# CVEs published 2025-03-31

371 CVEs were published on March 31, 2025: 71 critical, 73 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2025-3041](https://cve.now/CVE-2025-3041.md): Project Worlds Online Time Table Generator updatestudent.php unrestricted upload (CVSS 5.3, Project Worlds Online Time Table Generator)
- [CVE-2025-3040](https://cve.now/CVE-2025-3040.md): Project Worlds Online Time Table Generator add\_student.php unrestricted upload (CVSS 5.3, Project Worlds Online Time Table Generator)
- [CVE-2025-3039](https://cve.now/CVE-2025-3039.md): code-projects Payroll Management System add\_employee.php sql injection (CVSS 5.3, code-projects Payroll Management System)
- [CVE-2025-3038](https://cve.now/CVE-2025-3038.md): code-projects Payroll Management System view\_account.php sql injection (CVSS 5.3, code-projects Payroll Management System)
- [CVE-2025-3037](https://cve.now/CVE-2025-3037.md): yzk2356911358 StudentServlet-JSP cross-site request forgery (CVSS 5.3, yzk2356911358 StudentServlet-JSP)
- [CVE-2025-24167](https://cve.now/CVE-2025-24167.md): This issue was addressed through improved state management. (CVSS 9.8, Apple Safari · Apple iOS and iPadOS +2)
- [CVE-2025-30470](https://cve.now/CVE-2025-30470.md): A path handling issue was addressed with improved logic. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-30427](https://cve.now/CVE-2025-30427.md): A use-after-free issue was addressed with improved memory management. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +5)
- [CVE-2025-24262](https://cve.now/CVE-2025-24262.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 5.5, Apple macOS)
- [CVE-2024-40864](https://cve.now/CVE-2024-40864.md): The issue was addressed with improved handling of protocols. (CVSS 2.7, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-24235](https://cve.now/CVE-2025-24235.md): A memory initialization issue was addressed with improved memory handling. (CVSS 5.5, Apple macOS)
- [CVE-2025-24242](https://cve.now/CVE-2025-24242.md): This issue was addressed with improved handling of symlinks. (CVSS 4.4, Apple macOS)
- [CVE-2025-24215](https://cve.now/CVE-2025-24215.md): The issue was addressed with improved checks. (CVSS 5.5, Apple iPadOS · Apple macOS)
- [CVE-2025-24203](https://cve.now/CVE-2025-24203.md): The issue was addressed with improved checks. (CVSS 5.0, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-24192](https://cve.now/CVE-2025-24192.md): A script imports issue was addressed with improved isolation. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +2)
- [CVE-2025-24254](https://cve.now/CVE-2025-24254.md): This issue was addressed with improved validation of symlinks. (CVSS 8.8, Apple macOS)
- [CVE-2025-30450](https://cve.now/CVE-2025-30450.md): This issue was addressed with improved validation of symlinks. (CVSS 5.5, Apple macOS)
- [CVE-2025-31187](https://cve.now/CVE-2025-31187.md): This issue was addressed by removing the vulnerable code. (CVSS 5.5, Apple macOS)
- [CVE-2025-24278](https://cve.now/CVE-2025-24278.md): This issue was addressed with improved validation of symlinks. (CVSS 5.5, Apple macOS)
- [CVE-2025-24281](https://cve.now/CVE-2025-24281.md): This issue was addressed with improved data protection. (CVSS 5.5, Apple macOS)
- [CVE-2025-30446](https://cve.now/CVE-2025-30446.md): A permissions issue was addressed with additional restrictions. (CVSS 6.5, Apple macOS)
- [CVE-2025-24239](https://cve.now/CVE-2025-24239.md): A downgrade issue was addressed with additional code-signing restrictions. (CVSS 6.5, Apple macOS)
- [CVE-2025-31191](https://cve.now/CVE-2025-31191.md): This issue was addressed through improved state management. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-24238](https://cve.now/CVE-2025-24238.md): A logic issue was addressed with improved checks. (CVSS 9.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-30447](https://cve.now/CVE-2025-30447.md): The issue was resolved by sanitizing logging. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-24280](https://cve.now/CVE-2025-24280.md): An access issue was addressed with additional sandbox restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2025-24279](https://cve.now/CVE-2025-24279.md): This issue was addressed with improved file handling. (CVSS 4.3, Apple macOS)
- [CVE-2025-30451](https://cve.now/CVE-2025-30451.md): This issue was addressed with improved redaction of sensitive information. (CVSS 5.5, Apple macOS)
- [CVE-2025-24255](https://cve.now/CVE-2025-24255.md): A file access issue was addressed with improved input validation. (CVSS 8.4, Apple macOS)
- [CVE-2025-24193](https://cve.now/CVE-2025-24193.md): This issue was addressed with improved authentication. (CVSS 2.4, Apple iOS and iPadOS)
- [CVE-2025-24202](https://cve.now/CVE-2025-24202.md): A logging issue was addressed with improved data redaction. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2025-24214](https://cve.now/CVE-2025-24214.md): A privacy issue was addressed by not logging contents of text fields. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-24097](https://cve.now/CVE-2025-24097.md): A permissions issue was addressed with additional restrictions. (CVSS 5.0, Apple iOS and iPadOS · Apple iPadOS +3)
- [CVE-2025-24243](https://cve.now/CVE-2025-24243.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-24234](https://cve.now/CVE-2025-24234.md): This issue was addressed by removing the vulnerable code. (CVSS 7.8, Apple macOS)
- [CVE-2025-24263](https://cve.now/CVE-2025-24263.md): A privacy issue was addressed by moving sensitive data to a protected location. (CVSS 9.8, Apple macOS)
- [CVE-2025-24170](https://cve.now/CVE-2025-24170.md): A logic issue was addressed with improved file handling. (CVSS 7.8, Apple macOS)
- [CVE-2025-30426](https://cve.now/CVE-2025-30426.md): This issue was addressed with additional entitlement checks. (CVSS 9.8, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-24259](https://cve.now/CVE-2025-24259.md): This issue was addressed with additional entitlement checks. (CVSS 9.8, Apple iPadOS · Apple macOS)
- [CVE-2025-30471](https://cve.now/CVE-2025-30471.md): A validation issue was addressed with improved logic. (CVSS 7.5, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-30467](https://cve.now/CVE-2025-30467.md): The issue was addressed with improved checks. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +2)
- [CVE-2025-24218](https://cve.now/CVE-2025-24218.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 5.5, Apple macOS)
- [CVE-2025-30430](https://cve.now/CVE-2025-30430.md): This issue was addressed through improved state management. (CVSS 9.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-24182](https://cve.now/CVE-2025-24182.md): An out-of-bounds read issue was addressed with improved input validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-24244](https://cve.now/CVE-2025-24244.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +3)
- [CVE-2025-24213](https://cve.now/CVE-2025-24213.md): This issue was addressed with improved handling of floats. (CVSS 7.8, Apple Safari · Apple iOS and iPadOS +5)
- [CVE-2025-24205](https://cve.now/CVE-2025-24205.md): An authorization issue was addressed with improved state management. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +1)
- [CVE-2025-24194](https://cve.now/CVE-2025-24194.md): A logic issue was addressed with improved checks. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-30456](https://cve.now/CVE-2025-30456.md): A parsing issue in the handling of directory paths was addressed with improved path validation. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2025-24229](https://cve.now/CVE-2025-24229.md): A logic issue was addressed with improved checks. (CVSS 7.4, Apple macOS)
