CVEs published April 2, 2025
109 CVEs were published on April 2, 2025: 10 critical, 30 high.
- Published
- 109
- Critical
- 10
- High
- 30
- Medium
- 61
- Low
- 6
- Unrated
- 2
- Now in CISA KEV
- 0
- Fix available
- 35
Most affected products
- Google Chrome
- 9
- Linux
- 8
- STMicroelectronics X-CUBE-AZRT-H7RS · STMicroelectronics… +8
- 7
- Trend Micro Trend Vision One
- 5
- Zabbix
- 5
- AMD Ryzen™ AI Software
- 4
- Dell Wyse Management Suite
- 4
- IBM TXSeries for Multiplatforms
- 4
- Cisco Prime Infrastructure · Cisco Evolved Programmable Net…
- 2
- Hammock AssetView
- 2
Critical 10
- CVE-2025-31484conda-forge infrastructure uses a bad token for Azure's cf-staging accessconda-forge infrastructure
- CVE-2025-31477Improper Scope Validation in the open Endpoint of tauri-plugin-shelltauri-apps plugins-workspace · tauri-plugin-shell +1
- CVE-2025-21988fs/netfs/read_collect: add to next->prev_donatedLinux
- CVE-2025-2005Front-End-Only-Users <= 3.2.32 - Unauthenticated Arbitrary File Uploadrustaurius Front End Users
- CVE-2023-40714A relative path traversal in Fortinet FortiSIEM versions 7.0.0, 6.7.0 through 6.7.2, 6.6.0 through 6.6.3, 6.5.1, 6.5.0 allows attacker to esFortinet FortiSIEM
- CVE-2025-0415Command Injection in NTP SettingMoxa EDF-G1002-BP Series · Moxa EDR-810 Series +6
- CVE-2024-38392Pexip Infinity Connect before 1.13.0 lacks sufficient authenticity checks during the loading of resources, and thus remote attackers can cau
- CVE-2025-29062An issue in BL-AC2100 <=V1.0.4 allows a remote attacker to execute arbitrary code via the time1 and time2 parameters in the set_LimitClient_
- CVE-2025-29063An issue in BL-AC2100 V1.0.4 and before allows a remote attacker to execute arbitrary code via the enable parameter passed to /goform/set_hi
- CVE-2025-29085SQL injection vulnerability in vipshop Saturn v.3.5.1 and before allows a remote attacker to execute arbitrary code via /console/dashboard/ecom.vip.saturn:saturn-console
High 30
- CVE-2025-31479canonical/get-workflow-version-action can leak a partial GITHUB_TOKEN in exception outputcanonical get-workflow-version-action
- CVE-2025-2704OpenVPN version 2.6.1 through 2.6.13 in server mode using TLS-crypt-v2 allows remote attackers to trigger a denial of service by corrupting OpenVPN
- CVE-2024-36336Integer overflow within the AMD NPU Driver could allow a local attacker to write out of bounds, potentially leading to a loss of confidentiaAMD Ryzen™ AI Software
- CVE-2024-36328Integer overflow within AMD NPU Driver could allow a local attacker to write out of bounds, potentially leading to loss of integrity or avaiAMD Ryzen™ AI Software
- CVE-2024-36337Integer overflow within AMD NPU Driver could allow a local attacker to write out of bounds, potentially leading to loss of confidentiality, AMD Ryzen™ AI Software
- CVE-2025-20139A vulnerability in chat messaging features of Cisco Enterprise Chat and Email (ECE) could allow an unauthenticated, remote attacker to causeCisco Enterprise Chat and Email
- CVE-2025-20212A vulnerability in the Cisco AnyConnect VPN server of Cisco Meraki MX and Cisco Meraki Z Series devices could allow an authenticated, remoteCisco Meraki MX Firmware
- CVE-2025-0014Incorrect default permissions on the AMD Ryzen(TM) AI installation folder could allow an attacker to achieve privilege escalation, potentialAMD Ryzen™ AI Software
- CVE-2025-31722In Jenkins Templating Engine Plugin 2.5.3 and earlier, libraries defined in folders are not subject to sandbox protection, allowing attackerJenkins Project Jenkins Templating Engine Plugin · org.jenk…
- CVE-2025-21994ksmbd: fix incorrect validation for num_aces field of smb_aclLinux
- CVE-2024-45064A buffer overflow vulnerability exists in the FileX Internal RAM interface functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0.STMicroelectronics X-CUBE-AZRT-H7RS · STMicroelectronics… +8
- CVE-2025-21993iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic()Linux
- CVE-2025-21991x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodesLinux
