElfsight Testimonials Slider
- CVE-2025-31587WordPress Elfsight Testimonials Slider plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerabilityElfsight Testimonials Slider
- CVE-2025-31586WordPress Gallery – Photo Albums Plugin plugin <= 1.3.170 - Stored Cross Site Scripting (XSS) vulnerabilityGhozyLab Gallery – Photo Albums Plugin
- CVE-2025-31584WordPress Elfsight Testimonials Slider plugin <= 1.0.1 - Broken Access Control vulnerabilityElfsight Testimonials Slider
- CVE-2025-31577WordPress Appointify plugin <= 1.0.8 - Arbitrary File Upload vulnerabilityAppointify
- CVE-2025-31576WordPress PostmarkApp Email Integrator plugin <= 2.4 - Broken Access Control vulnerabilityGagan Deep Singh PostmarkApp Email Integrator
- CVE-2025-31575WordPress Flag Icons plugin <= 2.2 - Cross Site Scripting (XSS) vulnerabilityVasilis Triantafyllou Flag Icons
- CVE-2025-31574WordPress Custom Content Scrollbar plugin <= 1.3 - Cross Site Scripting (XSS) vulnerabilitySoftHopper Custom Content Scrollbar
- CVE-2025-31572WordPress Multi Days Events and Multi Events in One Day Calendar plugin <= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerabilityv20202020 Multi Days Events and Multi Events in One Day Cal…
- CVE-2025-31567WordPress Themesflat Addons For Elementor plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerabilitythemesflat-addons-for-elementor
- CVE-2025-31562WordPress Uptime Robot Plugin for WordPress plugin <= 2.3 - Cross Site Scripting (XSS) vulnerabilityAphotrax Uptime Robot Plugin for WordPress
- CVE-2025-31559WordPress Custom Database Applications by Caspio plugin <= 2.1 - Cross Site Scripting (XSS) vulnerabilityCaspio Bridge Custom Database Applications by Caspio
- CVE-2025-31557WordPress OSM plugin <= 6.1.13 - Cross Site Scripting (XSS) vulnerabilityMiKa OSM
- CVE-2025-31556WordPress IMPress for IDX Broker plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerabilityIMPress for IDX Broker
- CVE-2025-31555WordPress ContentMX Content Publisher plugin <= 1.0.6 - Broken Access Control vulnerabilityContentMX Content Publisher
- CVE-2025-31549WordPress Fusion plugin <= 1.6.4 - Cross Site Scripting (XSS) vulnerabilityAgency Dominion Fusion
- CVE-2025-31546WordPress Swiss Toolkit For WP plugin <= 1.4.0 - Broken Access Control vulnerabilityWP Messiah Swiss Toolkit For WP
- CVE-2025-31545WordPress Safe Ai Malware Protection for WP plugin <= 1.0.20 - Broken Access Control vulnerabilityWP Messiah Safe Ai Malware Protection for WP
- CVE-2025-31544WordPress Swiss Toolkit For WP plugin <= 1.4.5 - Broken Access Control vulnerabilityWP Messiah Swiss Toolkit For WP
- CVE-2025-31543WordPress Twice Commerce plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerabilityTwice Commerce
- CVE-2025-31540WordPress ACME Divi Modules plugin <= 1.3.5 - Broken Access Control vulnerabilityacmemediakits ACME Divi Modules
- CVE-2025-31539WordPress Cryptocurrency Widgets Pack plugin <= 2.0.1 - Broken Access Control vulnerabilityBlocksera Cryptocurrency Widgets Pack
- CVE-2025-31538WordPress Checklist plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerabilitychecklistcom Checklist
- CVE-2025-31535WordPress Simple Owl Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerabilityPressTigers Simple Owl Carousel
- CVE-2025-31533WordPress Salesmate Add-On for Gravity Forms plugin <= 2.0.3 - Broken Access Control vulnerabilitySalesmate.io Salesmate Add-On for Gravity Forms
- CVE-2025-31532WordPress AtomChat plugin <= 1.1.8 - Cross Site Scripting (XSS) vulnerabilityTeam AtomChat AtomChat
- CVE-2025-31530WordPress Google SEO Pressor Snippet plugin <= 2.0 - Broken Access Control vulnerabilitySmackcoders Inc., Google SEO Pressor Snippet
- CVE-2025-31529WordPress Slider Path for Elementor plugin <= 3.0.0 - Broken Access Control vulnerabilityRashid Slider Path for Elementor
- CVE-2025-31528WordPress StaticPress plugin <= 0.4.5 - Broken Access Control vulnerabilitywokamoto StaticPress
- CVE-2025-31527WordPress WP Link Preview plugin <= 1.4.1 - Server Side Request Forgery (SSRF) vulnerabilityKishan WP Link Preview