- [CVE-2025-24157](https://cve.now/CVE-2025-24157.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 5.6, Apple macOS)
- [CVE-2025-24248](https://cve.now/CVE-2025-24248.md): A permissions issue was addressed with additional restrictions. (CVSS 5.0, Apple macOS)
- [CVE-2025-30437](https://cve.now/CVE-2025-30437.md): The issue was addressed with improved bounds checks. (CVSS 7.4, Apple macOS)
- [CVE-2025-30460](https://cve.now/CVE-2025-30460.md): A permissions issue was addressed by removing vulnerable code and adding additional checks. (CVSS 7.4, Apple macOS)
- [CVE-2025-24209](https://cve.now/CVE-2025-24209.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.0, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2025-24198](https://cve.now/CVE-2025-24198.md): This issue was addressed by restricting options offered on a locked device. (CVSS 6.6, Apple iOS and iPadOS · Apple iPadOS +1)
- [CVE-2024-54533](https://cve.now/CVE-2024-54533.md): A permissions issue was addressed with additional sandbox restrictions. (CVSS 7.0, Apple macOS)
- [CVE-2025-24272](https://cve.now/CVE-2025-24272.md): The issue was addressed with improved checks. (CVSS 6.8, Apple macOS)
- [CVE-2025-24264](https://cve.now/CVE-2025-24264.md): The issue was addressed with improved memory handling. (CVSS 9.8, Apple Safari · Apple iOS and iPadOS +5)
- [CVE-2025-24233](https://cve.now/CVE-2025-24233.md): A permissions issue was addressed with additional restrictions. (CVSS 9.8, Apple macOS)
- [CVE-2025-24232](https://cve.now/CVE-2025-24232.md): This issue was addressed through improved state management. (CVSS 9.8, Apple macOS)
- [CVE-2025-24265](https://cve.now/CVE-2025-24265.md): An out-of-bounds read was addressed with improved bounds checking. (CVSS 9.8, Apple macOS)
- [CVE-2025-24273](https://cve.now/CVE-2025-24273.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 9.8, Apple macOS)
- [CVE-2025-24199](https://cve.now/CVE-2025-24199.md): An uncontrolled format string issue was addressed with improved input validation. (CVSS 5.5, Apple macOS)
- [CVE-2025-24208](https://cve.now/CVE-2025-24208.md): A permissions issue was addressed with additional restrictions. (CVSS 6.1, Apple Safari · Apple iOS and iPadOS)
- [CVE-2025-30461](https://cve.now/CVE-2025-30461.md): An access issue was addressed with additional sandbox restrictions on the system pasteboards. (CVSS 9.8, Apple macOS)
- [CVE-2025-24249](https://cve.now/CVE-2025-24249.md): A permissions issue was addressed with additional sandbox restrictions. (CVSS 9.8, Apple macOS)
- [CVE-2025-30441](https://cve.now/CVE-2025-30441.md): This issue was addressed through improved state management. (CVSS 5.5, Apple Xcode)
- [CVE-2025-24269](https://cve.now/CVE-2025-24269.md): The issue was addressed with improved memory handling. (CVSS 9.8, Apple macOS)
- [CVE-2025-24228](https://cve.now/CVE-2025-24228.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2025-30457](https://cve.now/CVE-2025-30457.md): This issue was addressed with improved validation of symlinks. (CVSS 9.8, Apple macOS)
- [CVE-2025-24253](https://cve.now/CVE-2025-24253.md): This issue was addressed with improved handling of symlinks. (CVSS 9.8, Apple macOS)
- [CVE-2025-24195](https://cve.now/CVE-2025-24195.md): An integer overflow was addressed with improved input validation. (CVSS 9.8, Apple macOS)
- [CVE-2025-24204](https://cve.now/CVE-2025-24204.md): The issue was addressed with improved checks. (CVSS 9.8, Apple macOS)
- [CVE-2025-24212](https://cve.now/CVE-2025-24212.md): This issue was addressed with improved checks. (CVSS 6.3, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-24245](https://cve.now/CVE-2025-24245.md): This issue was addressed by adding a delay between verification code attempts. (CVSS 9.8, Apple macOS)
- [CVE-2025-31183](https://cve.now/CVE-2025-31183.md): The issue was addressed with improved restriction of data container access. (CVSS 9.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-30454](https://cve.now/CVE-2025-30454.md): A path handling issue was addressed with improved validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-24250](https://cve.now/CVE-2025-24250.md): This issue was addressed with improved access restrictions. (CVSS 9.8, Apple macOS)
- [CVE-2025-24196](https://cve.now/CVE-2025-24196.md): A type confusion issue was addressed with improved memory handling. (CVSS 8.8, Apple macOS)
- [CVE-2025-24207](https://cve.now/CVE-2025-24207.md): A permissions issue was addressed with additional restrictions. (CVSS 9.8, Apple macOS)
- [CVE-2025-24211](https://cve.now/CVE-2025-24211.md): This issue was addressed with improved memory handling. (CVSS 9.8, Apple iOS and iPadOS · Apple iPadOS +3)
- [CVE-2025-24246](https://cve.now/CVE-2025-24246.md): An injection issue was addressed with improved validation. (CVSS 9.8, Apple macOS)
- [CVE-2025-30439](https://cve.now/CVE-2025-30439.md): The issue was addressed with improved checks. (CVSS 4.6, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-24180](https://cve.now/CVE-2025-24180.md): The issue was addressed with improved input validation. (CVSS 8.1, Apple Safari · Apple iOS and iPadOS +3)
- [CVE-2025-24231](https://cve.now/CVE-2025-24231.md): The issue was addressed with improved checks. (CVSS 9.8, Apple macOS)
- [CVE-2025-24266](https://cve.now/CVE-2025-24266.md): A buffer overflow was addressed with improved bounds checking. (CVSS 9.8, Apple macOS)
- [CVE-2025-30458](https://cve.now/CVE-2025-30458.md): A permissions issue was addressed with additional restrictions. (CVSS 9.8, Apple macOS)
- [CVE-2025-30462](https://cve.now/CVE-2025-30462.md): A library injection issue was addressed with additional restrictions. (CVSS 9.8, Apple macOS)
- [CVE-2025-30435](https://cve.now/CVE-2025-30435.md): This issue was addressed with improved redaction of sensitive information. (CVSS 5.5, Apple macOS)
- [CVE-2025-30434](https://cve.now/CVE-2025-30434.md): The issue was addressed with improved input sanitization. (CVSS 5.0, Apple iOS and iPadOS)
- [CVE-2025-30463](https://cve.now/CVE-2025-30463.md): The issue was addressed with improved restriction of data container access. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2025-24226](https://cve.now/CVE-2025-24226.md): The issue was addressed with improved checks. (CVSS 5.5, Apple Xcode)
- [CVE-2025-24267](https://cve.now/CVE-2025-24267.md): A permissions issue was addressed with additional restrictions. (CVSS 7.8, Apple macOS)
- [CVE-2025-24230](https://cve.now/CVE-2025-24230.md): An out-of-bounds read issue was addressed with improved input validation. (CVSS 9.8, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-30438](https://cve.now/CVE-2025-30438.md): This issue was addressed with improved access restrictions. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-24181](https://cve.now/CVE-2025-24181.md): A permissions issue was addressed with additional restrictions. (CVSS 9.8, Apple macOS)
- [CVE-2025-24247](https://cve.now/CVE-2025-24247.md): A type confusion issue was addressed with improved checks. (CVSS 9.8, Apple macOS)
- [CVE-2025-24210](https://cve.now/CVE-2025-24210.md): A logic error was addressed with improved error handling. (CVSS 5.5, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-24178](https://cve.now/CVE-2025-24178.md): This issue was addressed through improved state management. (CVSS 9.8, Apple iOS and iPadOS · Apple iPadOS +3)