- CVE-2025-3063Shopper Approved Reviews 2.0 - 2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Updateshopperapprovedapp Shopper Approved Reviews
- CVE-2024-39780Use of unsafe yaml load in dynparamOpen Source Robotics Foundation Robot Operating System
- CVE-2025-0676Commend Injection Leading to Privilege EscalationMoxa EDF-G1002-BP Series · Moxa EDR-810 Series +6
- CVE-2024-45699Reflected XSS vulnerability in /zabbix.php?action=export.valuemapsZabbix
- CVE-2024-36465SQL injection in Zabbix APIZabbix
- CVE-2025-25060Missing authentication for critical function vulnerability exists in AssetView and AssetView CLOUD.Hammock AssetView
- CVE-2025-3069Inappropriate implementation in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalationGoogle Chrome
- CVE-2025-3068Inappropriate implementation in Intents in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker to perform privilege esGoogle Chrome
- CVE-2025-3067Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker who convinced a useGoogle Chrome
- CVE-2025-3066Use after free in Site Isolation in Google Chrome prior to 135.0.7049.84 allowed a remote attacker to potentially exploit heap corruption viGoogle Chrome
- CVE-2025-29981Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Exposure of Sensitive Information Through Data Queries vulnerability.Dell Wyse Management Suite
- CVE-2024-37917Pexip Infinity before 35.0 has improper input validation that allows remote attackers to trigger a denial of service (software abort) via a
- CVE-2025-22923An issue in OS4ED openSIS v8.0 through v9.1 allows attackers to execute a directory traversal and delete files by sending a crafted POST req
- CVE-2025-22924OS4ED openSIS v7.0 through v9.1 contains a SQL injection vulnerability via the stu_id parameter at /modules/students/Student.php.
- CVE-2025-22925OS4ED openSIS v7.0 to v9.1 was discovered to contain a SQL injection vulnerability via the table parameter at /attendance/AttendanceCodes.ph
- CVE-2025-30080Signalling in Pexip Infinity 29 through 36.2 before 37.0 has improper input validation that allows remote attackers to trigger a temporary d
- CVE-2025-30090mime.php in SquirrelMail through 1.4.23-svn-20250401 and 1.5.x through 1.5.2-svn-20250401 allows XSS via e-mail headers, because JavaScript SquirrelMail
Medium, low and unrated 69
- CVE-2025-3123WonderCMS Theme Installation/Plugin Installation installUpdateModuleAction unrestricted uploadWonderCMS
- CVE-2025-3154Out-of-bounds array write due to invalid VerticesPerRow in Xpdf 4.05Xpdf
- CVE-2025-0257HCL DevOps Deploy / HCL Launch is susceptible to unauthorized access to other servicesHCL Software HCL DevOps Deploy / HCL Launch
- CVE-2025-3122WebAssembly wabt binary-reader-interp.cc BeginFunctionBody null pointer dereferenceWebAssembly wabt · wabt-bin
- CVE-2025-3121PyTorch torch.jit.jit_module_from_flatbuffer memory corruptionPyTorch · torch
- CVE-2025-3120SourceCodester Apartment Visitors Management System add-apartment.php sql injectionSourceCodester Apartment Visitors Management System
- CVE-2025-3119SourceCodester Online Tutor Portal manage_course.php sql injectionSourceCodester Online Tutor Portal
- CVE-2025-30218Next.js may leak x-middleware-subrequest-id to external hostsvercel next.js · next
- CVE-2025-3130Obfuscate - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-029Drupal Obfuscate · drupal/obfuscate
- CVE-2025-3129Access code - Moderately critical - Access bypass - SA-CONTRIB-2025-028Drupal Access code · drupal/access_code
- CVE-2025-27608Self Cross-Site Scripting in Arduino IDEarduino-ide
- CVE-2025-3118SourceCodester Online Tutor Portal view_course.php sql injectionSourceCodester Online Tutor Portal
- CVE-2025-31286An HTML injection vulnerability previously discovered in Trend Vision One could have allowed a malicious user to execute arbitrary code.Trend Micro Trend Vision One