- CVE-2025-2995Tenda FH1202 Web Management Interface SysToolChangePwd access controlTenda FH1202
- CVE-2025-2994Tenda FH1202 Web Management Interface qossetting access controlTenda FH1202
- CVE-2025-2993Tenda FH1202 default.cfg access controlTenda FH1202
- CVE-2025-2992Tenda FH1202 Web Management Interface AdvSetWrlsafeset access controlTenda FH1202
- CVE-2025-31419WordPress Churel plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerabilityThemeix Churel
- CVE-2025-30963WordPress JetSmartFilters plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetSmartFilters
- CVE-2025-3027Open Redirect vulnerability in EJBCAPrimeKey Solutions AB EJBCA
- CVE-2025-2991Tenda FH1202 Web Management Interface AdvSetWrlmacfilter access controlTenda FH1202
- CVE-2025-3026Improper Neutralization of Special Elements vulnerability in EJBCAPrimeKey Solutions AB EJBCA
- CVE-2025-2990Tenda FH1202 Web Management Interface AdvSetWrlGstset access controlTenda FH1202
- CVE-2025-31376WordPress NanoSupport plugin <= 0.6.0 - Broken Access Control vulnerabilityMayeenul Islam NanoSupport
- CVE-2025-31386WordPress Simple:Press plugin <= 6.11.5 - Broken Access Control vulnerabilitysimplepress Simple:Press
- CVE-2025-2989Tenda FH1202 Web Management Interface AdvSetWrl access controlTenda FH1202
- CVE-2025-30961WordPress Trackserver plugin <= 5.1.0 - Cross Site Scripting (XSS) vulnerabilitytinuzz Trackserver
- CVE-2025-2985code-projects Payroll Management System update_account.php sql injectioncode-projects Payroll Management System
- CVE-2025-31406WordPress ELEX WooCommerce Request a Quote plugin <= 2.3.9 - Broken Access Control vulnerabilityELEXtensions ELEX WooCommerce Request a Quote
- CVE-2025-2072Reflected Cross-Site Scripting (XSS) Vulnerability in FAST LTA Silent Brick WebUIFAST LTA Silent Brick WebUI
- CVE-2025-2984code-projects Payroll Management System delete.php sql injectioncode-projects Payroll Management System
- CVE-2025-31410WordPress WP Church Donation plugin <= 1.7 - Cross Site Request Forgery (CSRF) vulnerabilityAshish Ajani WP Church Donation
- CVE-2025-2983Legrand SMS PowerView os command injectionLegrand SMS PowerView
- CVE-2025-2982Legrand SMS PowerView file inclusionLegrand SMS PowerView
- CVE-2025-2981Legrand SMS PowerView cross site scriptingLegrand SMS PowerView
- CVE-2025-3019Cross-site scripting vulnerabilities in KNIME Business Hub web pagesKNIME Business Hub
- CVE-2025-2980Legrand SMS PowerView redirectLegrand SMS PowerView
- CVE-2025-31414WordPress Cost Calculator Builder plugin <= 3.2.65 - Cross Site Scripting (XSS) vulnerabilityStylemix Cost Calculator Builder
- CVE-2025-31412WordPress JetProductGallery plugin <= 2.1.22 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetProductGallery
- CVE-2025-30987WordPress JetBlocks For Elementor plugin <= 1.3.16 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetBlocks For Elementor
- CVE-2025-31417WordPress WP Docs plugin < 2.2.7 - Broken Access Control vulnerabilityFahad Mahmood WP Docs
- CVE-2025-31043WordPress JetSearch plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerabilityCrocoblock JetSearch
- CVE-2025-2979WCMS Registration setregister cross site scriptingWCMS
- CVE-2025-0613Photo Gallery < 1.8.34 - Unauthenticated Stored XSSPhoto Gallery by 10Web
- CVE-2025-2978WCMS Article Publishing Page CKEditor unrestricted uploadWCMS
- CVE-2025-2977GFI KerioConnect PDF File cross site scriptingGFI KerioConnect
- CVE-2025-24852Storing passwords in a recoverable format issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions.Inaba Denki Sangyo Co. CHOCO TEI WATCHER mini
- CVE-2025-2976GFI KerioConnect File Upload cross site scriptingGFI KerioConnect
- CVE-2025-2975GFI KerioConnect Signature EditHtmlSource cross site scriptingGFI KerioConnect
- CVE-2025-2974CodeCanyon Perfex CRM Contracts contract cross site scriptingCodeCanyon Perfex CRM
- CVE-2025-2973code-projects College Management System student.php unrestricted uploadcode-projects College Management System
- CVE-2024-55093phpIPAM through 1.7.3 has a reflected Cross-Site Scripting (XSS) vulnerability in the install scripts.phpIPAM