- [CVE-2025-30455](https://cve.now/CVE-2025-30455.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2025-31182](https://cve.now/CVE-2025-31182.md): This issue was addressed with improved handling of symlinks. (CVSS 9.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2025-30443](https://cve.now/CVE-2025-30443.md): A privacy issue was addressed by removing the vulnerable code. (CVSS 5.5, Apple macOS)
- [CVE-2025-31194](https://cve.now/CVE-2025-31194.md): An authentication issue was addressed with improved state management. (CVSS 9.8, Apple macOS)
- [CVE-2025-24237](https://cve.now/CVE-2025-24237.md): A buffer overflow was addressed with improved bounds checking. (CVSS 9.8, Apple iOS and iPadOS · Apple iPadOS +3)
- [CVE-2025-24260](https://cve.now/CVE-2025-24260.md): The issue was addressed with improved memory handling. (CVSS 9.8, Apple macOS)
- [CVE-2025-24276](https://cve.now/CVE-2025-24276.md): This issue was addressed by removing the vulnerable code. (CVSS 5.5, Apple macOS)
- [CVE-2025-24221](https://cve.now/CVE-2025-24221.md): This issue was addressed with improved data access restriction. (CVSS 7.5, Apple iOS and iPadOS · Apple iPadOS +1)
- [CVE-2025-30425](https://cve.now/CVE-2025-30425.md): This issue was addressed through improved state management. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2025-24173](https://cve.now/CVE-2025-24173.md): This issue was addressed with additional entitlement checks. (CVSS 7.8, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-30464](https://cve.now/CVE-2025-30464.md): An out-of-bounds write issue was addressed with improved bounds checking. (CVSS 7.8, Apple macOS)
- [CVE-2025-30433](https://cve.now/CVE-2025-30433.md): This issue was addressed with improved access restrictions. (CVSS 9.8, Apple iOS and iPadOS · Apple iPadOS +3)
- [CVE-2025-30444](https://cve.now/CVE-2025-30444.md): A race condition was addressed with improved locking. (CVSS 9.8, Apple macOS)
- [CVE-2025-24283](https://cve.now/CVE-2025-24283.md): A logging issue was addressed with improved data redaction. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-30452](https://cve.now/CVE-2025-30452.md): The issue was addressed with improved checks. (CVSS 9.8, Apple macOS)
- [CVE-2025-24256](https://cve.now/CVE-2025-24256.md): The issue was addressed with improved bounds checks. (CVSS 9.8, Apple macOS)
- [CVE-2025-24190](https://cve.now/CVE-2025-24190.md): The issue was addressed with improved memory handling. (CVSS 9.8, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-30429](https://cve.now/CVE-2025-30429.md): A path handling issue was addressed with improved validation. (CVSS 6.3, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-24217](https://cve.now/CVE-2025-24217.md): This issue was addressed with improved redaction of sensitive information. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-24240](https://cve.now/CVE-2025-24240.md): A race condition was addressed with additional validation. (CVSS 4.7, Apple macOS)
- [CVE-2025-24241](https://cve.now/CVE-2025-24241.md): A configuration issue was addressed with additional restrictions. (CVSS 9.8, Apple macOS)
- [CVE-2025-30469](https://cve.now/CVE-2025-30469.md): This issue was addressed through improved state management. (CVSS 2.4, Apple iOS and iPadOS)
- [CVE-2025-24095](https://cve.now/CVE-2025-24095.md): This issue was addressed with additional entitlement checks. (CVSS 7.6, Apple iOS and iPadOS · Apple visionOS)
- [CVE-2025-24216](https://cve.now/CVE-2025-24216.md): The issue was addressed with improved memory handling. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +5)
- [CVE-2025-24191](https://cve.now/CVE-2025-24191.md): The issue was addressed with improved validation of environment variables. (CVSS 5.5, Apple macOS)
- [CVE-2025-30428](https://cve.now/CVE-2025-30428.md): This issue was addressed through improved state management. (CVSS 5.4, Apple iOS and iPadOS · Apple iPadOS)
- [CVE-2025-24257](https://cve.now/CVE-2025-24257.md): An out-of-bounds write issue was addressed with improved input validation. (CVSS 7.1, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2025-31184](https://cve.now/CVE-2025-31184.md): This issue was addressed with improved permissions checking. (CVSS 7.8, Apple Safari · Apple iOS and iPadOS +2)
- [CVE-2025-24282](https://cve.now/CVE-2025-24282.md): A library injection issue was addressed with additional restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2025-31192](https://cve.now/CVE-2025-31192.md): The issue was addressed with improved checks. (CVSS 6.7, Apple Safari · Apple iOS and iPadOS +1)
- [CVE-2025-30432](https://cve.now/CVE-2025-30432.md): A logic issue was addressed with improved state management. (CVSS 6.4, Apple iOS and iPadOS · Apple iPadOS +4)
- [CVE-2025-24164](https://cve.now/CVE-2025-24164.md): A logic issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2025-30465](https://cve.now/CVE-2025-30465.md): A permissions issue was addressed with improved validation. (CVSS 9.8, Apple iPadOS · Apple macOS)
- [CVE-2025-30424](https://cve.now/CVE-2025-30424.md): A logging issue was addressed with improved data redaction. (CVSS 9.8, Apple macOS)
- [CVE-2025-24172](https://cve.now/CVE-2025-24172.md): A permissions issue was addressed with additional sandbox restrictions. (CVSS 9.8, Apple macOS)
- [CVE-2025-31188](https://cve.now/CVE-2025-31188.md): A race condition was addressed with additional validation. (CVSS 7.8, Apple macOS)
- [CVE-2025-24277](https://cve.now/CVE-2025-24277.md): A parsing issue in the handling of directory paths was addressed with improved path validation. (CVSS 7.8, Apple macOS)
- [CVE-2025-3062](https://cve.now/CVE-2025-3062.md): Drupal Admin LTE theme - Critical - Unsupported - SA-CONTRIB-2025-010 (CVSS 6.6, Drupal Admin LTE theme · drupal/druadmin\_lte\_theme)
- [CVE-2025-24261](https://cve.now/CVE-2025-24261.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2025-24148](https://cve.now/CVE-2025-24148.md): This issue was addressed with improved handling of executable types. (CVSS 5.5, Apple macOS)
- [CVE-2025-24236](https://cve.now/CVE-2025-24236.md): An access issue was addressed with additional sandbox restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2025-30449](https://cve.now/CVE-2025-30449.md): A permissions issue was addressed with additional restrictions. (CVSS 7.8, Apple macOS)
- [CVE-2025-3061](https://cve.now/CVE-2025-3061.md): Material Admin - Critical - Unsupported - SA-CONTRIB-2025-006 (CVSS 6.6, Drupal Material Admin · drupal/material\_admin)
- [CVE-2025-3060](https://cve.now/CVE-2025-3060.md): Flattern – Multipurpose Bootstrap Business Profile - Critical - Unsupported - SA-CONTRIB-2025-005 (CVSS 6.6, Drupal Flattern – Multipurpose Bootstrap Business Profile)
- [CVE-2025-3059](https://cve.now/CVE-2025-3059.md): Profile Private - Critical - Unsupported - SA-CONTRIB-2025-002 (CVSS 5.3, Drupal Profile Private · drupal/profile\_private)
- [CVE-2025-3036](https://cve.now/CVE-2025-3036.md): yzk2356911358 StudentServlet-JSP Student Management cross site scripting (CVSS 4.8, yzk2356911358 StudentServlet-JSP)
- [CVE-2025-3018](https://cve.now/CVE-2025-3018.md): SourceCodester Online Eyewear Shop Users.php sql injection (CVSS 5.3, SourceCodester Online Eyewear Shop)
- [CVE-2025-31697](https://cve.now/CVE-2025-31697.md): Formatter Suite - Moderately critical - Cross site scripting - SA-CONTRIB-2025-026 (CVSS 6.1, Drupal Formatter Suite · drupal/formatter\_suite)
- [CVE-2025-31696](https://cve.now/CVE-2025-31696.md): RapiDoc OAS Field Formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-025 (CVSS 6.1, Drupal RapiDoc OAS Field Formatter · drupal/rapidoc\_element…)