- CVE-2025-31285A broken access control vulnerability previously discovered in the Trend Vision One Role Name component could have allowed an administrator Trend Micro Trend Vision One
- CVE-2025-31284A broken access control vulnerability previously discovered in the Trend Vision One Status component could have allowed an administrator to Trend Micro Trend Vision One
- CVE-2025-31283A broken access control vulnerability previously discovered in the Trend Vision One User Roles component could have allowed an administratorTrend Micro Trend Vision One
- CVE-2025-31282A broken access control vulnerability previously discovered in the Trend Vision One User Account component could have allowed an administratTrend Micro Trend Vision One
- CVE-2025-20203A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure coCisco Prime Infrastructure · Cisco Evolved Programmable Net…
- CVE-2025-20120A vulnerability in the web-based management interface of Cisco Evolved Programmable Network Manager (EPNM) and Cisco Prime Infrastructure coCisco Prime Infrastructure · Cisco Evolved Programmable Net…
- CVE-2024-56476IBM TXSeries for Multiplatforms information disclosureIBM TXSeries for Multiplatforms
- CVE-2024-56475IBM TXSeries for Multiplatforms cross-site scriptingIBM TXSeries for Multiplatforms
- CVE-2024-56474IBM TXSeries for Multiplatforms cross-site request forgeryIBM TXSeries for Multiplatforms
- CVE-2025-0154IBM TXSeries for Multiplatforms information disclosureIBM TXSeries for Multiplatforms
- CVE-2024-56341IBM Content Navigator cross-site scriptingIBM Content Navigator
- CVE-2025-31728Jenkins AsakusaSatellite Plugin 0.1.1 and earlier does not mask AsakusaSatellite API keys displayed on the job configuration form, increasinJenkins Project Jenkins AsakusaSatellite Plugin · org.codef…
- CVE-2025-31727Jenkins AsakusaSatellite Plugin 0.1.1 and earlier stores AsakusaSatellite API keys unencrypted in job config.xml files on the Jenkins controJenkins Project Jenkins AsakusaSatellite Plugin · org.codef…
- CVE-2025-31726Jenkins Stack Hammer Plugin 1.0.6 and earlier stores Stack Hammer API keys unencrypted in job config.xml files on the Jenkins controller wheJenkins Project Jenkins Stack Hammer Plugin · org.jenkins-c…
- CVE-2025-31725Jenkins monitor-remote-job Plugin 1.0 stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be vieweJenkins Project Jenkins monitor-remote-job Plugin · org.uki…
- CVE-2025-31724Jenkins Cadence vManager Plugin 4.0.0-282.v5096a_c2db_275 and earlier stores Verisium Manager vAPI keys unencrypted in job config.xml files Jenkins Project Jenkins Cadence vManager Plugin · org.jenki…
- CVE-2025-31723A cross-site request forgery (CSRF) vulnerability in Jenkins Simple Queue Plugin 1.4.6 and earlier allows attackers to change and reset the Jenkins Project Jenkins Simple Queue Plugin · io.jenkins.pl…
- CVE-2025-31721A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but withouJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2025-31720A missing permission check in Jenkins 2.503 and earlier, LTS 2.492.2 and earlier allows attackers with Computer/Create permission but withouJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2024-25051IBM Jazz Reporting Service insufficient session expirationIBM Jazz Reporting Service
- CVE-2024-50385A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0.STMicroelectronics X-CUBE-AZRT-H7RS · STMicroelectronics… +8
- CVE-2024-50384A denial of service vulnerability exists in the NetX Component HTTP server functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0.STMicroelectronics X-CUBE-AZRT-H7RS · STMicroelectronics… +8
- CVE-2024-50595An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0.STMicroelectronics X-CUBE-AZRT-H7RS · STMicroelectronics… +8
- CVE-2024-50594An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0.STMicroelectronics X-CUBE-AZRT-H7RS · STMicroelectronics… +8
- CVE-2024-50597An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0.STMicroelectronics X-CUBE-AZRT-H7RS · STMicroelectronics… +8