- [CVE-2025-31695](https://cve.now/CVE-2025-31695.md): Link field display mode formatter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-024 (CVSS 6.1, Drupal Link field display mode formatter · drupal/link\_fiel…)
- [CVE-2025-31694](https://cve.now/CVE-2025-31694.md): Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2025-023 (CVSS 8.1, Drupal Two-factor Authentication · drupal/tfa)
- [CVE-2025-31693](https://cve.now/CVE-2025-31693.md): AI (Artificial Intelligence) - Moderately critical - Gadget Chain - SA-CONTRIB-2025-022 (CVSS 6.6, Drupal AI · drupal/ai)
- [CVE-2025-26683](https://cve.now/CVE-2025-26683.md): Azure Playwright Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Azure Playwright)
- [CVE-2025-31692](https://cve.now/CVE-2025-31692.md): AI (Artificial Intelligence) - Critical - Remote Code Execution - SA-CONTRIB-2025-021 (CVSS 7.5, Drupal AI · drupal/ai)
- [CVE-2025-31691](https://cve.now/CVE-2025-31691.md): OAuth2 Server - Moderately critical - Access bypass - SA-CONTRIB-2025-020 (CVSS 9.8, Drupal OAuth2 Server · drupal/oauth2\_server)
- [CVE-2025-31690](https://cve.now/CVE-2025-31690.md): Cache Utility - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-019 (CVSS 8.8, Drupal Cache Utility · drupal/cache\_utility)
- [CVE-2025-31689](https://cve.now/CVE-2025-31689.md): General Data Protection Regulation - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-018 (CVSS 8.1, Drupal General Data Protection Regulation · drupal/gdpr)
- [CVE-2025-31688](https://cve.now/CVE-2025-31688.md): Configuration Split - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-017 (CVSS 6.8, Drupal Configuration Split · drupal/config\_split)
- [CVE-2025-31687](https://cve.now/CVE-2025-31687.md): SpamSpan filter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-016 (CVSS 6.1, Drupal SpamSpan filter · drupal/spamspan)
- [CVE-2025-31686](https://cve.now/CVE-2025-31686.md): Open Social - Less critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-015 (CVSS 8.1, Drupal Open Social · goalgorilla/open\_social)
- [CVE-2025-31685](https://cve.now/CVE-2025-31685.md): Open Social - Moderately critical - Access bypass - SA-CONTRIB-2025-014 (CVSS 9.1, Drupal Open Social · goalgorilla/open\_social)
- [CVE-2025-31684](https://cve.now/CVE-2025-31684.md): OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013 (CVSS 6.8, Drupal OAuth2 Client · drupal/oauth2\_client)
- [CVE-2025-31683](https://cve.now/CVE-2025-31683.md): Google Tag - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-012 (CVSS 6.8, Drupal Google Tag · drupal/google\_tag)
- [CVE-2025-31682](https://cve.now/CVE-2025-31682.md): Google Tag - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-011 (CVSS 4.8, Drupal Google Tag · drupal/google\_tag)
- [CVE-2025-31681](https://cve.now/CVE-2025-31681.md): Authenticator Login - Critical - Access bypass - SA-CONTRIB-2025-009 (CVSS 9.8, Drupal Authenticator Login · drupal/alogin)
- [CVE-2025-31680](https://cve.now/CVE-2025-31680.md): Matomo Analytics - Moderately critical - Cross site request forgery - SA-CONTRIB-2025-008 (CVSS 6.8, Drupal Matomo Analytics · drupal/matomo)
- [CVE-2025-31679](https://cve.now/CVE-2025-31679.md): Ignition Error Pages - Critical - Cross Site Scripting - SA-CONTRIB-2025-007 (CVSS 6.1, Drupal Ignition Error Pages · drupal/ignition)
- [CVE-2025-31678](https://cve.now/CVE-2025-31678.md): AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004 (CVSS 8.2, Drupal AI · drupal/ai)
- [CVE-2025-31677](https://cve.now/CVE-2025-31677.md): AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003 (CVSS 8.8, Drupal AI · drupal/ai)
- [CVE-2025-31676](https://cve.now/CVE-2025-31676.md): Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001 (CVSS 8.8, Drupal Email TFA · drupal/email\_tfa)
- [CVE-2025-31675](https://cve.now/CVE-2025-31675.md): Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2025-004 (CVSS 5.4, Drupal core · Drupal Link +1)
- [CVE-2025-31674](https://cve.now/CVE-2025-31674.md): Drupal core - Moderately critical - Gadget Chain - SA-CORE-2025-003 (CVSS 7.5, Drupal core · drupal/core)
- [CVE-2025-31673](https://cve.now/CVE-2025-31673.md): Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002 (CVSS 4.6, Drupal core · drupal/core)
- [CVE-2025-3057](https://cve.now/CVE-2025-3057.md): Drupal core - Critical - Cross site scripting - SA-CORE-2025-001 (CVSS 6.1, Drupal core · drupal/core)
- [CVE-2025-3017](https://cve.now/CVE-2025-3017.md): TA-Lib ta\_regtest test\_minmax.c setInputBuffer out-of-bounds write (CVSS 4.8, TA-Lib)
- [CVE-2025-3016](https://cve.now/CVE-2025-3016.md): Open Asset Import Library Assimp MDL File MDLMaterialLoader.cpp ParseTextureColorData resource consumption (CVSS 5.3, Open Asset Import Library Assimp · pyassimp)
- [CVE-2024-24456](https://cve.now/CVE-2024-24456.md): An E-RAB Release Command packet containing a malformed NAS PDU will cause the Athonet MME to immediately crash, potentially due to a buffer (CVSS 5.9, Hewlett Packard Enterprise (HPE) HPE Athonet Core)
- [CVE-2025-3015](https://cve.now/CVE-2025-3015.md): Open Asset Import Library Assimp ASE File ASELoader.cpp BuildUniqueRepresentation out-of-bounds (CVSS 5.3, Open Asset Import Library Assimp · pyassimp)
- [CVE-2025-3010](https://cve.now/CVE-2025-3010.md): Khronos Group glslang Intermediate.cpp isConversionAllowed null pointer dereference (CVSS 4.8, Khronos Group glslang)
- [CVE-2025-21893](https://cve.now/CVE-2025-21893.md): keys: Fix UAF in key\_put() (CVSS 7.8, Linux)
- [CVE-2025-31124](https://cve.now/CVE-2025-31124.md): Zitadel allows User Enumeration by loginname attribute normalization (CVSS 5.3, zitadel)
- [CVE-2025-31123](https://cve.now/CVE-2025-31123.md): Zitadel Expired JWT Keys Usable for Authorization Grants (CVSS 8.7, zitadel)
- [CVE-2025-3009](https://cve.now/CVE-2025-3009.md): Jinher Network OA NetDiskProperty.aspx sql injection (CVSS 5.3, Jinher Network OA)
- [CVE-2025-31129](https://cve.now/CVE-2025-31129.md): jooby-pac4j: deserialization of untrusted data (CVSS 8.8, jooby-project jooby · io.jooby:jooby-pac4j)
- [CVE-2025-3008](https://cve.now/CVE-2025-3008.md): Novastar CX40 NetFilter Utility netconfig popen command injection (CVSS 5.1, Novastar CX40)
- [CVE-2025-31128](https://cve.now/CVE-2025-31128.md): gifplayer XSS vulnerability (CVSS 6.9, rubentd gifplayer · gifplayer +1)
- [CVE-2025-29908](https://cve.now/CVE-2025-29908.md): Netty QUIC hash collision DoS attack (CVSS 5.3, netty-incubator-codec-quic · io.netty.incubator:netty-incub…)
- [CVE-2025-3007](https://cve.now/CVE-2025-3007.md): Novastar CX40 NetFilter Utility netconfig getopt stack-based overflow (CVSS 5.1, Novastar CX40)
- [CVE-2025-3006](https://cve.now/CVE-2025-3006.md): PHPGurukul e-Diary Management System edit-category.php sql injection (CVSS 6.9, PHPGurukul e-Diary Management System)
- [CVE-2025-3005](https://cve.now/CVE-2025-3005.md): Sayski ForestBlog Friend Link cross site scripting (CVSS 5.1, Sayski ForestBlog)
- [CVE-2025-31125](https://cve.now/CVE-2025-31125.md): Vite has a \`server.fs.deny\` bypassed for \`inline\` and \`raw\` with \`?import\` query (CVSS 5.3, KEV, vitejs vite · vite)
- [CVE-2025-3004](https://cve.now/CVE-2025-3004.md): Sayski ForestBlog search cross site scripting (CVSS 5.1, Sayski ForestBlog)
- [CVE-2025-31122](https://cve.now/CVE-2025-31122.md): scratch-coding-hut.github.io Login Links Generation vulnerability (CVSS 9.0, Scratch-Coding-Hut)
- [CVE-2025-30006](https://cve.now/CVE-2025-30006.md): Xorcom CompletePBX \<= 5.2.35 Reflected Cross-Site Scripting (CVSS 6.1, Xorcom CompletePBX)
- [CVE-2025-31117](https://cve.now/CVE-2025-31117.md): OpenEMR Out-of-Band Server-Side Request Forgery (OOB SSRF) Vulnerability (CVSS 6.9, openemr)
- [CVE-2025-30005](https://cve.now/CVE-2025-30005.md): Xorcom CompletePBX \<= 5.2.35 Authenticated Path Traversal & File Deletion (CVSS 8.3, Xorcom CompletePBX)
- [CVE-2025-31116](https://cve.now/CVE-2025-31116.md): Mobile Security Framework (MobSF) has a SSRF Vulnerability fix bypass on assetlinks\_check with DNS Rebinding (CVSS 4.4, Mobile-Security-Framework-MobSF · mobsf)
- [CVE-2025-30004](https://cve.now/CVE-2025-30004.md): Xorcom CompletePBX \<= 5.2.35 Task Scheduler Authenticated Command Injection (CVSS 8.8, Xorcom CompletePBX)
- [CVE-2025-2292](https://cve.now/CVE-2025-2292.md): Xorcom CompletePBX \<= 5.2.35 Authenticated File Disclosure (CVSS 6.5, Xorcom CompletePBX)
- [CVE-2025-30369](https://cve.now/CVE-2025-30369.md): Zulip allows the deletion of Custom profile fields by administrators of a different organization (CVSS 2.7, zulip)
- [CVE-2025-3003](https://cve.now/CVE-2025-3003.md): ESAFENET CDG UserAjax sql injection (CVSS 5.3, ESAFENET CDG)
- [CVE-2025-30368](https://cve.now/CVE-2025-30368.md): Zulip allows the deletion of organization by administrators of a different organization (CVSS 2.7, zulip)
- [CVE-2025-2794](https://cve.now/CVE-2025-2794.md): Kentico Xperience \<= 13.0.180 Unsafe Reflection (CVSS 8.7, Kentico Xperience)
- [CVE-2025-30223](https://cve.now/CVE-2025-30223.md): Beego allows Reflected/Stored XSS in Beego's RenderForm() Function Due to Unescaped User Input (CVSS 9.3, beego · github.com/beego/beego/v2 +1)
- [CVE-2025-30161](https://cve.now/CVE-2025-30161.md): OpenEMR Stored XSS in OpenEMR Bronchitis Form (CVSS 8.4, openemr)
- [CVE-2025-30149](https://cve.now/CVE-2025-30149.md): OpenEMR Reflected XSS in AJAX Script (CVSS 6.4, openemr)
- [CVE-2025-29772](https://cve.now/CVE-2025-29772.md): OpenEMR allows Reflected XSS in CAMOS new.php (CVSS 7.2, openemr)
- [CVE-2025-1449](https://cve.now/CVE-2025-1449.md): Admin Shell Access Vulnerability in Rockwell Automation Verve Asset Manager (CVSS 7.5, Rockwell Automation Verve Asset Manager)
- [CVE-2025-3002](https://cve.now/CVE-2025-3002.md): Digital China DCME-520 mon\_merge\_stat\_hist.php os command injection (CVSS 6.9, Digital China DCME-520)
- [CVE-2025-30155](https://cve.now/CVE-2025-30155.md): Tuleap does not enforce read permissions on parent trackers in the REST API (CVSS 4.3, Enalean tuleap)
- [CVE-2025-30209](https://cve.now/CVE-2025-30209.md): Tuleap has improper permission handling in the REST endpoints and release notes display of the FRS plugin (CVSS 5.3, Enalean tuleap)
- [CVE-2025-30203](https://cve.now/CVE-2025-30203.md): Tuleap allows XSS via the content of RSS feeds in the RSS widgets (CVSS 4.8, Enalean tuleap)
- [CVE-2025-29929](https://cve.now/CVE-2025-29929.md): Tuleap is missing CSRF protection on tracker hierarchy administration (CVSS 4.6, Enalean tuleap)
- [CVE-2025-29766](https://cve.now/CVE-2025-29766.md): Tuleap has missing CSRF protections on artifact submission & edition from the tracker view (CVSS 4.6, Enalean tuleap)
- [CVE-2025-27149](https://cve.now/CVE-2025-27149.md): Zulip exports can leak private data (CVSS 4.6, zulip)
- [CVE-2025-3001](https://cve.now/CVE-2025-3001.md): PyTorch torch.lstm\_cell memory corruption (CVSS 4.8, PyTorch · torch)
- [CVE-2025-3048](https://cve.now/CVE-2025-3048.md): Path Traversal in AWS SAM CLI allows file copy to local cache (CVSS 6.9, AWS Serverless Application Model Command Line Interface · a…)
- [CVE-2025-3047](https://cve.now/CVE-2025-3047.md): Path Traversal in AWS SAM CLI allows file copy to build container (CVSS 6.9, AWS Serverless Application Model Command Line Interface · a…)
- [CVE-2025-27095](https://cve.now/CVE-2025-27095.md): JumpServer has a Kubernetes Token Leak Vulnerability (CVSS 4.3, jumpserver)
- [CVE-2025-3000](https://cve.now/CVE-2025-3000.md): PyTorch torch.jit.script memory corruption (CVSS 4.8, PyTorch · torch)
- [CVE-2023-33302](https://cve.now/CVE-2023-33302.md): A buffer copy without checking size of input ('classic buffer overflow') in Fortinet FortiMail webmail and administrative interface version (CVSS 4.5, Fortinet FortiNDR · Fortinet FortiMail)
- [CVE-2025-2999](https://cve.now/CVE-2025-2999.md): PyTorch torch.nn.utils.rnn.unpack\_sequence memory corruption (CVSS 4.8, PyTorch · torch)
- [CVE-2024-12021](https://cve.now/CVE-2024-12021.md): Stored Cross-Site Scripting (CVSS 8.5, Black Duck Coverity)
- [CVE-2025-2998](https://cve.now/CVE-2025-2998.md): PyTorch torch.nn.utils.rnn.pad\_packed\_sequence memory corruption (CVSS 4.8, PyTorch · torch)
- [CVE-2025-2997](https://cve.now/CVE-2025-2997.md): zhangyanbo2007 youkefu url server-side request forgery (CVSS 5.3, zhangyanbo2007 youkefu)
- [CVE-2023-0881](https://cve.now/CVE-2023-0881.md): DDoS in Ubuntu package linux-bluefield (CVSS 7.5, Ubuntu package linux-bluefield)
- [CVE-2025-2996](https://cve.now/CVE-2025-2996.md): Tenda FH1202 Web Management Interface SysToolDDNS access control (CVSS 6.9, Tenda FH1202)
- [CVE-2025-31629](https://cve.now/CVE-2025-31629.md): WordPress Infusionsoft Web Form JavaScript plugin \<= 1.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jacob Allred Infusionsoft Web Form JavaScript)
- [CVE-2025-31627](https://cve.now/CVE-2025-31627.md): WordPress Media Library Assistant plugin \<= 3.24 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 5.9, David Lingren Media LIbrary Assistant)
- [CVE-2025-31625](https://cve.now/CVE-2025-31625.md): WordPress Useinfluence plugin \<= 1.0.8 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 7.1, ramanparashar Useinfluence)
- [CVE-2025-31624](https://cve.now/CVE-2025-31624.md): WordPress Processing Projects plugin \<= 1.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, LABCAT Processing Projects)
- [CVE-2025-31623](https://cve.now/CVE-2025-31623.md): WordPress Rich Text Editor plugin \<= 1.0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, richtexteditor Rich Text Editor)
- [CVE-2025-31621](https://cve.now/CVE-2025-31621.md): WordPress byBrick Accordion plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, davidpaulsson byBrick Accordion)
- [CVE-2025-31620](https://cve.now/CVE-2025-31620.md): WordPress CoverManager plugin \<= 0.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, carperfer CoverManager)
- [CVE-2025-31618](https://cve.now/CVE-2025-31618.md): WordPress Connector to CiviCRM with CiviMcRestFace plugin \<= 1.0.10 - Broken Access Control vulnerability (CVSS 5.3, Jaap Jansma Connector to CiviCRM with CiviMcRestFace)
- [CVE-2025-31617](https://cve.now/CVE-2025-31617.md): WordPress PostmarkApp Email Integrator plugin \<= 2.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, Gagan Deep Singh PostmarkApp Email Integrator)
- [CVE-2025-31616](https://cve.now/CVE-2025-31616.md): WordPress Varnish WordPress plugin \<= 1.7 - CSRF to Stored XSS vulnerability (CVSS 7.1, AdminGeekZ Varnish WordPress)
- [CVE-2025-31615](https://cve.now/CVE-2025-31615.md): WordPress Simple Contact Forms plugin \<= 1.6.4 - CSRF to Stored XSS vulnerability (CVSS 7.1, owenr88 Simple Contact Forms)
- [CVE-2025-31614](https://cve.now/CVE-2025-31614.md): WordPress Terms Before Download plugin \<= 1.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, hiroprot Terms Before Download)
- [CVE-2025-31613](https://cve.now/CVE-2025-31613.md): WordPress AB Google Map Travel plugin \<= 4.6 - CSRF to Stored XSS vulnerability (CVSS 7.1, Aboobacker. AB Google Map Travel)
- [CVE-2025-31611](https://cve.now/CVE-2025-31611.md): WordPress Auto Post After Image Upload plugin \<= 1.6 - Broken Access Control vulnerability (CVSS 4.3, Shaharia Azam Auto Post After Image Upload)