- CVE-2024-50596An integer underflow vulnerability exists in the HTTP server PUT request functionality of STMicroelectronics X-CUBE-AZRTOS-WL 2.0.0.STMicroelectronics X-CUBE-AZRT-H7RS · STMicroelectronics… +8
- CVE-2025-21992HID: ignore non-functional sensor in HP 5MP CameraLinux
- CVE-2025-21990drm/amdgpu: NULL-check BO's backing store when determining GFX12 PTE flagsLinux
- CVE-2025-21989drm/amd/display: fix missing .is_two_pixels_per_containerLinux
- CVE-2025-1805Crypt::Salt for Perl uses insecure rand() function when generating salts for cryptographic purposesHACHI Crypt::Salt
- CVE-2025-21987drm/amdgpu: init return value in amdgpu_ttm_clear_bufferLinux
- CVE-2025-2842Tempo-operator: tempo operator token exposition lead to read sensitive datatempo-operator · Red Hat OpenShift distributed tracing +1
- CVE-2025-2786Tempo-operator: serviceaccount token exposure leading to token and subject access reviews in openshift tempo operatortempo-operator · Red Hat OpenShift distributed tracing +1
- CVE-2025-3097wp Time Machine <= 3.4.0 - Cross-Site Request Forgery to Stored Cross-Site Scriptingpaulgpetty wp Time Machine
- CVE-2025-2483Gift Certificate Creator <= 1.1.0 - Reflected Cross-Site Scripting via receip_address Parameterbobcares_plugins Gift Certificate Creator
- CVE-2024-13637Demo Awesome <= 1.0.3 - Missing Authorization to Authenticated (Subscriber+) Plugin Activationromik84 Demo Awesome
- CVE-2024-12410Front End Users <= 3.2.32 - Authenticated (Admin+) SQL injectionrustaurius Front End Users
- CVE-2025-2513Smart Icons For WordPress <= 1.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Uploadsmartpixels Smart Icons For WordPress
- CVE-2025-3098Video Url <= 1.0.0.3 - Reflected Cross-Site Scriptingulshamim Video Url
- CVE-2025-3099Advanced Search by My Solr Server <= 2.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scriptingdbejean Advanced Search by My Solr Server
- CVE-2024-45700DoS vulnerability due to uncontrolled resource exhaustionZabbix
- CVE-2024-42325Excessive information returned by user.getZabbix
- CVE-2024-36469User enumeration via timing attack in Zabbix web interfaceZabbix
- CVE-2025-27244AssetView and AssetView CLOUD contain an issue with acquiring sensitive information from sent data to the developer.Hammock AssetView
- CVE-2025-2779Insert Headers and Footers Code – HT Script <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Limited Options Updatehtplugins Insert Headers and Footers Code – HT Script
- CVE-2025-3074Inappropriate implementation in Downloads in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform UI spoofing via a craGoogle Chrome
- CVE-2025-3073Inappropriate implementation in Autofill in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage inGoogle Chrome
- CVE-2025-3072Inappropriate implementation in Custom Tabs in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engageGoogle Chrome
- CVE-2025-3071Inappropriate implementation in Navigations in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engageGoogle Chrome
- CVE-2025-3070Insufficient validation of untrusted input in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilGoogle Chrome
- CVE-2025-27692Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Unrestricted Upload of File with Dangerous Type vulnerability.Dell Wyse Management Suite Repository
- CVE-2025-27693Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Improper Neutralization of Input During Web Page Generation ('Cross-site Dell Wyse Management Suite
- CVE-2025-27694Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insufficient Resource Pool vulnerability.Dell Wyse Management Suite
- CVE-2025-29982Dell Wyse Management Suite, versions prior to WMS 5.1, contains an Insecure Inherited Permissions vulnerability.Dell Wyse Management Suite
- CVE-2025-27556An issue was discovered in Django 5.1 before 5.1.8 and 5.0 before 5.0.14.djangoproject Django · django
- CVE-2025-29719SourceCodester (rems) Employee Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in add_employee.php via the First Name and