- [CVE-2025-31610](https://cve.now/CVE-2025-31610.md): WordPress Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, gingerplugins Notification Bar, Sticky Notification Bar, St…)
- [CVE-2025-31609](https://cve.now/CVE-2025-31609.md): WordPress WPCargo Track & Trace plugin \<= 8.0.2 - Insecure Direct Object References (IDOR) vulnerability (CVSS 4.3, Arni Cinco WPCargo Track & Trace)
- [CVE-2025-31608](https://cve.now/CVE-2025-31608.md): WordPress CookieHint WP plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, reDim CookieHint WP)
- [CVE-2025-31607](https://cve.now/CVE-2025-31607.md): WordPress Simple-Audioplayer plugin \<= 1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, flomei Simple-Audioplayer)
- [CVE-2025-31606](https://cve.now/CVE-2025-31606.md): WordPress SP Blog Designer plugin \<= 1.0.0 - Arbitrary Shortcode Execution vulnerability (CVSS 4.8, softpulseinfotech SP Blog Designer)
- [CVE-2025-31605](https://cve.now/CVE-2025-31605.md): WordPress Welcome Popup plugin \<= 1.0.10 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WeblineIndia Welcome Popup)
- [CVE-2025-31604](https://cve.now/CVE-2025-31604.md): WordPress Cal.com plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Cal.com)
- [CVE-2025-31603](https://cve.now/CVE-2025-31603.md): WordPress CF7 Spreadsheets plugin \<= 2.3.2 - Settings Change vulnerability (CVSS 5.4, moshensky CF7 Spreadsheets)
- [CVE-2025-31602](https://cve.now/CVE-2025-31602.md): WordPress Apimo Connector plugin \<= 2.6.5.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Proptech Plugin Apimo Connector)
- [CVE-2025-31601](https://cve.now/CVE-2025-31601.md): WordPress Appointy Appointment Scheduler plugin \<= 4.2.1 - CSRF to Settings Change vulnerability (CVSS 6.5, Appointy Appointment Scheduler)
- [CVE-2025-31600](https://cve.now/CVE-2025-31600.md): WordPress DesignO plugin \<= 2.6.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, designnbuy DesignO)
- [CVE-2025-31598](https://cve.now/CVE-2025-31598.md): WordPress Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin \<= 4.0.3 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPFactory Quantity Dynamic Pricing & Bulk Discounts for Woo…)
- [CVE-2025-31597](https://cve.now/CVE-2025-31597.md): WordPress Ultimate Live Cricket WordPress Lite plugin \<= 1.4.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, crazycric Ultimate Live Cricket WordPress Lite)
- [CVE-2025-31596](https://cve.now/CVE-2025-31596.md): WordPress Chat by Chatwee plugin \<= 2.1.3 - Broken Access Control vulnerability (CVSS 4.3, Chat by Chatwee)
- [CVE-2025-31595](https://cve.now/CVE-2025-31595.md): WordPress Timeline Event History plugin \<= 3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, wpdiscover Timeline Event History)
- [CVE-2025-31593](https://cve.now/CVE-2025-31593.md): WordPress OpenMenu plugin \<= 3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, OpenMenu)
- [CVE-2025-31592](https://cve.now/CVE-2025-31592.md): WordPress Send E-mail plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Paolo Melchiorre Send E-mail)
- [CVE-2025-31591](https://cve.now/CVE-2025-31591.md): WordPress Exit Popup Free plugin \<= 1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, promoz73 Exit Popup Free)
- [CVE-2025-31590](https://cve.now/CVE-2025-31590.md): WordPress WP Date and Time Shortcode plugin \<= 2.6.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Denra.com WP Date and Time Shortcode)
- [CVE-2025-31589](https://cve.now/CVE-2025-31589.md): WordPress Ethiopian Calendar plugin \<= 1.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Kibru Demeke Ethiopian Calendar)
- [CVE-2025-31588](https://cve.now/CVE-2025-31588.md): WordPress Elfsight Testimonials Slider plugin \<= 1.0.1 - Cross Site Request Forgery (CSRF) to Settings Change vulnerability (CVSS 5.4, Elfsight Testimonials Slider)
- [CVE-2025-31587](https://cve.now/CVE-2025-31587.md): WordPress Elfsight Testimonials Slider plugin \<= 1.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Elfsight Testimonials Slider)
- [CVE-2025-31586](https://cve.now/CVE-2025-31586.md): WordPress Gallery – Photo Albums Plugin plugin \<= 1.3.170 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.5, GhozyLab Gallery – Photo Albums Plugin)
- [CVE-2025-31585](https://cve.now/CVE-2025-31585.md): WordPress Leadfox for WordPress plugin \<= 2.1.9 - CSRF to Stored XSS vulnerability (CVSS 7.1, Leadfox for WordPress)
- [CVE-2025-31584](https://cve.now/CVE-2025-31584.md): WordPress Elfsight Testimonials Slider plugin \<= 1.0.1 - Broken Access Control vulnerability (CVSS 5.4, Elfsight Testimonials Slider)
- [CVE-2025-31583](https://cve.now/CVE-2025-31583.md): WordPress WP Copy Media URL plugin \<= 2.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, Ashish Ajani WP Copy Media URL)
- [CVE-2025-31577](https://cve.now/CVE-2025-31577.md): WordPress Appointify plugin \<= 1.0.8 - Arbitrary File Upload vulnerability (CVSS 6.6, Appointify)
- [CVE-2025-31576](https://cve.now/CVE-2025-31576.md): WordPress PostmarkApp Email Integrator plugin \<= 2.4 - Broken Access Control vulnerability (CVSS 4.3, Gagan Deep Singh PostmarkApp Email Integrator)
- [CVE-2025-31575](https://cve.now/CVE-2025-31575.md): WordPress Flag Icons plugin \<= 2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Vasilis Triantafyllou Flag Icons)
- [CVE-2025-31574](https://cve.now/CVE-2025-31574.md): WordPress Custom Content Scrollbar plugin \<= 1.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SoftHopper Custom Content Scrollbar)
- [CVE-2025-31572](https://cve.now/CVE-2025-31572.md): WordPress Multi Days Events and Multi Events in One Day Calendar plugin \<= 1.1.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, v20202020 Multi Days Events and Multi Events in One Day Cal…)
- [CVE-2025-31570](https://cve.now/CVE-2025-31570.md): WordPress Related Posts Widget with Thumbnails plugin \<= 1.2 - CSRF to Stored XSS vulnerability (CVSS 7.1, wp-buy Related Posts Widget with Thumbnails)
- [CVE-2025-31569](https://cve.now/CVE-2025-31569.md): WordPress wordpress related Posts with thumbnails plugin \<= 3.0.0.1 - CSRF to Stored XSS vulnerability (CVSS 7.1, wp-buy wordpress related Posts with thumbnails)
- [CVE-2025-31567](https://cve.now/CVE-2025-31567.md): WordPress Themesflat Addons For Elementor plugin \<= 2.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, themesflat-addons-for-elementor)
- [CVE-2025-31566](https://cve.now/CVE-2025-31566.md): WordPress Rio Video Gallery plugin \<= 2.3.6 - CSRF to Stored XSS vulnerability (CVSS 7.1, riosisgroup Rio Video Gallery)
- [CVE-2025-31562](https://cve.now/CVE-2025-31562.md): WordPress Uptime Robot Plugin for WordPress plugin \<= 2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Aphotrax Uptime Robot Plugin for WordPress)
- [CVE-2025-31559](https://cve.now/CVE-2025-31559.md): WordPress Custom Database Applications by Caspio plugin \<= 2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Caspio Bridge Custom Database Applications by Caspio)
- [CVE-2025-31557](https://cve.now/CVE-2025-31557.md): WordPress OSM plugin \<= 6.1.13 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, MiKa OSM)
- [CVE-2025-31556](https://cve.now/CVE-2025-31556.md): WordPress IMPress for IDX Broker plugin \<= 3.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, IMPress for IDX Broker)
- [CVE-2025-31555](https://cve.now/CVE-2025-31555.md): WordPress ContentMX Content Publisher plugin \<= 1.0.6 - Broken Access Control vulnerability (CVSS 5.4, ContentMX Content Publisher)
- [CVE-2025-31549](https://cve.now/CVE-2025-31549.md): WordPress Fusion plugin \<= 1.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Agency Dominion Fusion)
- [CVE-2025-31547](https://cve.now/CVE-2025-31547.md): WordPress Uptime Robot Plugin for WordPress plugin \<= 2.3 - SQL Injection vulnerability (CVSS 8.5, Aphotrax Uptime Robot Plugin for WordPress)
- [CVE-2025-31546](https://cve.now/CVE-2025-31546.md): WordPress Swiss Toolkit For WP plugin \<= 1.4.0 - Broken Access Control vulnerability (CVSS 4.3, WP Messiah Swiss Toolkit For WP)
- [CVE-2025-31545](https://cve.now/CVE-2025-31545.md): WordPress Safe Ai Malware Protection for WP plugin \<= 1.0.20 - Broken Access Control vulnerability (CVSS 5.4, WP Messiah Safe Ai Malware Protection for WP)
- [CVE-2025-31544](https://cve.now/CVE-2025-31544.md): WordPress Swiss Toolkit For WP plugin \<= 1.4.5 - Broken Access Control vulnerability (CVSS 4.3, WP Messiah Swiss Toolkit For WP)
- [CVE-2025-31543](https://cve.now/CVE-2025-31543.md): WordPress Twice Commerce plugin \<= 1.3.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Twice Commerce)
- [CVE-2025-31542](https://cve.now/CVE-2025-31542.md): WordPress My auctions allegro plugin \<= 3.6.20 - SQL Injection vulnerability (CVSS 8.5, wphocus My auctions allegro)
- [CVE-2025-31540](https://cve.now/CVE-2025-31540.md): WordPress ACME Divi Modules plugin \<= 1.3.5 - Broken Access Control vulnerability (CVSS 4.3, acmemediakits ACME Divi Modules)
- [CVE-2025-31539](https://cve.now/CVE-2025-31539.md): WordPress Cryptocurrency Widgets Pack plugin \<= 2.0.1 - Broken Access Control vulnerability (CVSS 6.5, Blocksera Cryptocurrency Widgets Pack)
- [CVE-2025-31538](https://cve.now/CVE-2025-31538.md): WordPress Checklist plugin \<= 1.1.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, checklistcom Checklist)
- [CVE-2025-31535](https://cve.now/CVE-2025-31535.md): WordPress Simple Owl Carousel plugin \<= 1.1.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, PressTigers Simple Owl Carousel)
- [CVE-2025-31533](https://cve.now/CVE-2025-31533.md): WordPress Salesmate Add-On for Gravity Forms plugin \<= 2.0.3 - Broken Access Control vulnerability (CVSS 5.3, Salesmate.io Salesmate Add-On for Gravity Forms)
- [CVE-2025-31532](https://cve.now/CVE-2025-31532.md): WordPress AtomChat plugin \<= 1.1.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Team AtomChat AtomChat)
- [CVE-2025-31530](https://cve.now/CVE-2025-31530.md): WordPress Google SEO Pressor Snippet plugin \<= 2.0 - Broken Access Control vulnerability (CVSS 4.3, Smackcoders Inc., Google SEO Pressor Snippet)
- [CVE-2025-31529](https://cve.now/CVE-2025-31529.md): WordPress Slider Path for Elementor plugin \<= 3.0.0 - Broken Access Control vulnerability (CVSS 4.3, Rashid Slider Path for Elementor)
- [CVE-2025-31528](https://cve.now/CVE-2025-31528.md): WordPress StaticPress plugin \<= 0.4.5 - Broken Access Control vulnerability (CVSS 4.3, wokamoto StaticPress)
- [CVE-2025-31527](https://cve.now/CVE-2025-31527.md): WordPress WP Link Preview plugin \<= 1.4.1 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.4, Kishan WP Link Preview)
- [CVE-2025-31526](https://cve.now/CVE-2025-31526.md): WordPress Behance Portfolio Manager plugin \<= 1.7.5 - SQL Injection vulnerability (CVSS 8.5, eleopard Behance Portfolio Manager)
- [CVE-2025-2995](https://cve.now/CVE-2025-2995.md): Tenda FH1202 Web Management Interface SysToolChangePwd access control (CVSS 6.9, Tenda FH1202)
- [CVE-2025-2994](https://cve.now/CVE-2025-2994.md): Tenda FH1202 Web Management Interface qossetting access control (CVSS 6.9, Tenda FH1202)
- [CVE-2025-2586](https://cve.now/CVE-2025-2586.md): Ols: unauthenticated metrics flooding in openshift lightspeed service leading to resource exhaustion (CVSS 7.5, lightspeed-service · Red Hat OpenShift Lightspeed)
- [CVE-2025-2993](https://cve.now/CVE-2025-2993.md): Tenda FH1202 default.cfg access control (CVSS 6.9, Tenda FH1202)
- [CVE-2025-3022](https://cve.now/CVE-2025-3022.md): OS Command Injection vulnerability in e-management of e-solutions (CVSS 9.3, e-solutions e-management)
- [CVE-2025-2992](https://cve.now/CVE-2025-2992.md): Tenda FH1202 Web Management Interface AdvSetWrlsafeset access control (CVSS 6.9, Tenda FH1202)
- [CVE-2025-23995](https://cve.now/CVE-2025-23995.md): WordPress Tantyyellow theme \<= 1.0.0.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, ta2g Tantyyellow)
- [CVE-2025-31419](https://cve.now/CVE-2025-31419.md): WordPress Churel plugin \<= 1.0.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Themeix Churel)
- [CVE-2025-30963](https://cve.now/CVE-2025-30963.md): WordPress JetSmartFilters plugin \<= 3.6.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetSmartFilters)
- [CVE-2025-3027](https://cve.now/CVE-2025-3027.md): Open Redirect vulnerability in EJBCA (CVSS 5.1, PrimeKey Solutions AB EJBCA)
- [CVE-2025-2991](https://cve.now/CVE-2025-2991.md): Tenda FH1202 Web Management Interface AdvSetWrlmacfilter access control (CVSS 6.9, Tenda FH1202)
- [CVE-2025-3026](https://cve.now/CVE-2025-3026.md): Improper Neutralization of Special Elements vulnerability in EJBCA (CVSS 5.1, PrimeKey Solutions AB EJBCA)
- [CVE-2025-3021](https://cve.now/CVE-2025-3021.md): Path Traversal vulnerability in e-management of e-solutions (CVSS 8.7, e-solutions e-management)
- [CVE-2025-2990](https://cve.now/CVE-2025-2990.md): Tenda FH1202 Web Management Interface AdvSetWrlGstset access control (CVSS 6.9, Tenda FH1202)
- [CVE-2025-31376](https://cve.now/CVE-2025-31376.md): WordPress NanoSupport plugin \<= 0.6.0 - Broken Access Control vulnerability (CVSS 4.3, Mayeenul Islam NanoSupport)
- [CVE-2025-31386](https://cve.now/CVE-2025-31386.md): WordPress Simple:Press plugin \<= 6.11.5 - Broken Access Control vulnerability (CVSS 5.3, simplepress Simple:Press)
- [CVE-2025-2989](https://cve.now/CVE-2025-2989.md): Tenda FH1202 Web Management Interface AdvSetWrl access control (CVSS 6.9, Tenda FH1202)
- [CVE-2025-30961](https://cve.now/CVE-2025-30961.md): WordPress Trackserver plugin \<= 5.1.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, tinuzz Trackserver)
- [CVE-2025-2985](https://cve.now/CVE-2025-2985.md): code-projects Payroll Management System update\_account.php sql injection (CVSS 5.3, code-projects Payroll Management System)
- [CVE-2025-31406](https://cve.now/CVE-2025-31406.md): WordPress ELEX WooCommerce Request a Quote plugin \<= 2.3.9 - Broken Access Control vulnerability (CVSS 4.3, ELEXtensions ELEX WooCommerce Request a Quote)
- [CVE-2025-2072](https://cve.now/CVE-2025-2072.md): Reflected Cross-Site Scripting (XSS) Vulnerability in FAST LTA Silent Brick WebUI (CVSS 5.1, FAST LTA Silent Brick WebUI)
- [CVE-2025-2071](https://cve.now/CVE-2025-2071.md): OS Command Injection Vulnerability in FAST LTA Silent Brick WebUI (CVSS 10.0, FAST LTA Silent Brick WebUI)
- [CVE-2025-2984](https://cve.now/CVE-2025-2984.md): code-projects Payroll Management System delete.php sql injection (CVSS 5.3, code-projects Payroll Management System)
- [CVE-2025-31410](https://cve.now/CVE-2025-31410.md): WordPress WP Church Donation plugin \<= 1.7 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Ashish Ajani WP Church Donation)
- [CVE-2025-2983](https://cve.now/CVE-2025-2983.md): Legrand SMS PowerView os command injection (CVSS 5.1, Legrand SMS PowerView)
- [CVE-2025-2982](https://cve.now/CVE-2025-2982.md): Legrand SMS PowerView file inclusion (CVSS 5.3, Legrand SMS PowerView)
- [CVE-2025-2981](https://cve.now/CVE-2025-2981.md): Legrand SMS PowerView cross site scripting (CVSS 5.1, Legrand SMS PowerView)
- [CVE-2025-3019](https://cve.now/CVE-2025-3019.md): Cross-site scripting vulnerabilities in KNIME Business Hub web pages (CVSS 5.3, KNIME Business Hub)
- [CVE-2025-2980](https://cve.now/CVE-2025-2980.md): Legrand SMS PowerView redirect (CVSS 5.1, Legrand SMS PowerView)
- [CVE-2025-2402](https://cve.now/CVE-2025-2402.md): Hard-coded password for object store of KNIME Business Hub (CVSS 8.8, KNIME Business Hub)
- [CVE-2025-31414](https://cve.now/CVE-2025-31414.md): WordPress Cost Calculator Builder plugin \<= 3.2.65 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Stylemix Cost Calculator Builder)
- [CVE-2025-31412](https://cve.now/CVE-2025-31412.md): WordPress JetProductGallery plugin \<= 2.1.22 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetProductGallery)
- [CVE-2025-31387](https://cve.now/CVE-2025-31387.md): WordPress InstaWP Connect plugin \<= 0.1.0.82 - Local File Inclusion vulnerability (CVSS 7.5, InstaWP Connect)
- [CVE-2025-31016](https://cve.now/CVE-2025-31016.md): WordPress JetWooBuilder plugin \<= 2.1.18 - Local File Inclusion vulnerability (CVSS 7.5, Crocoblock JetWooBuilder)
- [CVE-2025-30987](https://cve.now/CVE-2025-30987.md): WordPress JetBlocks For Elementor plugin \<= 1.3.16 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetBlocks For Elementor)
- [CVE-2025-30855](https://cve.now/CVE-2025-30855.md): WordPress Ads by WPQuads plugin \<= 2.0.87.1 - Broken Access Control Vulnerability (CVSS 7.5, Ads by WPQuads)
- [CVE-2025-30835](https://cve.now/CVE-2025-30835.md): WordPress Accounting for WooCommerce plugin \<= 1.6.8 - Local File Inclusion vulnerability (CVSS 7.5, Bastien Ho Accounting for WooCommerce)
- [CVE-2025-31417](https://cve.now/CVE-2025-31417.md): WordPress WP Docs plugin \< 2.2.7 - Broken Access Control vulnerability (CVSS 4.3, Fahad Mahmood WP Docs)
- [CVE-2025-31043](https://cve.now/CVE-2025-31043.md): WordPress JetSearch plugin \<= 3.5.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crocoblock JetSearch)
- [CVE-2025-2979](https://cve.now/CVE-2025-2979.md): WCMS Registration setregister cross site scripting (CVSS 4.8, WCMS)
- [CVE-2025-0613](https://cve.now/CVE-2025-0613.md): Photo Gallery \< 1.8.34 - Unauthenticated Stored XSS (CVSS 6.1, Photo Gallery by 10Web)
- [CVE-2025-2978](https://cve.now/CVE-2025-2978.md): WCMS Article Publishing Page CKEditor unrestricted upload (CVSS 5.3, WCMS)
- [CVE-2025-2977](https://cve.now/CVE-2025-2977.md): GFI KerioConnect PDF File cross site scripting (CVSS 5.1, GFI KerioConnect)
- [CVE-2025-31103](https://cve.now/CVE-2025-31103.md): Untrusted data deserialization vulnerability exists in a-blog cms. (CVSS 7.5, appleple a-blog cms)
- [CVE-2025-26689](https://cve.now/CVE-2025-26689.md): Direct request ('Forced Browsing') issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. (CVSS 9.8, Inaba Denki Sangyo Co. CHOCO TEI WATCHER mini)
- [CVE-2025-25211](https://cve.now/CVE-2025-25211.md): Weak password requirements issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. (CVSS 9.8, Inaba Denki Sangyo Co. CHOCO TEI WATCHER mini)
- [CVE-2025-24852](https://cve.now/CVE-2025-24852.md): Storing passwords in a recoverable format issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. (CVSS 4.6, Inaba Denki Sangyo Co. CHOCO TEI WATCHER mini)
- [CVE-2025-24517](https://cve.now/CVE-2025-24517.md): Use of client-side authentication issue exists in CHOCO TEI WATCHER mini (IB-MCT001) all versions. (CVSS 7.5, Inaba Denki Sangyo Co. CHOCO TEI WATCHER mini)
- [CVE-2025-2976](https://cve.now/CVE-2025-2976.md): GFI KerioConnect File Upload cross site scripting (CVSS 5.1, GFI KerioConnect)
- [CVE-2025-2975](https://cve.now/CVE-2025-2975.md): GFI KerioConnect Signature EditHtmlSource cross site scripting (CVSS 5.1, GFI KerioConnect)
- [CVE-2025-3014](https://cve.now/CVE-2025-3014.md): Insecure direct object references (IDOR) in NightWolf Penetration Platform (CVSS 8.3, FPT Software NightWolf Penetration Platform)
- [CVE-2025-3013](https://cve.now/CVE-2025-3013.md): Insecure direct object references (IDOR) in NightWolf Penetration Platform (CVSS 8.3, FPT Software NightWolf Penetration Platform)
- [CVE-2025-2974](https://cve.now/CVE-2025-2974.md): CodeCanyon Perfex CRM Contracts contract cross site scripting (CVSS 5.1, CodeCanyon Perfex CRM)
- [CVE-2025-3011](https://cve.now/CVE-2025-3011.md): PiExtract SOOP-CLM - SQL Injection (CVSS 9.8, PiExtract SOOP-CLM)
- [CVE-2025-2973](https://cve.now/CVE-2025-2973.md): code-projects College Management System student.php unrestricted upload (CVSS 5.3, code-projects College Management System)
- [CVE-2025-1268](https://cve.now/CVE-2025-1268.md): Out-of-bounds vulnerability in EMF Recode processing of Generic Plus PCL6 Printer Driver / Generic Plus UFR II Printer Driver / Generic Plus (CVSS 9.4, Canon Generic Plus PCL6 Printer Driver · Canon Generic… +12)
- [CVE-2024-54802](https://cve.now/CVE-2024-54802.md): In Netgear WNR854T 1.5.2 (North America), the UPNP service (/usr/sbin/upnp) is vulnerable to stack-based buffer overflow in the M-SEARCH Hos (CVSS 9.8)
- [CVE-2024-54803](https://cve.now/CVE-2024-54803.md): Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. (CVSS 9.8)
- [CVE-2024-54804](https://cve.now/CVE-2024-54804.md): Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. (CVSS 9.8)
- [CVE-2024-54805](https://cve.now/CVE-2024-54805.md): Netgear WNR854T 1.5.2 (North America) is vulnerable to Command Injection. (CVSS 9.8)
- [CVE-2024-54806](https://cve.now/CVE-2024-54806.md): Netgear WNR854T 1.5.2 (North America) is vulnerable to Arbitrary command execution in cmd.cgi which allows for the execution of system comma (CVSS 9.8)
- [CVE-2024-54807](https://cve.now/CVE-2024-54807.md): In Netgear WNR854T 1.5.2 (North America), the UPNP service is vulnerable to command injection in the function addmap\_exec which parses the N (CVSS 9.8)
- [CVE-2024-54808](https://cve.now/CVE-2024-54808.md): Netgear WNR854T 1.5.2 (North America) contains a stack-based buffer overflow vulnerability in the SetDefaultConnectionService function due t (CVSS 9.8)
- [CVE-2024-54809](https://cve.now/CVE-2024-54809.md): Netgear Inc WNR854T 1.5.2 (North America) contains a stack-based buffer overflow vulnerability in the parse\_st\_header function due to use of (CVSS 9.8)
- [CVE-2024-55093](https://cve.now/CVE-2024-55093.md): phpIPAM through 1.7.3 has a reflected Cross-Site Scripting (XSS) vulnerability in the install scripts. (CVSS 5.4, phpIPAM)
- [CVE-2025-22937](https://cve.now/CVE-2025-22937.md): An issue in Adtran 411 ONT vL80.00.0011.M2 allows attackers to escalate privileges via unspecified vectors. (CVSS 9.8)
- [CVE-2025-22938](https://cve.now/CVE-2025-22938.md): Adtran 411 ONT L80.00.0011.M2 was discovered to contain weak default passwords. (CVSS 9.8)
- [CVE-2025-22939](https://cve.now/CVE-2025-22939.md): A command injection vulnerability in the telnet service of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and (CVSS 9.8)
- [CVE-2025-22940](https://cve.now/CVE-2025-22940.md): Incorrect access control in Adtran 411 ONT L80.00.0011.M2 allows unauthorized attackers to arbitrarily set the admin password. (CVSS 9.1)
- [CVE-2025-22941](https://cve.now/CVE-2025-22941.md): A command injection vulnerability in the web interface of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and (CVSS 9.8)
- [CVE-2025-29266](https://cve.now/CVE-2025-29266.md): Unraid 7.0.0 before 7.0.1 allows remote users to access the Unraid WebGUI and web console as root without authentication if a container is r (CVSS 9.6, Unraid)
- [CVE-2025-30095](https://cve.now/CVE-2025-30095.md): VyOS 1.3 through 1.5 (fixed in 1.4.2) or any Debian-based system using dropbear in combination with live-build has the same Dropbear private (CVSS 9.0, VyOS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2025-03-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.